Fake ChatGPT billing emails can steal your login, tell me about this news in (https://www.foxnews.com/tech/fake-chatgpt-billing-emails-steal-login)

The article reports on a phishing campaign uncovered by cybersecurity researchers at Cofense, in which scammers impersonate OpenAI to steal ChatGPT users’ login credentials and payment information.

How the Scam Operates

• Convincing Email Lures: The attack begins with a deceptive email designed to look like a routine billing alert from OpenAI. It features official branding, ChatGPT logos, and a sign-off from “The OpenAI Team.”

• Manufactured Urgency: The message claims that a “Subscription Payment Required” notice has been triggeredsuch as a declined renewal or expired cardand warns the user that they must resolve the issue within 48 hours to avoid service disruption.

• Evasive Redirects: The email includes an “Update Payment Information” button. Instead of going directly to a destination, the link routes victims through intermediaries, such as a Google API redirect, which helps the email slip past automated security and spam filters.

• Spoofed Login Portal: Once redirected, users arrive at a fake webpage that closely mirrors the real ChatGPT login interface, down to the fonts, colors, and layout.

• Credential & Data Theft: If a user enters their login credentials or payment card details, the data is captured by attackers. The site then typically displays a generic error message, leading victims to believe they experienced a routine website glitch rather than a security breach.

Key Recommendations to Stay Protected

1. Verify Billing Directly: Never click links or buttons inside unexpected billing emails. Navigate directly to the official ChatGPT website or mobile app, log in, and check your subscription status under Settings → Billing (or Settings → Account → Payment).

2. Examine the Address Bar: Check the full domain name in your browser before typing in passwords or card details. Phishing pages may look visually identical to the real site, but the URL will not belong to the official service.

3. Inspect the Sender Address: Scammers often use display names like “OpenAI” while sending from unrelated third-party domains.

4. Enable Multi-Factor Authentication (MFA): Turn on two-factor authentication inside your ChatGPT account settings so that a stolen password alone is not enough for an attacker to break in.

5. If You Fell for the Scam: Immediately change your ChatGPT password, sign out of all active sessions, and notify your bank or credit card provider to monitor or cancel the card used on the fake site.