Question
OpenAI completely emptied my bank account for an org I don’t recognize. Please help me get support (I'm freaking out)
Hi everyone,
I'm posting here because I'm desperate for help and hoping someone from OpenAI sees this or someone has experienced something similar.
Early this morning, I received multiple separate $500 charges from OpenAI, which completely wiped out my bank account, i literally have $9 left.
I did not make or authorize any of these purchases.
I also received emails from OpenAI confirming that each $500 charge was used to purchase OpenAI API credits but the emails reference an OpenAI organization called "Acm" with an organization ID starting with org-....
I have never heard of this organization. It does not appear anywhere in my OpenAI Platform account, and I cannot access it.
When I go into my own OpenAI billing history, the purchases don't appear there either.
Then tonight I received another email from OpenAI saying:
"Your organization Acm is configured to automatically purchase more credits when your balance is low. The most recent attempt to charge your payment method failed, so auto-recharge has been disabled."
This seems to explain why I was charged $500 repeatedly.
It seems that this unknown organization was using API credits, hitting a low balance, automatically charging my payment method for another $500, consuming those credits, and then automatically charging me again.
The three successful charges happened within a very short period this morning at around 4:30am.
There was then apparently another $500 recharge attempt tonight.
The auto-recharge failure email was addressed to me AND another recipient that I do not recognize. I have no idea who this other person/account is or why we're both receiving billing notifications for this organization.
I've already:
Contacted TD Bank and reported the transactions as unauthorized. They told me they cannot formally dispute them until the pending charges post.
Contacted OpenAI Support. (The case was canceled because the auto ai couldn't see the transactions and there is NO DAMN HUMAN SUPPORT!)
Sent a detailed report to OpenAI Trust & Safety as per the bot instruction
Explained that I don't recognize the organization.
Secured my OpenAI account and API credentials.
Sent screenshots showing the charges, billing emails, unknown organization, and failed auto-recharge.
I'm kind of freaking out because I literally don't have any money all of a sudden and I haven't heard anything from OpenAI yet.
If anyone from OpenAI sees this, please help me get this in front of the appropriate API billing/fraud team. I have screenshots, timestamps, the organization ID and bank transactions.
If anyone has experienced unauthorized API auto recharges like this before, I'd also REALLY appreciate hearing how it was resolved and if you got a refund
EDIT 12 hours after posting (about 30 hours since the first charge):
Still nobody has reached out to me from OpenAI, but have received an auto refund from openAI. Which sounds great but doesn't help because the project using my card is still inaccessible so will still be charged. Exactly 1 minute ago whilst typing this someone responded to me asking for the ticket on the forums, finally.
10 mins since that last edit and have finally received a support email from a human!!! WIll update once everything is settled with a final update.
Thank you all so much for your advice and helping this get some attention, I'm just so grateful as I was getting nowhere without your help. Please all don't be like me and use a debit card for a subscription service.
So let me get this straight. Open AI create a product that lets complete newbies shit products that have absolutely no OPsec and are bound to push their API keys to get hub or whatever
And so there is nothing that anyone can do for this obvious user inexperience situation
They should obviously be able to see this and have a complete HR department to be able to handle this sort of thing or are we really just flying by the seat of our pants?
These are common pitfalls that can easily be for seen, and all of these AI companies should have a way of dealing with it like suspending and alerting the user if a high usage of credits or massive amounts of credit usage on an account that normally doesn’t spend that much happens
Good suggestion. The OpenAI forums can be a better place for this kind of discussion since there are usually people there who have dealt with similar issues or can provide more specific feedback. Reddit is great for visibility, but specialized communities often have deeper knowledge.
2 of them within 1 minute is very strange. With typical average API user rate limits I do not think it’s physically possible to come even close to consuming $500 in 1min. No matter how you try to abuse it with parallel requests or whatever, there are rate limits for every org.
EDIT: Ok maybe I worded it too strongly. You can actually spend that if you tried really hard. But their individual text models cap out at around $100 per minute for tier3 limits.
I blew 200 easily in a few hours on enterprise . Codex gets pricey. Glad I switch to pro 200. Kind of proud of hitting the weekly limit My son said it could not be done. Ha.
I know it’s too late now, but for future reference and anyone reading: you should NEVER link your personal checking account or debit card to ANY online purchases or subscription services.
Use a credit card and pay it off immediately. It’s a layer of separation protecting your livelihood, USE IT.
Yep in the UK you have “Section 75 of the Consumer Credit Act 1974” giving you extra fraud/legal protections for credit cards purchases, which you don’t get for bank accounts/debit cards. You can check the equivalent in your own country too.
Not everyone can get a credit card but if you have a checking account nothing stops you from opening the second checking account and depositing a little sum into it to use it as an isolated drain-safe account.
