Fraudsters use open-banking links to test stolen cards, Group-IB says
Original title: Hackers Exploit Open Banking Services to Test Stolen Credentials Without Paying a Cent
Group-IB says a spend platform paid aggregator fees while attackers checked credentials and phished via its own notices.
Group-IB says criminals abused a spend-management platform’s account-linking flow to test stolen bank and card credentials and see whether accounts held funds. The platform did not lose customer funds, but Group-IB says it was billed by its open-banking provider for successful links. The same actors used the platform’s notification system to send Poshmark-themed phishing that collected personal and payment data. Group-IB assesses the activity as consistent with Classiscam and says a client later blocked more than 230 accounts in May 2026.
Unconfirmed: Group-IB’s cost figures are estimates, and the spend-management platform is not named.
- Group-IB estimates a successful link at about USD 0.30 to USD 1.00.
- Its illustrative annual checker cost is about USD 2,500 to USD 5,000.
- Device identity [496-] hit two phishing and two checker accounts on 27 April.
- Poshmark was impersonated; Group-IB says it was not compromised.
- Phishing forms sought names, cards, OTPs, balances, and sometimes wallet logins.
Impact: stolen credentials checked; phishing collected payment and personal data
- 1.Watch new-account creation, first outbound messages, and first bank or card links.
- 2.Limit or add checks for new or low-trust accounts and scan outbound links.
- 3.Compare open-banking aggregator invoices and link volume with normal demand.
- Products
- Poshmark
- Threat actors
- Classiscam
- Organizations
- Group-IB
From the original article
5 min read at cybersecuritynews.com
Criminals have found a way to use open banking as a low-cost checking service for stolen bank and card details. In a campaign described by Group-IB, fraudsters abused a spend-management platform’s account-linking process to check whether credentials worked and whether linked accounts held funds. The platform did not lose money through stolen funds, but it […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.