Hackers Exploit Open Banking Services to Test Stolen Credentials Without Paying a Cent

Criminals have found a way to use open banking as a low-cost checking service for stolen bank and card details. In a campaign described by Group-IB, fraudsters abused a spend-management platform’s account-linking process to check whether credentials worked and whether linked accounts held funds.

The platform did not lose money through stolen funds, but it unknowingly paid for the checks through its open-banking provider. The scheme also used the platform’s email and payment notices to send phishing messages.

These claimed that a sale through the online marketplace Poshmark was waiting for verification and urged recipients to follow a link. Poshmark was impersonated and was not involved in the activity; Group-IB also said its systems had not been compromised.

Analysts from Group-IB identified the activity while investigating abuse of a client’s fraud-protection environment.

They assessed it as consistent with Classiscam, a scam-as-a-service operation, and described two linked uses of the platform: sending phishing messages and testing stolen credentials.

This was a fraud campaign—not a report of malware infecting the platform. Group-IB’s findings are detailed in its report on the checker scheme.

Hackers Exploit Open Banking Services

Rather than send every message directly, the criminals used the platform’s own notification system. They added recipients to accounts and triggered messages that appeared to be genuine payment alerts.

The emails borrowed the credibility of a real business service, while the message pretended that a Poshmark sale could not be completed until the recipient verified an account.

The link led to a fake page designed to collect personal and payment details. Group-IB says the form could request names, card details, phone numbers, email addresses, billing addresses, one-time passcodes and card balances.

Some versions also sought payment-wallet or online-banking details. A countdown added pressure by suggesting that the recipient had little time to claim the money.

This use of trusted service messages echoes other cases where criminals abuse real platform notifications to deliver phishing content.

Account linking served as a credential checker

The second part of the scheme took place when an account tried to connect a bank account or card. Some spend-management services let users link a bank through an open-banking aggregator.

With the user’s permission, this login-based process can return account details such as a balance and transaction history. That can help a legitimate user manage spending, but it can also confirm to a criminal that stolen credentials are valid and the account is active.

The key detail is who pays. Group-IB says the platform may be billed by its aggregator for successful links, while the fraudster uses the result without paying that fee.

The criminal gets a useful signal; the platform absorbs the service cost. In its estimate, a successful verification may cost about USD 0.30 to USD 1.00.

For one million billable links a year, if 0.5% to 1% were checker activity, the illustrative annual cost would be about USD 2,500 to USD 5,000, using USD 0.50 per link.

Group-IB observed the phishing and checking activity happening in parallel. That meant one-time codes stolen from victims could be used quickly during an account-link attempt.

The same devices were linked to accounts sending phishing messages and accounts testing cards. On 27 April, device identity [496-] was associated with two accounts of each type; on 28 April, identity [524-] was associated with six of each. These links helped investigators connect activity that might otherwise look like separate incidents.

Many fraud teams look for losses on their own company’s records: unauthorised purchases, false reimbursements or account takeovers. Here, the platform was being used as infrastructure rather than directly robbed. The victims could be marketplace sellers or cardholders who were not even customers of the platform, and the cost could appear on an aggregator invoice rather than as a clear fraud loss.

The observed activity also included disposable email addresses and a mix of hosting services, VPNs, data-centre networks, proxies and residential IP addresses. Group-IB found that accounts created from different device identities could share device and location fingerprints.

This helps explain why blocking a single IP address, or relying only on simple rate limits, may not be enough. Criminals also use automated Classiscam phishing sites to create convincing pages that collect financial information.

Group-IB recommends watching for suspicious activity at three points: account creation, the first outbound messages and the first bank or card link.

Signals may include disposable email use, repeated device or location fingerprints, rapid messages to unfamiliar recipients and account links soon after sign-up.

Reviewing these events together can help teams spot connected behaviour rather than treating each action as an isolated case.

Platforms can also set limits or extra checks for new or low-trust accounts, scan links before messages go out and review unusual spikes in account-linking volume. Finance teams can compare aggregator invoices and link counts against normal customer demand.

Group-IB reports that after its team became involved, a client reduced the time to block fraudulent accounts from several hours to under a minute, and stopped more than 230 accounts in May 2026.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Exploit Open Banking Services to Test Stolen Credentials Without Paying a Cent appeared first on Cyber Security News.