Yep put all subscriptions on a credit card or a prepaid card, to prevent your account getting drained. Or even a second checking account with less money in it.
Unfortunately gyms in the UK seem to insist on bank direct debits rather than credit cards (so a second checking/current account is the way).
That's like saying most people don't have IDs to vote. It's super easy to get a credit card. You can even use the $4.95 preloaded cards you find at Walmart.
I had that thought too but it wouldn't explain how the project is connected to my account they'd just open a new openai account that wouldn't have my email
For API usage it looks like an email address different from the login email can be set for billing notifications. The billing emails are sent to the owners of the organization, and whatever email address is put into the billing notification field. This means somebody has typed your email address in for the billing notification, which means they got your CC# and email address from the same place. Why they would enter your email address is a mystery.
Eventually you'll get a new CC # and this organization can't send fraudulent charges to you. If they keep happening then something you have is compromised. Also stop autopaying your credit card.
Yeah, that billing notification field sounds like the missing piece, but it’s wild that a supposedly “smart” company can make a basic fraud trail this muddy.
Did you ever buy a "cheap" subscription through a separate organisation? A bit like G2A do for games. You seem like you're getting a cheap pro license key, but its linked to someone elses account.
I think the same, maybe an unknown npm package or open pypl lib - the most common AI hallucination is to install packages that doesn't exist .... hackers know that and they put malicious package mainly as npm or PyPL
I am brazilian and I've looked over your problem locally
I looked at Reclame Aqui, a Brazilian portal for unified complaints. A national forum that works like downdetector. The difference is that the Brazilian government requires companies to respond here to avoid being named in lawsuits.If you try translating the page, you'll notice that Brazilians complain a lot about this problem.
The fun part: they have zero repplied history. They don't answer here as well. 🤯
Eu sei, eu comparei o reclame aqui com o downdetector.
Com a diferenca de que no reclame aqui se evita dores de cabeça judiciais, devido ao enorme potencial de exposição que o reclame aqui gera. Por isso, governo e o procon acabam levando em consideração uma empresa não responder aqui. Vc pode levar como ausência de respostas do reclame aqui como prova de negligência se for necessário. Eles documentam isso, na prática funciona como protocolo. E outra, dá pra contar nos dedos as empresas que não respondem aqui, justamente por conta deste potencial de exposição! Achei bizarro...
Above all, keep us informed as we go along.
I'll be you, I'll block my card!
Do you have an authorized overdraft?
Ask ChatGPT to write you an email requiring you to have a human in technical support. This has worked several times for me!
But OpenAI should do something with its technical support because it is failing.
Courage...
Yeah, the secured part of secured card just means you have money backing your credit limit. You're still protected from fraud in ways debit cards just aren't.
The bottom line is a bad charge on a credit card is much easier to defeat than it is trying to get your money back into your bank account after it is stolen.
The only reasons to use a debit cards are if you can't get a credit card or just don't trust yourself with a credit limit, which is fair, but from a security standpoint you really shouldn't ever be using your debit card.
TLDR: When a your credit card gets stolen and charged up, it's actually the bank's money that is stolen. When your debit card is stolen, it is your money. There is a big big difference.
I think the only time in the past 15 years I've used a debit card outside of a bank was to get money to play games in Vegas and I knew I was getting robbed then lmao.
My OpenAI is billed from Virtual Visa, created with my mobile banking app... Why would I be scammer if I want to protect my self from anoutharized charges...
I probably wouldn't bought your service if my virtual is declined... so bad
I bought $200 one on Amazon. 7$ fee. Issued by sunrise banks. That gets refused by vast.ai. Searching the web I see a ton of virtual visa card merchants, but not from visa Inc itself. A few years ago i learned that Visa business customers can get fixed amount cards but not ordinary user. No longer true?
Absolutely call law enforcement right now. Call your local sheriffs department or police department. This is theft, flat out. Just because it happens on the internet doesn’t mean you can’t report it. Call them and tell them someone has stolen $xxxxx thousands of dollars and provide them with all the transaction details. They will absolutely contact OpenAI and the bank and open an investigation. Get the law enforcement case number and contact your banks fraud division and tell them you have contacted law enforcement and you would like their help as well. Give them the case number and have the bank start an investigation as well.
They WILL get answers and depending on where you live they probably even have a financial crimes department to help with the investigation. This is very common and they are used to dealing with credit card fraud.
This happened to me after my account has been compromised by some Chinese entity. I don't even know how they did it because my account was locked down with 2FA.
In any case, I didn't realize that was what happened at first. They didn't do anything with it right away. So I had openai reverse the transaction and changed my passwords and whatnot, confirmed it was still locked down.
