Open Banking Exploited to Test Stolen Credentials

Key Takeaways

• Cybercriminals are exploiting open banking platforms to validate stolen bank and card credentials at a low cost.
• Fraudsters leverage legitimate spend-management platforms for both credential testing and distributing sophisticated phishing campaigns.
• The attacks impersonate reputable online marketplaces like Poshmark, using the platform’s own notification systems to lend credibility to phishing emails.
• Affected platforms unknowingly incur costs for these fraudulent checks through their open banking aggregators, rather than experiencing direct financial losses.

A sophisticated new fraud campaign is leveraging open banking infrastructure to serve two primary malicious purposes: verifying stolen financial credentials and distributing highly convincing phishing messages. This scheme, detailed by Analysts from Group-IB identified, exploits the account-linking mechanisms of legitimate spend-management platforms, turning them into unwitting tools for cybercriminals.

Instead of directly stealing funds from the targeted platform, the attackers exploit its services to validate stolen bank and card details, effectively using the platform as a low-cost “checker.” Simultaneously, they weaponize the platform’s trusted email and payment notification systems to disseminate phishing attempts, impersonating popular online marketplaces such as Poshmark. While Poshmark was impersonated, Group-IB confirmed that its systems were not compromised, nor did the spend-management platform directly lose funds to the attackers.

The campaign exhibits characteristics consistent with Classiscam, a known scam-as-a-service operation. Group-IB’s investigation into a client’s fraud-protection environment uncovered the dual-pronged attack, highlighting a novel method for criminals to operationalize existing financial technology for their illicit gains.

Hackers Exploit Open Banking Services for Phishing

A crucial element of this fraud campaign involves the strategic use of the spend-management platform’s inherent notification system. Rather than relying on their own, often suspicious, mail servers, criminals enroll victims’ email addresses into platform accounts. This action then triggers what appear to be authentic payment alerts or transaction notifications from the platform itself.

These deceptive emails capitalize on the credibility of a legitimate business service. The messages falsely claim that a sale on Poshmark is pending verification, urging recipients to click on an embedded link to complete the transaction. This link, however, directs victims to a meticulously crafted fake webpage designed to harvest sensitive personal and financial information. Group-IB’s analysis revealed that these phishing forms could request a wide array of data, including names, full card details, phone numbers, email addresses, billing information, one-time passcodes, and even current card balances.

In some observed instances, the phishing pages also sought credentials for payment wallets or online banking services. To heighten the sense of urgency and pressure victims into compliance, a countdown timer was often integrated into the fake pages, implying a limited window to claim the supposed funds. This tactic of abusing trusted service messages to deliver phishing content is not new but demonstrates a persistent evolution in social engineering strategies.

Account Linking Used as a Credential Checker

The second, equally insidious, facet of this scheme involves leveraging the account-linking functionality common in many spend-management services. These platforms often allow users to securely connect their bank accounts or credit cards via an open banking aggregator. With the user’s explicit permission, this login-based process can retrieve detailed account information, such as balances and transaction histories, which is invaluable for legitimate spend management.

However, fraudsters have co-opted this feature. By attempting to link a stolen bank account or card to a new or compromised platform account, they can effectively test the validity of the stolen credentials. A successful link confirms that the credentials are active and that the account holds funds, providing critical intelligence for future fraudulent activities.

A key financial implication identified by Group-IB is that the spend-management platform often bears the cost of these successful account linkages, typically billed by its open banking aggregator. While the fraudster gains valuable verification without expense, the platform unknowingly pays for the service. Group-IB estimates that each successful verification could cost the platform approximately USD 0.30 to USD 1.00. Projecting this, if a platform experiences one million billable links annually, and just 0.5% to 1% are fraudulent checker activity, the illustrative annual cost could range from USD 2,500 to USD 5,000, assuming an average cost of USD 0.50 per link.

Synchronized Attack Operations

Group-IB’s investigation revealed that the phishing and credential-checking activities were frequently conducted in parallel. This synchronization allowed criminals to rapidly utilize one-time passcodes (OTPs) stolen from phishing victims during subsequent account-linking attempts. Furthermore, investigators observed that the same device identities were associated with both accounts used for sending phishing messages and accounts engaged in testing stolen cards. For example, on April 27, device identity [496-] was linked to two accounts of each type, and on April 28, identity [524-] was associated with six of each. These crucial links enabled researchers to connect seemingly disparate activities into a coherent fraud campaign.

A significant challenge for fraud teams is that the platform itself was primarily used as infrastructure rather than being directly defrauded. The actual victims might be marketplace sellers or cardholders who are not even customers of the platform. The costs incurred by the platform might appear as aggregator invoices, rather than explicit fraud losses, making detection difficult.

The attackers employed various obfuscation techniques, including disposable email addresses, a mix of hosting services, VPNs, data-center networks, proxies, and residential IP addresses. Group-IB also noted that accounts created from different device identities could still share common device and location fingerprints. This complexity underscores why simple mitigation strategies, such as blocking single IP addresses or relying solely on basic rate limits, are often insufficient. The criminals also utilize automated Classiscam phishing sites to generate highly convincing pages designed to collect financial information.

What You Should Do

• Monitor Account Creation: Implement enhanced scrutiny for new accounts, particularly those using disposable email addresses or exhibiting unusual device/location fingerprints.
• Analyze Outbound Messages: Scan links within messages before they are sent, especially for new or low-trust accounts. Look for rapid message dissemination to unfamiliar recipients.
• Review Account Linking Behavior: Flag accounts attempting bank or card links shortly after creation, or those exhibiting unusually high volumes of linking activity, as potential credential testing.
• Compare Aggregator Invoices: Finance teams should regularly cross-reference open banking aggregator invoices and link counts against normal customer demand to identify suspicious spikes.
• Implement Multi-Factor Authentication (MFA): Where applicable, enforce strong MFA for account creation and sensitive actions to deter unauthorized access.
• Educate Users: Provide clear warnings to users about phishing risks, especially those impersonating popular services, and advise them to verify requests through official channels.
• Leverage Behavioral Analytics: Deploy advanced analytics to correlate seemingly disparate activities (e.g., phishing attempts and credential checks from the same device ID) to identify connected fraud patterns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.