Scammers use a fintech platform’s notifications to phish sellers
Original title: Scammers Turn Legitimate Fintech Platforms Into Phishing Tools to Steal Banking Details
Group-IB says operators impersonated Poshmark, harvested cards and OTPs, and checked stolen bank logins.
Group-IB documented abuse of a legitimate spend-management platform that sent phishing notifications and tested stolen banking credentials. Messages claimed marketplace buyers had paid and linked to a counterfeit Poshmark page; Poshmark’s systems were not reported compromised. Investigators called the activity consistent with Classiscam. The firm says it blocked more than 230 fraudulent accounts in May 2026.
Unconfirmed: Group-IB assessed the activity as consistent with Classiscam; the fintech platform is not named.
- Onboarding detection cut blocking time from hours to under a minute.
- Pages asked for names, addresses, card data, balances and one-time passcodes.
- One device on April 27 tied two phishing accounts and two testing accounts.
- The next day another identity backed six accounts of each type.
Impact: card details, one-time passcodes and banking credentials
- 1.Flag disposable emails, repeated device fingerprints and immediate bank linking
- 2.Treat marketplace payment notices with shortened links as suspicious
- Products
- Poshmark
- Threat actors
- Classiscam
- Organizations
- Group-IB
From the original article
3 min read at gbhackers.com
Scammers have weaponized a legitimate spend-management platform to send phishing messages and validate stolen financial credentials, turning trusted payment infrastructure into an operational part of fraud instead of attacking it directly. Group-IB documented the activity within a client environment after the platform reported suspicious payment notifications in late April 2026.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.