Open banking fraud has taken an unusual turn after security researchers uncovered a scheme in which criminals used a legitimate fintech platform to test stolen bank credentials without paying for the verification themselves.
The attackers exploited a spend-management platform’s bank-account linking service to check whether stolen financial credentials were valid and whether connected accounts contained funds. At the same time, they used the platform’s legitimate email notifications to distribute phishing messages impersonating online marketplace Poshmark.
According to cybersecurity company Group-IB, the platform was not directly robbed. Instead, its services became part of the fraud operation, while account-verification fees were charged to the platform through its open-banking provider.
The investigation, published on October 20, 2026, describes how two seemingly separate activities, phishing and credential checking, were linked through shared device identifiers and behavioral evidence.
The findings expose a weakness in conventional fraud monitoring: a platform can facilitate financial scams without recording a direct theft or unauthorized transaction against its own accounts.
For organizations and consumers facing similar risks, our Small Business and Consumer Cybersecurity Defense Guide covers identity protection, phishing prevention and practical security controls.
Key Findings From the Open Banking Fraud Investigation
- Research organization: Group-IB, which investigated the activity within a fraud-protection client’s environment.
- Attack pattern: Criminals abused a legitimate spend-management platform as fraud infrastructure rather than directly stealing its funds.
- Phishing delivery: The platform’s trusted email and payment notifications were used to send fraudulent marketplace payment messages.
- Impersonated brand: Poshmark, which was not involved in the operation and was not compromised according to Group-IB.
- Credential checking: Stolen banking and card details were tested through a legitimate open-banking account-linking flow.
- Verification costs: Group-IB estimated successful account connections could cost the platform approximately $0.30 to $1.00 each.
- Observed infrastructure: Disposable emails, manipulated device identities, proxies, VPNs and multiple network types.
- Campaign linkage: Investigators connected phishing and checking accounts through shared device and location fingerprints.
- Defensive result: Group-IB reported reducing fraudulent-account blocking time from hours to under a minute.
- Accounts stopped: More than 230 accounts assessed as fraudulent were blocked during May 2026.
How Hackers Exploited Open Banking Services
The campaign targeted a normal feature found in many financial technology applications: the ability to connect an external bank account.
Spend-management platforms use these connections to help customers manage payments, expenses and account information.
Depending on the provider, users may link an account through an open-banking aggregator that connects to financial institutions and returns authorized account data.
That information can include balances and transaction history, allowing the application to confirm that a connected account exists and can be used for supported services.
For legitimate customers, the process makes onboarding more convenient.
For someone holding stolen credentials, however, the same process may reveal whether those credentials work.
Group-IB found that criminals were exploiting this distinction.
Instead of testing stolen banking details directly against a financial institution’s normal login interface, they submitted them through the spend-management platform’s account-linking workflow.
Successful linking could provide a useful signal about the account’s validity and available funds.
Importantly, this does not mean that every open-banking connection exposes unrestricted access to an account. The available information and permissions depend on the aggregator, financial institution and authorization process.
The weakness in this case was the abuse of a legitimate verification workflow by fraudulent users.
Classiscam Phishing Used Trusted Payment Notifications
The operation had a second component that helped criminals obtain financial information in the first place.
According to Group-IB, attackers used the platform’s payment-notification and email systems to deliver messages that appeared to originate from a trusted business service.
The messages impersonated Poshmark, a legitimate online marketplace.
Recipients were told that a buyer had paid for an item but that the seller needed to complete an identity-verification step before receiving the money.
The message directed the recipient toward a shortened link leading to a fraudulent page.
The phishing page copied marketplace branding and displayed a countdown timer to create urgency.
It then requested personal and financial information, including names, card details, telephone numbers, email addresses, billing addresses, one-time passcodes and card balances.
Some versions also requested payment-wallet or online-banking information.
Group-IB assessed the activity as consistent with Classiscam, an established scam-as-a-service operation associated with automated marketplace impersonation and payment-data theft.
The important distinction is how the messages were delivered.
The criminals were not relying solely on email infrastructure they controlled. They were abusing a real service’s notification system, allowing the fraudulent message to inherit some of the credibility of a legitimate business platform.
Poshmark itself was an impersonated brand. Group-IB stated that Poshmark did not participate in the operation and that its systems were not compromised.
How the Stolen Credentials Were Tested
After collecting financial information through phishing, fraudsters typically need to determine which stolen credentials are still usable.
Invalid, expired or blocked details have less value to a criminal operation than credentials that successfully connect to an active account.
Group-IB documented how the attackers used the spend-management platform’s bank-account linking function for this purpose.
The platform supported a login-based connection method through an open-banking aggregator.