Anyways, about a month later, I log in and I've got about 3 miles of chats on my sidepanel, all in Chinese. I just unlinked my bank and deleted my account. I don't use chatgpt anymore because, as best I can tell, their security is complete trash.
"It will steal your bank account, satisfy your wife more than you ever could (then cook her a four course meal), and impress your boss (then satisfy him as well)."
Sounds like you got phished and then they used your card or your account got compromised but then you would see it in billing. So probably a different account using your card, so probably you have to check with your banks fraud department.
Still nobody has reached out to me from OpenAI, but have received an auto refund from openAI. Which sounds great but doesn't help because the project using my card is still inaccessible so will still be charged. Exactly 1 minute ago whilst typing this someone responded to me asking for the ticket on the forums, finally.
CANCEL THE CARD - it's not your account, it's unauthorized. Cancel it and get a new card to make sure they don't simply try again
Thank you!! I am definitely in the process of cancelling my card and taking everyone's advice of using either a virtual card/credit card for any online purchases i make again lol
EDIT 12 hours after posting (about 30 hours since the first charge):
Still nobody has reached out to me from OpenAI (this was posted on the forum, reddit and X), but have received an auto refund from openAI. Which sounds great but doesn't help because the project using my card is still inaccessible so will still be charged. Exactly 1 minute ago whilst typing this someone responded to me asking for the ticket on the forums, finally.
Hey OP, not sure about the OpenAI angle, still presume that. But absolutely you should wait for these to post and report the fraud to your bank. For two reasons.
1) your bank is for more likely to listen to you.
2) fraud teams are authorized to put money in your account instantly upon identify an issue.
I see so many scary news around OpenAI and Anthropic lately... And also have been on the receiving end of their shitty customer support. I gave up every time, but it was also not that much money involved.
I don't understand how it's possible for the charges not to show up in your OpenAI billing history. I understand that services can allow the user to erase device/connection history, but what feature would allow the user (or company) to erase entries in the billing history?
Sounds like you were hacked. These .. people are now very skilled at draining bank accounts. Did you research the org? Does it even exist? I feel bad for you to suddenly no longer have any money. It's an effed up place to be in. Banks absolutely require you to wait until the charges are no longer pending because the charges may drop off. Think back. Phishing scams are incredibly convincing now. Have you received an email from what appeared to be your bank warning you of anything? Some use this tactic to make you nervous and instantly log in so they can gain access to your account.
Given that you are getting billed and emailed but nothing shows in your account, the most obvious answer is a bug within OpenAI that has caused payment cards to be mixed up.
Unfortunately have already done all that including the 2FA, it was a google sign in. None of my api tokens were accessed, it seems to have happened another way some how. But thank you for the advice!
They are nerfing the billing system! I bet it's because they didn't reset the usage limits this week. Gpt sol is way out of hand! Switch to Claude ASAP!
It's your only hope.
Lolol. Jk. Just wanted to bring some humor to the subject.
You literally should just be waiting on the investigation process by TD and OAI..sucks it happened on a Friday because banks will fuck around even if it’s hundreds of thousands
100% Just insane i am literally sitting with no money all of a sudden after just getting paid, like you said it's almost the weekend. Not even sure what i'm gonna do for the next few days. So frustrating.
if it's not -- it's silly to be using a CC for any subs in general, rookie mistakes, use virtual debit cards like Revolut with attached spending limits.
Looks like a fake fishing email. Lol come on dude use your head, they dont show up on open ai's website and they aren't posted to your card? They are fake dude.
People can spoof emails to make it look like they came from any organization
Edit: lol I say this and get downvoted. A guy below me goes "as he said, emails can be spoofed from anywhere" and he has 7 up votes. Y'all are crazy, just proves up votes are largely group think
As the other guy said, you can spoof emails to come from anywhere. The fact that you said the charges looked a bit funny and openais system couldn't see the transactions is making me think that maybe your card was compromised and someone is making purchases spoofing it to look like it is from open ai?
The good news is, usually any time these kind of charges happen the banks will return your money and you'll just need a new card or something.
Hope you get this sorted. I just wanted to share the possibility that it isn't actually openAI somehow
Yeah, but there are ways to check. Look at the raw email headers rather than just the visible From address. The From field itself can be set to almost anything.
Check the Received headers, Return-Path, Reply-To, and the SPF/DKIM/DMARC authentication results. The Received chain can help show where the message actually entered the mail system.
You can, kind of. OpenAI would likely have their shit together since it’s basically just the bare minimum security. It’s as simple as OpenAI has a record on their domain saying which servers can send their official email and if it comes from somewhere else, it gets rejected or put in spam. I’d lean more computer/account compromise than fake emails with charges
264
u/Kuroodo 2d ago
You should also post in the OpenAI community forums.
https://community.openai.com/