# Fake ChatGPT and OpenAI subscription emails: how to tell if one is real

URL: https://iblockspam.com/blog/fake-chatgpt-openai-subscription-phishing
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake ChatGPT and OpenAI billing emails steal logins and cards, which domains OpenAI really uses, how to check your plan, and what to do if you clicked.

## Short answer

A fake ChatGPT subscription email claims your payment failed or your plan will be suspended, then links to a fake login or payment page. Don't click it. Open chatgpt.com yourself and check Settings > Billing. If nothing is wrong there, the email is fake. OpenAI's help center lists its real sending domains, such as openai.com and mail.openai.com.

"Your ChatGPT Plus payment was declined. Update your billing details within 48 hours to avoid losing access." Emails like this copy the look of a real OpenAI receipt, but the button leads to a fake login or payment page. This guide shows how to check any ChatGPT billing email in a minute, which domains OpenAI says it really uses, and what to do, as a user or an admin, if someone clicked.

## What is a fake ChatGPT subscription email?

A fake ChatGPT subscription email is a phishing message that pretends to come from OpenAI's billing team. It says your ChatGPT Plus, Pro or Business payment failed, that your plan is about to be suspended, or that you've been charged for a renewal you didn't expect. Its goal is to get you to enter your card details or your ChatGPT password on a page the scammer controls.

These emails are not a sign that OpenAI was hacked. Scammers copy popular brands because many people have accounts with them, so a billing problem sounds believable. The FTC lists exactly this pattern as a phishing warning sign: an email that "says your account is on hold because of a billing problem" and "invites you to click on a link to update your payment details" ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)).

### Common versions of the lure

| Lure | What it says | What it wants |
|---|---|---|
| Payment failed | "We couldn't process your payment. Update your card to keep ChatGPT Plus." | Card number, expiry date, security code |
| Subscription suspended | "Your account will be suspended in 24 hours." | ChatGPT password, sometimes MFA code |
| Unexpected renewal | "You've been charged for ChatGPT Pro. Not you? Cancel here." | Login or a phone call to a fake "support" number |
| Account verification | "Verify your email to keep using ChatGPT." | Password |
| Fake workspace invite | "You've been invited to a ChatGPT workspace." | Work password on a fake sign-in page |

The "not you? call us" version is [callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails): there's no link at all, just a phone number answered by the scammer. Microsoft 365 users see the same billing trick in [fake subscription expired emails](https://iblockspam.com/blog/fake-microsoft-365-subscription-expired-emails).

### Example of a fake ChatGPT billing email

This is an **example** written for this guide. It is not a real OpenAI email.

```
From: ChatGPT Billing <billing@chatgpt-renewal-support.com>
Subject: Action required: your ChatGPT Plus payment was declined

Hi there,

We were unable to process the payment for your ChatGPT Plus
subscription. To avoid interruption, please update your payment
method within 48 hours.

Plan: ChatGPT Plus
Status: Payment failed

[ Update payment method ]

If no action is taken, your subscription and saved chats
will be suspended.

The OpenAI Team
```

The warning signs: a sender domain that isn't one of OpenAI's, a generic "Hi there", a short deadline, a threat to your saved chats, and a button instead of an instruction to sign in yourself. The checks below work even when a fake looks perfect.

## How do I check if a ChatGPT billing email is real?

Check your account directly, never through the email. A real billing problem will be visible inside ChatGPT, so you never need the email's button.

1. **Don't click anything in the email.** Not the button, not the "unsubscribe" link, not the phone number.
2. **Open ChatGPT yourself.** Type `chatgpt.com` into your browser or use the official app.
3. **Go to Settings > Billing.** OpenAI's [cancellation guide](https://help.openai.com/en/articles/7232927) gives this path for subscriptions bought on chatgpt.com: open your account menu, select **Settings**, then **Billing**. For a self-service ChatGPT Business plan, it's **Workspace settings** > **Billing**.
4. **Compare.** If your plan is active and no payment is overdue, the email is fake. Delete it after reporting it. OpenAI's [charges guidance](https://help.openai.com/en/articles/7242625) gives the same advice for any charge you don't recognize: first check the invoices on your billing page to see whether it matches a real subscription or credit purchase.
5. **If you subscribed through Apple or Google Play, check there.** OpenAI's cancellation guide says Apple manages App Store subscriptions and that Google Play subscriptions are handled in Google Play, while a plan bought on chatgpt.com doesn't appear in either store. So if a store bills you, a "ChatGPT" email asking you to update a card on some web page doesn't match how you pay.
6. **Report the email** with your mail app's report button (see [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email)).

