Hackers have turned to open banking systems as a cost-free method to verify stolen bank and credit card credentials. According to a report by Group-IB, fraudsters exploited a financial management platform’s account-linking process to validate credentials and assess account balances without incurring expenses.
How Open Banking Services Are Exploited
The targeted platform did not lose money directly through theft of funds. However, it inadvertently bore the cost of credential verification via its open-banking provider. Additionally, the platform’s email and payment notifications were manipulated to dispatch phishing messages.
These phishing attempts impersonated Poshmark, claiming pending sales required verification through a provided link. Poshmark had no involvement, and Group-IB confirmed their systems remained uncompromised.
Phishing Tactics and Platform Manipulation
Group-IB analysts identified this scheme while probing the misuse of a client’s fraud-prevention infrastructure. They linked it to Classiscam, a scam-as-a-service model, involving both phishing message dissemination and credential testing through the platform.
The scam utilized the platform’s notification system to send credible-looking payment alerts. Victims were directed to a counterfeit page designed to capture sensitive information, including personal and financial details.
Financial Implications of Credential Testing
Credential testing occurred during attempts to link bank accounts or cards. Some financial management platforms allow users to connect to banks via open-banking aggregators, enabling login-based processes that reveal account details.
This verification process incurs a fee to the platform, not the fraudster. Group-IB estimates a successful verification costs between USD 0.30 to USD 1.00. For a million links annually, with 0.5% to 1% being fraudulent, costs could range from USD 2,500 to USD 5,000.
Group-IB observed simultaneous phishing and credential testing activities, with stolen one-time codes utilized during account-link attempts. Identified devices linked phishing and card-testing accounts, illustrating the coordinated nature of these attacks.
Recommendations for Enhanced Security
Group-IB advises monitoring suspicious activities at account creation, initial message dispatch, and first bank or card link. Indicators include disposable email use, recurring device fingerprints, and rapid message sending to unknown recipients.
Platforms should implement additional checks for new accounts, scan links before message delivery, and assess unusual spikes in account-linking activity. By refining these practices, a client reduced fraudulent account blocking time significantly, stopping over 230 accounts in a single month.
