Users seeking workarounds to pay for foreign subscriptions are increasingly falling victim to phishing schemes. Instead of gaining access to ChatGPT Plus, they end up with a completely drained bank account — the cybercrime unit of the Ministry of Internal Affairs warns.
Scammers exploit the strongest human motive — the desire to pay quickly, cheaply, and without unnecessary hassle. The scheme is built not around a specific service, but around a person's willingness to save money, which makes it universal and hard to recognize.
How the bot scheme works
Victims are sent phishing links to pages where they are required to enter bank card details. After the credentials are entered, the entire available amount is debited from the account. Notably, the bot has already changed its signage: now, instead of ChatGPT Plus, it offers a "Premium" tier for Telegram at a price significantly below the official one. This confirms that the scam relies not on being tied to a specific product, but on the psychology of saving.
The Cybercrime Unit of the Ministry of Internal Affairs emphasizes: buying ChatGPT Plus through a Telegram bot in most cases turns out to be fraud. There is no official OpenAI chat bot in the messenger, so any offer to pay for a subscription this way requires verification.
Other tricks used by scammers
The same technique with an inflated discount is used in fake online stores, where advertising is reinforced with videos featuring celebrities generated by neural networks. The buyer is asked to make a full prepayment, and then they cite a customs delay and do not return the money.
Artificial intelligence is also used in phone schemes: calls supposedly from a bank's security service or from law enforcement now add deepfakes, and the approach is tailored to the victim's age. At the same time, voice and appearance forgeries have not yet become widespread: in 2025 and the first half of 2026, only 18 such cases were recorded out of nearly 480,000 frauds.
Schemes involving "jobs abroad" also rely on an attractive offer: the victim is asked to buy cryptocurrency and send it to a specified address supposedly for visa processing. In addition to losing savings, the person risks being accused of complicity, so before transferring funds it is necessary to independently verify the employer and documents.
Risks in Telegram are not limited to bots: through animated stickers, attackers could run foreign code on a phone without the owner's actions. The bugs affected clients for iOS, Android, and desktop computers, after which Telegram completely replaced the vulnerable rendering library.
Cryptalist analysis: The growth of phishing schemes around foreign subscriptions reflects steady demand for workaround payment channels and the weakness of official payment infrastructure. For the market, this is a signal: the segment of intermediary services remains a zone of increased risk, and user literacy still lags behind the speed at which scammers adapt. Institutional players should take this factor into account when assessing the reputational and operational risks of payment ecosystems.