### Which email domains does OpenAI really use?

OpenAI's help article [Verifying Communications from OpenAI](https://help.openai.com/en/articles/11725090-verifying-communications-from-openai) says that, as a customer, you may receive emails from these domains (at the time of writing, November 2026):

- `@openai.com`
- `@mail.openai.com`
- `@sales.openai.com`
- `@tm.openai.com` (used for workspace and GPT invites from `noreply@tm.openai.com`)
- `@c-openai.com`

The same page lists OpenAI's official website (openai.com), support site (help.openai.com) and status page (status.openai.com). It also warns that OpenAI will "never go into details of your account over social media."

The only phone number the page lists is 1-800-CHATGPT, which it describes as an experimental way to use ChatGPT itself by phone call or WhatsApp. It isn't presented as a billing or support line, so an email that tells you to call a "ChatGPT billing department" is a red flag.

A domain on this list is a good sign, but it isn't proof. Display names are easy to fake (see [display name spoofing](https://iblockspam.com/blog/display-name-spoofing)), and any service that lets users send invitations can be misused to send unwanted ones. A domain not on the list, such as `openai-billing.net` or `chatgpt-support.co`, is a reliable sign of a fake. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) explains the tricks.

To see where a message really came from, paste its headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). It shows the SPF, DKIM and DMARC results; our guide to [reading email headers](https://iblockspam.com/blog/how-to-read-email-headers) explains them.

### Real vs fake ChatGPT billing email

| Check | Real OpenAI email | Fake |
|---|---|---|
| Sender domain | One of the domains OpenAI lists | Lookalike or unrelated domain |
| Matches Settings > Billing | Yes | No |
| Deadline or threat to delete chats | Unusual | Common |
| Payment link destination | chatgpt.com or OpenAI's own pages | A lookalike checkout or login page |
| Asks you to call a number about a charge | Not part of OpenAI's billing help | Common in callback scams |
| Subscription bought in an app store | Managed by Apple or Google | Asks you to update a card by email |

## What should I do if I clicked a fake ChatGPT email?

What to do depends on what you entered. Work through the steps that apply, and do them from a device you trust.

### If you entered your ChatGPT password

1. **Change your password.** OpenAI's [fraud guidance](https://help.openai.com/en/articles/7242626) says to choose "a strong, unique password that you haven't used elsewhere."
2. **Log out of all devices.** The same page says to select "Log out of all sessions" in your account settings. In ChatGPT, OpenAI's [MFA guide](https://help.openai.com/en/articles/7967234) puts this under **Settings** > **Security and login** > **Log out of all devices**, and says it may take up to 30 minutes for every session to end.
3. **Turn on multi-factor authentication (MFA).** MFA means a second check, such as a code from an app, at sign-in. OpenAI's [MFA guide](https://help.openai.com/en/articles/7967234) says to go to ChatGPT **Settings** > **Security and login**, then choose a method. It offers authenticator apps, push notifications, text messages and passkeys. A passkey is a sign-in credential stored on your device that won't work on a lookalike site.
4. **Rotate API keys** if you use the OpenAI API platform and think a key was exposed.
5. **Change the password anywhere else you reused it.**

### If you entered card details

1. **Call your card issuer now**, using the number on your card, and ask them to block it. OpenAI's [charges guidance](https://help.openai.com/en/articles/7242625) "strongly" recommends contacting your bank immediately if you believe a charge is unauthorized.
2. **Report the fraud to OpenAI** if your account or card was used. OpenAI asks you to use its Fraudulent Activity webform and choose "Report unauthorized activity involving my account" ([OpenAI](https://help.openai.com/en/articles/7242626)).
3. **Watch your statements** for small test charges over the next few weeks.

If you only opened the email or clicked without typing anything, close the page and report the message. Our step-by-step guide to [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers the rest, including checks for attachments and downloads.

## Why do fake ChatGPT emails matter to businesses?

Fake ChatGPT emails matter at work for three reasons. Staff often pay for ChatGPT with a company card. Chat history can contain company information, and anyone who takes over the account can read it. And if staff sign in to ChatGPT with their work Microsoft or Google account, a fake "ChatGPT sign-in" page may ask for that work password instead, which is far more valuable to an attacker.

The same lure is easy to aim at teams: a fake "invitation to your company's ChatGPT workspace" looks like routine IT work. Write one rule into staff training: a ChatGPT invite or billing problem is checked inside ChatGPT, or with IT, never through the email. Our guide to [security awareness training for small businesses](https://iblockspam.com/blog/email-security-awareness-training-small-business) shows how to make rules like that stick.

## What should an admin do about fake OpenAI emails?

An admin's job is to remove the email from every mailbox, block it, and reset anyone who entered details. Work in this order.

