Hackers used a legitimate financial platform to test stolen bank logins without paying for the checks.
In an Oct. 20 report, Group-IB described criminals abusing an unnamed spend-management service to check stolen credentials and distribute phishing messages.
For security teams, the case exposes a monitoring gap: account linking and customer notifications can support fraud before transaction controls detect any money moving.
Account linking exposed bank balances and transaction histories
Customers could connect external bank accounts through an open-banking aggregator. Successful connections returned account balances and transaction histories, allowing criminals to confirm which stolen logins worked and identify accounts holding funds.
Manual linking through routing and account numbers did not provide the same information. Attackers instead exploited the login-based connection to test credentials without initiating a payment.
Group-IB estimates that open-banking verification commonly costs platforms roughly $0.30 to $1 per successful connection, depending on billing arrangements. These are industry estimates, not confirmed charges for the affected service. Criminals obtained the results without paying the verification fees themselves.
Fake marketplace alerts helped attackers collect banking details
In late April 2026, the platform reported that its payment-notification and email systems were being abused to distribute phishing links to thousands of recipients daily. Fraudsters registered accounts using disposable email addresses and generated messages impersonating Poshmark, telling recipients that a sale required identity verification.
Shortened links directed recipients to counterfeit marketplace pages displaying countdown timers. Fraudulent forms collected personal information and card details, sometimes requesting banking credentials or one-time passcodes.
Investigators connected the phishing activity to credential-testing accounts through shared device fingerprints recorded on April 27 and 28. Both operations ran simultaneously, allowing newly captured verification codes to be used quickly. Researchers found similarities with Classiscam, a scam-as-a-service operation.
Group-IB subsequently reduced the time needed to block suspicious accounts from several hours to under a minute. More than 230 fraudulent accounts were stopped during May 2026. The report does not name the platform or quantify total losses. Group-IB assessed the activity as consistent with Classiscam, rather than definitively attributing it to that operation.
Financial platforms should investigate activity before money moves
For organizations operating financial integrations, fraud detection needs to cover the activity preceding a payment. Depending on which services you manage, several checks can help identify abuse before attackers use verified credentials elsewhere.
- Fintech and platform administrators. Review repeated bank-linking attempts from newly registered accounts and correlate suspicious registrations using bot protection and device intelligence. Compare aggregator charges with legitimate customer connections to identify unexplained verification costs.
- Fraud and messaging teams. Examine spikes in payment notifications sent to unfamiliar recipients, especially from new accounts. Review embedded links and apply controls against phishing through legitimate services to prevent financial notifications from distributing fraudulent instructions.
- Bank security teams. Investigate unusual third-party account connections when credential-stuffing activity or stolen logins are suspected. Review recent authorizations, revoke unfamiliar connections where supported and coordinate credential resets with affected customers.
Finance teams should also review verification expenses alongside security findings, since unusual billing increases may reveal abuse that transaction monitoring misses. Catching these patterns early gives organizations an opportunity to interrupt credential testing before criminals use the information for further fraud.
More cybersecurity news: A compromised ETS login exposed sensitive records belonging to millions of current and former California students.