Group-IB: Fraudsters Abuse Open Banking to Validate Stolen Credentials
Cybercriminals used a spend-management platform’s linking process to check stolen data, triggering phishing emails without costing them direct fees.
Key points
- Group-IB identified a scheme where fraudsters abused open banking to verify stolen credentials.
- The campaign used a spend-management platform to send phishing messages impersonating Poshmark.
- The platform incurred costs for checks but did not suffer direct financial theft of funds.
Group-IB analysts uncovered a fraud campaign that abuses open banking services to validate stolen credentials at minimal cost to the attackers, according to a report by Cyber Security News. The scheme leveraged a spend-management platform’s account-linking features to determine if compromised bank details were active and held funds.
The criminals did not steal money directly from the platform or the linked accounts. Instead, they used the service’s open-banking provider to run validity checks on stolen data. The spend-management platform unknowingly paid for these verification attempts through its provider fees. This method allowed fraudsters to filter useful credentials from invalid ones without spending significant resources on direct testing.
Phishing Campaign Mechanics
The operation also utilized the platform’s notification system to distribute phishing content. Attackers added victim email addresses to accounts on the service, which triggered automated messages that appeared to be genuine payment alerts. These emails claimed that a sale on the online marketplace Poshmark required verification to proceed.
Group-IB stated that Poshmark was not involved in the activity and its systems were not compromised. The fraudsters simply impersonated the brand to lend credibility to the phishing attempt. The emails urged recipients to click a link to verify their account, creating a sense of urgency.
The links directed users to fake pages designed to harvest sensitive personal and financial information. Group-IB noted that these forms could request names, card details, phone numbers, email addresses, billing addresses, one-time passcodes, and card balances. Some versions of the fake pages also sought payment-wallet or online-banking login credentials. A countdown timer on the pages added pressure, suggesting recipients had little time to claim the supposed funds.
Threat Actor and Context
Group-IB identified this activity while investigating abuse of a client’s fraud-protection environment. Analysts assessed the campaign as consistent with Classiscam, a scam-as-a-service operation. This assessment links the current activity to a broader ecosystem of modular fraud services.
The scheme represents a dual-use abuse of the platform’s features. The first use was sending phishing messages via legitimate notification channels. The second use was testing stolen credentials through the open-banking aggregation process. This approach echoes other cases where criminals abuse real platform notifications to deliver malicious content, bypassing traditional spam filters.
What should you do?
Security teams should monitor for unusual spikes in account-linking requests or notification sends from their platforms. Organizations should verify that their open-banking integrations include rate-limiting controls to prevent automated credential checking. Users should be educated to recognize that legitimate platforms do not ask for one-time passcodes or full card numbers via email links.
What to do and how to stay safe: Group-IB
- Monitor your open-banking integration logs for rapid, sequential account-linking attempts from new or suspicious user accounts.
- Implement strict rate-limiting on API endpoints that return account balances or transaction history to hinder credential stuffing.
- Train employees and users to recognize phishing emails that create false urgency around marketplace sales or payment verifications.
- Verify that all external links in automated notification emails point to your own verified domains, not third-party redirects.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Poshmark suffer a data breach in this campaign?
No, Group-IB confirmed that Poshmark was not involved in the activity and its systems were not compromised.
Did the spend-management platform lose money from stolen funds?
No, the platform did not lose money through stolen funds, but it paid for the checks via its open-banking provider.
What information did the phishing pages try to collect?
The fake pages sought names, card details, phone numbers, email addresses, billing addresses, one-time passcodes, and card balances.