1. **Find who received it.** In Microsoft 365, search by sender, subject or URL in [Threat Explorer or Real-time detections](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections). In Google Workspace, use the [security investigation tool](https://iblockspam.com/blog/google-workspace-security-investigation-tool) or [email log search](https://iblockspam.com/blog/google-workspace-email-log-search).
2. **Remove it.** Delete or move the message from all mailboxes from the same tool; our guide to [removing a phishing email from all mailboxes in Microsoft 365](https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365) has the exact steps. Microsoft 365 can also pull back delivered mail automatically with [zero-hour auto purge](https://iblockspam.com/blog/microsoft-365-zero-hour-auto-purge-zap).
3. **Block the sender and the link.** Add the sending domain and the phishing URL to the [Tenant Allow/Block List](https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list) in Microsoft 365, or to a blocked senders list in Gmail settings.
4. **Ask who clicked.** Check URL click data where you have it, and ask staff directly. Make it easy to admit a click.
5. **Reset affected users.** For a work password typed into a fake page, follow [how to tell if an email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised): reset the password, revoke sessions, and check for [malicious inbox rules and forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).
6. **Tell staff.** Send a short note with a screenshot of the fake and the rule: check Settings > Billing yourself.
7. **Ask staff to turn on MFA themselves.** OpenAI's MFA guide says MFA can't currently be enforced at the ChatGPT workspace or API Platform organization level, so each person has to switch it on in their own settings. Turning MFA on doesn't sign out other sessions, so anyone who typed a password into a fake page should also log out of all devices.

Built-in filtering catches many of these emails, but new lookalike domains slip through, especially in the first hours of a campaign. An MX-level filter checks inbound mail for phishing and spoofing before it reaches Microsoft 365 or Google Workspace, and holds suspect messages in a quarantine each user can review. If your team keeps seeing brand-impersonation emails, our page for [small businesses](https://iblockspam.com/solutions/small-business) explains how iBlockSpam adds that layer.

## Next steps

1. Tell staff the one rule: ChatGPT billing is checked at chatgpt.com > Settings > Billing, never through an email.
2. Turn on MFA for every ChatGPT account that holds work data, and prefer passkeys.
3. Share OpenAI's [list of real sending domains](https://help.openai.com/en/articles/11725090-verifying-communications-from-openai) with whoever handles reported phishing.
4. Run the free [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator) on your own domain, since the same tricks are used to impersonate you.
5. If phishing keeps reaching inboxes, see how iBlockSpam protects [small businesses](https://iblockspam.com/solutions/small-business).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What email addresses does OpenAI really send from?

OpenAI's help center lists five sending domains at the time of writing (November 2026): @openai.com, @mail.openai.com, @sales.openai.com, @tm.openai.com and @c-openai.com. Workspace and GPT invites come from noreply@tm.openai.com. A billing email from any other domain, such as chatgpt-billing-support.com, is not from OpenAI. A real domain alone still doesn't prove an email is safe.

### Does OpenAI email you when a ChatGPT Plus payment fails?

Treat any payment email as a prompt to check, not to click. Sign in at chatgpt.com by typing the address, open Settings and then Billing, and look at your plan and invoices. If your plan is active and nothing is overdue, the email was fake. If you pay through Apple or Google Play, check the subscription in that store, because OpenAI says those subscriptions are managed there.

### I entered my card on a fake ChatGPT payment page. What now?

Call your card issuer straight away, using the number on the back of the card, and ask them to block the card and watch for fraud. OpenAI's own fraud guidance also recommends contacting your bank immediately about unauthorized charges. Then change your ChatGPT password, log out of all sessions, and report the email.

### How do I report a fake OpenAI email?

Use your mail app's report button first, such as Report phishing in Gmail or Outlook. In the US you can also forward it to reportphishing@apwg.org and report it at ReportFraud.ftc.gov. If someone used your OpenAI account or card, OpenAI asks you to use its Fraudulent Activity webform and choose Report unauthorized activity involving my account.

### Why do scammers copy ChatGPT billing emails?

Because millions of people pay for ChatGPT, a payment-failed email looks plausible to many readers. The scam can steal card details, the ChatGPT password, or both. A stolen account also exposes chat history, which at work may include company information, and the password may be reused on other services.

## Sources

- [OpenAI Help Center: Verifying Communications from OpenAI](https://help.openai.com/en/articles/11725090-verifying-communications-from-openai)
- [OpenAI Help Center: How can I report fraud or suspicious activity?](https://help.openai.com/en/articles/7242626)
- [OpenAI Help Center: Canceling your ChatGPT subscription](https://help.openai.com/en/articles/7232927)
- [OpenAI Help Center: Report Fraudulent ChatGPT or API Credit Purchase Charges](https://help.openai.com/en/articles/7242625)
- [OpenAI Help Center: Managing multi-factor authentication (MFA)](https://help.openai.com/en/articles/7967234)
- [FTC Consumer Advice: How to Recognize and Avoid Phishing Scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- [Gmail Help: Avoid and report phishing emails](https://support.google.com/mail/answer/8253)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-chatgpt-openai-subscription-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt