ChatGPT Phishing Scams Surge as OpenAI Enters Top 10 Targeted Brands

ChatGPT has entered the top 10 most impersonated brands in phishing campaigns for the first time, according to new research.

OpenAI accounted for 1.1% of tracked brand phishing attempts during the second quarter of 2026. The figure places the company alongside widely impersonated brands such as PayPal, WhatsApp and Facebook.

Microsoft remains the main phishing target

Microsoft still attracts the largest share of brand impersonation campaigns, accounting for 23% of tracked attempts. LinkedIn, Google, Apple and Amazon follow behind it.

Together, those five brands account for more than half of all brand phishing activity. Attackers continue to use familiar companies because victims are more likely to trust messages that appear to come from services they use every day.

ChatGPT’s addition to the top 10 reflects its rapid move from a new technology to a mainstream service.

Fake ChatGPT billing emails target card details

Researchers identified phishing emails that impersonate ChatGPT Plus billing notices. The messages claim that a payment failed or that the recipient needs to update billing information.

The emails copy OpenAI branding and direct victims to fraudulent payment pages. These pages aim to collect credit card details and other financial information.

Attackers often rely on urgency to make victims act before checking the message. Fake payment failures, account warnings and security alerts all create pressure to click quickly.

How to spot ChatGPT phishing scams

Users should avoid opening payment or account links directly from emails. Instead, they should type OpenAI’s official web address into their browser and sign in from there.

Other warning signs include suspicious sender addresses, misspelled domains, distorted logos, broken buttons and unusual social media links. A convincing-looking email does not prove that it came from OpenAI.

Multi-factor authentication can also reduce the risk of account takeover if attackers steal a password. However, users should still verify every login request and payment notice before taking action.

As AI services become part of daily work and personal routines, ChatGPT phishing scams will likely continue to grow. AI tools can also help criminals create more polished messages at scale, making careful verification increasingly important.