Cybercriminals are increasingly leveraging open banking frameworks to verify stolen bank and card credentials—without actually making payments, and while pushing the costs onto legitimate financial platforms. A new investigation by Group-IB uncovers how fraudsters manipulated a spend-management service’s account-linking flows to both test credentials and send phishing messages, all while avoiding direct detection or financial impact on the victims’ accounts.
How the Scheme Works
The scheme has two main components: phishing and credential checking. Once the fraudsters gain access to a stolen account, they use the platform’s own notification system to send emails that appear to come from a trusted marketplace—Poshmark is used in this case. These messages falsely claim a sale is pending and demand verification via a malicious link. Clicking takes victims to a fake page—designed to harvest sensitive data like names, card details, billing addresses, device-linked credentials, one-time passcodes and even online banking or wallet information. A countdown timer adds urgency. In some versions, victims are prompted for more financial credentials, including wallet or online-banking access. Group-IB emphasizes no compromise of the actual platform was involved—this is identity abuse rather than technical intrusion.
Simultaneously, fraudsters abused the service’s account-linking feature via open banking aggregators. When users—or in this case criminals—link a bank or card, open banking permits retrieval of account balances and transaction histories. These logs are meant for legitimate use, but here they act as proof that stolen credentials are real and active. Each successful link often triggers a fee charged by the aggregator, but the thief gains the result without paying. The platform ultimately bears that cost.
Impact & Detection Challenges
Each account-link verification likely costs the platform between about US $0.30 and US $1.00. When done at scale—even if only 0.5% to 1.0% of a million links annually are fraudulent—the annual loss could reach an estimated US $2,500 to US $5,000 for a single platform.
Detecting this fraud is hard. Fraudsters use disposable email addresses, anonymization through VPNs, data-center infrastructure, proxies and even residential IPs. Unique device and location fingerprints allow them to create multiple linked accounts—some that send phishing messages, some that attempt credential checks. Blocking individual IP addresses or relying solely on rate limits often fails against such distributed and cleverly disguised activity.
Prevention Tactics
Experts recommend that platforms keep watch for suspicious behavior at key stages: account creation, the first outbound messages, and the first bank or card link. Possible red flags include disposable email usage, multiple accounts sharing device or location fingerprints, account linking immediately after signup, and spikes in link volume.
Firms should also consider setting stricter verification thresholds or additional checks for new or low-trust users, scanning messages before they’re sent, and closely reviewing aggregator invoices against normal volume. In one case study, after adopting such measures, a client cut fraudsters’ window from several hours to under one minute and shut down over 230 fraudulent accounts in a single month (May 2026).
Indicators of compromise (IoCs) noted include device identities linked to both phishing and card-checking accounts, disposable or temporary email addresses, network anonymization, and rapidly linked bank or card accounts following signup. These can help security teams build detection strategies.
What this signals is a shift in fraud technique: rather than forcing large, directly traceable losses, attackers are opting for low-cost probing operations that degrade trust, bleed platforms, and scale quietly. The damage may not show up as huge stolen amounts, but it can erode user confidence, increase operational costs, and strain fraud detection efforts.
Looking ahead, vigilance over platform notifications and account-linking flows will become essential. As open banking grows, platforms must build resilient detection pipelines—connecting the dots across message delivery, credential checking, device identity and network behavior—to protect users and their own bottom lines.