Unlike a manual account-entry process that may collect only static information, the login-based connection could return live financial account details when authorization succeeded.
That made it useful as a checking mechanism.
Investigators observed account-linking attempts occurring alongside the phishing activity, which meant that one-time passcodes collected from victims could potentially be used while still valid.
The report also found that the accounts responsible for distributing phishing messages and those performing checking activity were connected through common device fingerprints.
These connections provided evidence that both activities belonged to the same broader operation rather than unrelated suspicious accounts.
Group-IB did not publish a complete list of compromised financial institutions or a verified total of successfully abused bank accounts.
Why the Credential Checks Cost Criminals Nothing
The financial arrangement behind the account-linking service made the scheme particularly attractive to fraudsters.
Many fintech platforms pay an open-banking aggregator to provide account verification and related services.
In some commercial arrangements, the platform pays a fee when an account is successfully connected.
Group-IB estimated that these verification charges commonly range from approximately $0.30 to $1.00 per successful link.
When criminals used the account-linking feature to test stolen financial credentials, the checking result benefited them while the platform carried the service cost.
This did not require the criminals to steal money directly from the platform’s accounts.
The charges could instead appear as ordinary account-linking expenses on an aggregator invoice.
Group-IB provided an illustrative example involving a platform processing one million billable account links annually.
If between 0.5% and 1% of those links were fraudulent checking activity, and each cost $0.50, the annual expense would be approximately $2,500 to $5,000.
Those amounts are hypothetical calculations, not confirmed losses suffered by the investigated platform.
The more important issue is visibility.
A relatively small increase in verification costs may be overlooked if financial and fraud teams assess account-linking expenses separately from suspicious onboarding behavior.
How Researchers Connected the Phishing and Checking Accounts
Group-IB’s investigation used device intelligence and behavioral analysis to identify relationships between accounts that initially appeared separate.
Some accounts were involved in creating or delivering phishing messages.
Others attempted to link financial accounts and test stolen details.
The researchers observed overlapping device identifiers and location fingerprints across these activities.
On April 27, an internal device identity represented as [496-] was associated with two phishing-related accounts and two accounts used for financial checking.
On April 28, another identity represented as [524-] was associated with six accounts of each type.
Further investigation indicated that multiple apparent device identities could originate from the same physical device.
The attackers also changed their account-creation behavior after controls began detecting multiple registrations from a single device.
Rather than continuing to create numerous accounts under one visible identity, they shifted toward separate identities while retaining underlying fingerprint similarities.
This illustrates why basic account counts or IP-based blocking may not reveal an entire fraud operation.
Device, location, network and behavioral signals become more useful when examined together.
The bracketed identifiers in the report are research references, not globally usable indicators that defenders can automatically block.
Why the Fintech Platform Did Not See a Conventional Financial Loss
The campaign exploited a gap between how financial fraud is traditionally monitored and how platform services can be misused.
A conventional fraud investigation may begin with unauthorized transactions, account takeovers, chargebacks or stolen funds.
In this case, the platform’s own money was not directly stolen through the reported operation.
Instead, its trusted communication services were used to contact potential phishing victims, and its account-linking system was used to test stolen financial details.
The potential victims included marketplace users and financial account holders who might never have registered with the spend-management platform.
That makes the financial impact harder to see through the platform’s normal transaction records.
The costs may be distributed across different systems: reputation damage from phishing messages, verification charges on aggregator invoices and possible legal or compliance consequences.
These risks cannot necessarily be detected by monitoring the platform’s own unauthorized payments alone.
Group-IB’s central finding was that an institution can enable fraud indirectly even when the criminals are not trying to withdraw money from the institution itself.
How Fintech Security Teams Can Detect Open Banking Fraud
Group-IB identified three opportunities to detect abuse before the fraudulent workflow becomes established.
1. Detect Suspicious Account Creation
New accounts registered using disposable email addresses, repeated device fingerprints or unusual automated behavior may warrant additional review.
Investigators should compare registration events with device and location information rather than treating each account as unrelated.
Legitimate users can share networks and devices, so automated restrictions should combine multiple signals to reduce false positives.
2. Monitor the First Outbound Messages
Recently created accounts sending large numbers of messages to unfamiliar recipients can indicate notification-system abuse.
Platforms should examine links included in outbound messages and investigate repeated payment-verification language inconsistent with normal user behavior.
Limits on messaging privileges for newly created or low-trust accounts can reduce the opportunity for abuse.
Security teams should also correlate outbound messages with subsequent reports of phishing or suspicious external domains.
3. Review the First Bank or Card Link
A new account attempting to link financial credentials immediately after registration may be legitimate.
