nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

New Scam Alert: Fake ChatGPT Plus "Payment Failed" Phishing

CSEC

I just spotted this one landing in inboxes, and it’s a perfect example of how scammers are pivoting to target AI users. They’re banking on the "fear of losing access" to GPT-5 or your custom workflows to make you act without thinking.

Red Flag	Why it’s suspicious
The Sender Address	The email came from infos@bwb-bonn.de. This is a compromised German domain, not openai.com.
The Link	Hovering over the "Update" button reveals a messy URL: [removed by admin] OpenAI will never host their billing on a random Bluehost subdomain.
The Hook	It uses "Sense of Urgency" (Your sub will expire soon) and "Loss Aversion" (avoiding interruption mid-thought).
The Footers	While they copied the OpenAI office address correctly, the "Unsubscribe" and "Privacy Policy" links likely lead to the same credential-stealing site.

This is a credential and credit card harvester. If you click that link and "update" your info, you aren't paying OpenAI—you're handing your wallet to a scammer.

Stay sharp, everyone! 🙂

Find more posts tagged with

phishing attempt

scam alert

Comments

CSEC

I've edited the post as I wasnt done typing. Its under review - likely due to an image being shared.

Alexandru_BD

Hi and thanks for sharing your findings here.
I wasn't able to find your additional comment, the one with the image you mentioned in the moderation queue.
I have, however, edited your intial post due to the link shared. Posting malware samples and /or URLs is not allowed in the community. Please do not post direct links to any executable files, malicious/suspicious software or websites in threads, comments or private messages, even if you think the software or site is clean and incorrectly detected by Bitdefender. Should you wish to report a false positive / false negative detection, head to this link and submit your findings using the dedicated form.

We are doing this to protect our readers and prevent them from accessing dangerous URLs or files by mistake.

Once again, thank you for raising awareness about this. You may still provide relevant information in the form of text or image, but please refrain from posting any hyperlinks or embedded URLs that may lead to harmful content.
I appreciate your understanding and intention to help. 👍️