diff --git a/detection-rules/impersonation_openai_payment_issues.yml b/detection-rules/impersonation_openai_payment_issues.yml
index 70e44d4c353..a4a1d30c3e9 100644
--- a/detection-rules/impersonation_openai_payment_issues.yml
+++ b/detection-rules/impersonation_openai_payment_issues.yml
@@ -52,7 +52,13 @@ source: |
     strings.icontains(body.current_thread.text, 'exceeds your credit limit'),
     strings.icontains(body.current_thread.text, 'plan features have been paused'),
     strings.icontains(body.current_thread.text, 'saved payment method'),
-    strings.icontains(body.current_thread.text, 'active without interruption')
+    strings.icontains(body.current_thread.text, 'active without interruption'),
+    strings.icontains(body.current_thread.text, 'interruption to your access'),
+    strings.icontains(body.current_thread.text, 'review your account status'),
+    strings.icontains(body.current_thread.text, 'access confirmation'),
+    strings.icontains(body.current_thread.text, 'review allowance'),
+    strings.icontains(body.current_thread.text, 'access may be suspended'),
+    strings.icontains(body.current_thread.text, 'next allowance cycle')
   )
   // not from openai
   and not (