However, repeated linking attempts, multiple accounts associated with the same device or an absence of normal platform activity can indicate checking behavior.
Additional verification, risk-based limits and investigation of unusual linking patterns can help identify fraudulent activity before it scales.
These controls are especially useful when combined with device intelligence and behavioral correlation.
Detection Evidence and Indicators From Group-IB
The published research provides several observable patterns that fintech fraud teams can use when reviewing suspicious activity.
- Account creation: Disposable email addresses and rapid registration of multiple accounts.
- Device intelligence: Separate account identities sharing underlying device or geographic fingerprints.
- Message behavior: Newly created accounts sending payment-related notifications containing suspicious external links.
- Financial linking: Multiple bank or card connection attempts shortly after onboarding.
- Network patterns: Use of VPNs, proxies, data-center networks and residential IP infrastructure.
- Campaign correlation: Shared device evidence connecting phishing-message accounts to credential-checking accounts.
- Research references: Partially masked device identities
[496-]and[524-].
These are behavioral indicators rather than proof that any individual account is malicious.
The source does not provide a public list of confirmed attacker-controlled domains, IP addresses or file hashes for universal blocking.
Platforms should apply the findings to their own telemetry and authorization environment rather than treating the research identifiers as immediately actionable network indicators.
Remediation Verification: What Platforms Should Check
Stopping suspicious accounts is not enough if the same activity can resume through newly registered identities.
Fintech platforms investigating similar abuse should confirm that corrective controls address both the messaging and account-linking components.
- Review suspicious onboarding records and identify connected accounts through device and behavioral evidence.
- Investigate whether newly registered accounts sent phishing content through trusted notification systems.
- Assess unusual account-linking attempts and whether they resulted in billable aggregator transactions.
- Apply proportionate restrictions to confirmed fraudulent accounts and related identities.
- Check that suspicious messages and external phishing links are blocked through appropriate controls.
- Compare account-linking volumes and aggregator invoices against legitimate onboarding activity.
- Verify that fraud detection still works when attackers change IP addresses or visible device identifiers.
- Review alerts and enforcement decisions for false positives affecting legitimate customers.
- Retest monitoring rules against known fraudulent behavior after changes are deployed.
Group-IB reported that its fraud-protection team helped reduce the time required to block fraudulent accounts from several hours to less than one minute.
The researchers also reported that more than 230 accounts assessed as fraudulent were stopped during May 2026.
Those results describe the investigated deployment. They should not be interpreted as guaranteed outcomes for every fintech platform using similar controls.
What Consumers Should Know About Marketplace Payment Phishing
The same campaign also provides a practical warning for online marketplace sellers.
A payment notification can appear to come from a genuine business service while containing a fraudulent request supplied by an attacker.
Someone selling an item should be cautious if an unexpected message says that a payment is waiting but requires entering banking credentials or one-time verification codes on an external website.
Verify the transaction directly through the marketplace’s official application or website instead of relying on a link supplied in an unsolicited message.
A countdown timer, shortened URL or demand for account verification should prompt additional scrutiny.
Never disclose one-time passcodes to an unverified payment page or person claiming to release marketplace funds.
If banking details have already been entered into a suspicious form, contact the financial institution through its official support channel, report the exposure and follow its guidance on protecting the account.
Card replacement, credential changes and additional monitoring may be appropriate depending on what information was disclosed.
Consumers should also report fraudulent marketplace messages to the impersonated service.
Confirmed vs Unknown: What Group-IB Established
Supported by the Investigation
- A legitimate spend-management platform was abused to distribute phishing messages.
- The campaign impersonated Poshmark in fraudulent marketplace payment communications.
- Attackers used an open-banking linking flow to check stolen financial credentials.
- The platform carried account-verification costs through its aggregator arrangement.
- Shared device evidence connected phishing and checking activities.
- Attackers used disposable emails and varied network infrastructure.
- Group-IB reported improving account-blocking speed and stopping more than 230 fraudulent accounts in May.
Not Established or Requiring Qualification
- The identity and total membership of the criminal operation.
- The exact number of people who surrendered financial information.
- The total value of stolen funds, if any, across all affected users.
- The verified total cost of fraudulent account checks to the platform.
- A compromise of Poshmark’s systems.
- A vulnerability affecting every open-banking aggregator.
- A single CVE responsible for the scheme.
- A universal list of attacker IP addresses or domains.
Group-IB assessed the operation as consistent with Classiscam, but the report does not establish that every example of open-banking credential abuse is necessarily part of that group.
CyberUpdates365 Analysis
The distinctive feature of this campaign is that the criminals used a legitimate platform without needing to compromise the platform’s core infrastructure.
