Hi OpenAI team,
I want to report a second route to the same result as the UPI + mail.com pattern that was flagged here a few days ago, this time out of Vietnam. As with that thread, I’m keeping this at the pattern level and leaving out the step-by-step so it doesn’t turn into a guide. I have screenshots of the listings and my chats with the sellers and can hand those to Trust & Safety privately.
What I’m seeing
The trial is being started with Google Pay as the payment method rather than a card typed in at checkout. A Google Pay wallet can hold a lot of cards, and as far as I can tell each card added to it counts as a fresh payment method for the trial check. So one operator with one Google account goes through card after card and picks up a new month of Plus each time.
The cards themselves are the interesting part. When sellers run out of their own, they rent cards from middlemen (thương lái, as they’re called locally). These are ordinary debit cards from Vietnamese banks, mostly MB Bank and Vietcombank from what I’ve been told, opened in other people’s names and handed over in batches. They aren’t virtual or prepaid cards, so they presumably don’t trip whatever check catches those. Each one has a real BIN and a different cardholder name.
Nothing here is a one-person trick. The accounts are openly listed in Vietnamese marketplaces and community groups as “ChatGPT Plus 1 tháng” (one month), and the sellers describe the method to buyers without any hesitation.
When I asked a few of them about it, none were worried. One told me, more or less word for word, that they dare OpenAI to fix it. They treat the card supply as unlimited and the trial as a solved problem on their side.
Why it matters
Every farmed account is a month of Plus given away, and because the accounts are resold, the trial is paying for a grey-market subscription business. The people whose names are on the rented cards most likely have no idea what the cards are being used for, and they’re the ones who’d take the hit if anything were ever charged. Legitimate users in Vietnam who pay through Google Pay for real would be the ones facing extra friction if the trial or the wallet option gets pulled. And the gap isn’t specific to Vietnam: any wallet that can front many cards would work the same way.
Suggestions
Tie trial eligibility to the underlying card rather than to the wallet or the email, and cap it at one trial per card fingerprint.
Require a successful small charge or a verified hold on the card before Plus is activated. I’d guess most of the rented cards are empty, so an authorization that actually has to clear would stop a good share of them.
Limit trials per verified phone number and per device, on top of the per-email limit, and rate-limit trial activations per IP and device fingerprint.
Treat “same device or IP, new cardholder name every few days” as a signal. That sequence doesn’t happen with real users.
If the Google Pay checkout skips a verification step that a directly entered Vietnamese card has to go through, that’s probably the gap the sellers are relying on.
Watch Vietnamese resale listings for “ChatGPT Plus 1 tháng”. If the price jumps or the listings dry up, the fix is working. If not, it isn’t.
I’d rather report this than keep watching the listings grow. If there’s a better channel for this (Trust & Safety form, bug bounty), point me to it and I’ll move the details there.
Thanks.