They exploited ordinary product features that were designed to improve customer experience.
Fast onboarding made it easier to register accounts. Trusted payment notifications provided a credible channel for phishing. Bank-account linking supplied confirmation signals about stolen credentials.
Each feature had a legitimate business purpose.
The security failure emerged when those features could be combined into a workflow that served fraudulent objectives.
For fintech operators, that creates a challenge that traditional transaction monitoring may not solve.
If an attacker abuses a platform to target outsiders, the platform’s own transaction ledger may never record the main harm.
That makes the earliest stages of account activity more valuable for fraud prevention.
Instead of waiting for a suspicious payment, defenders need to understand who is registering, whom they are contacting and why they are linking financial accounts.
The research also demonstrates why isolated signals can be misleading.
One suspicious email account might look like messaging abuse. Another account performing unusual bank links might look like onboarding fraud.
Device and behavior correlation can reveal that both activities belong to the same operation.
The broader lesson extends beyond open banking. Any platform offering trusted communications, identity validation or financial verification may become useful infrastructure for external fraud.
Fraud prevention must account for how legitimate services can be misused, even when the platform itself is not losing money directly.
Research Evidence
- Original research: Group-IB, October 20, 2026.
- Report title: The Checker You Pay For.
- Research authors: Yuan Huang and Alexander Grabko.
- Investigation environment: An unnamed Group-IB Fraud Protection client.
- Observed activity: Phishing distribution and stolen financial credential checking.
- Impersonated marketplace: Poshmark.
- Suspected scam ecosystem: Classiscam.
- Service abused: Open-banking account linking through a spend-management platform.
- Estimated link cost: Approximately USD $0.30–$1.00 per successful connection.
- Illustrative annual expense: USD $2,500–$5,000 under Group-IB’s hypothetical usage assumptions.
- Device evidence: Partially masked identifiers
[496-]and[524-]. - Observed defenses: Onboarding, outbound messaging and initial account-link monitoring.
- Reported response improvement: Blocking time reduced from several hours to under one minute.
- Fraudulent accounts stopped: More than 230 in May 2026.
- Confirmed Poshmark compromise: None reported.
- Campaign-specific CVE: None established.
Frequently Asked Questions
How are hackers exploiting open banking services?
Group-IB documented criminals abusing a fintech platform’s legitimate bank-account linking process to check stolen financial credentials. The service could confirm whether a connected account was valid and active.
Does this mean open banking has been hacked?
No. The report describes misuse of a legitimate account-linking feature. It does not establish a universal technical vulnerability or compromise affecting all open-banking services.
What is Classiscam phishing?
Classiscam is a scam-as-a-service operation associated with phishing pages that impersonate marketplaces and other services to collect payment information. Group-IB assessed the observed campaign as consistent with this activity.
Why did criminals use a spend-management platform?
The platform offered trusted notification systems and bank-account verification. These features let criminals distribute phishing messages and test stolen credentials while using legitimate infrastructure.
How much did credential verification cost?
Group-IB estimated that successful open-banking links could cost the platform approximately $0.30 to $1.00 each. The criminals used the result without directly paying those aggregator fees.
Was Poshmark breached in this campaign?
No Poshmark system compromise was reported. The marketplace’s name and branding were impersonated in phishing messages, according to Group-IB.
Can fintech platforms detect this type of fraud?
Yes. Group-IB identified three useful stages for detection: account creation, the first outbound messages and the first bank or card connection. Correlating device and behavioral signals improves visibility.
What should users do after entering banking information on a fake payment page?
Contact the bank immediately through an official channel, report the exposed information and follow its instructions for securing the account. Review recent activity and report the phishing message to the impersonated marketplace.
Final Takeaway
Group-IB uncovered a fraud operation that turned a legitimate spend-management platform into infrastructure for phishing and stolen-credential checking.
The criminals exploited trusted notifications to impersonate marketplace payments and used open-banking account linking to test financial credentials without directly paying verification fees.
The platform did not need to suffer a conventional breach or direct theft for the abuse to create risk.
For financial technology providers, the case highlights the importance of connecting onboarding, messaging, device intelligence and account-linking telemetry before suspicious activity becomes established.
The most effective opportunity to stop this kind of fraud may appear before any unauthorized payment takes place.
What happens when a convincing phishing message captures more than just a password?
The open-banking campaign shows how criminals validate stolen financial details. Another investigation reveals how attackers use fake invitations to capture Google authentication sessions, including accounts protected by MFA.
Read: UAT-11985 Fake Event Invites Steal Google Accounts Through AitM Phishing →
