Fraudsters have found a clever way to turn open banking infrastructure into a free credential-checking service, and the company footing the bill never even realizes it is paying for the privilege. Researchers at Group-IB say they uncovered the scheme while investigating abuse inside a client’s fraud-protection environment, tracing it to a scam-as-a-service operation known as Classiscam.

The target was a spend-management platform that lets users link their bank accounts and cards through an open-banking aggregator. Criminals exploited two separate features of the platform at once: its trusted notification system, which they hijacked to send convincing phishing emails, and its account-linking process, which they used to silently verify whether stolen financial credentials still worked.

Turning Payment Alerts Into Phishing Lures

Rather than sending phishing emails directly, the attackers added victims as recipients inside the platform itself and let its own automated notification system do the work. Because the resulting messages came from a real, trusted business service, they carried far more legitimacy than a typical spoofed email. The lures claimed that a sale through the online marketplace Poshmark was stuck pending verification, urging recipients to click through and confirm their details. Poshmark had no involvement in the scheme and was simply impersonated as a believable hook.

The fake verification pages that followed were built to harvest an unusually complete set of personal and financial data, including names, card numbers, phone numbers, email and billing addresses, one-time passcodes, and even current card balances. Some versions pushed further, asking for digital wallet or online banking logins, while a countdown timer added urgency by implying victims had only minutes to claim a payout before it expired.

Free Credential Checking, Billed to Someone Else

The second half of the scheme is the more novel one. When a user links a bank account through an open-banking aggregator, the service performs a login-based check and can return details like account balance and recent transactions. That is a convenience for legitimate customers, but for a criminal testing a batch of stolen card or bank credentials, it is a ready-made verification oracle that confirms which stolen details are still active and worth selling or draining.

Crucially, the account-linking service typically bills the platform operator for each successful check, not the person initiating it. Group-IB estimates each verification costs between $0.30 and $1.00, and modeled that if just 0.5 to 1 percent of a million yearly link attempts were actually fraudulent testing, the platform could be quietly absorbing between $2,500 and $5,000 a year in fees for a service it never knowingly provided to criminals.

• Phishing and credential-checking activity ran in parallel, letting stolen one-time passcodes be used almost immediately during account-linking attempts.
• Investigators tied the same device fingerprints to both phishing-sending accounts and credential-testing accounts, with one device identity linked to six of each type in a single day.
• Attackers used disposable email addresses alongside a mix of VPNs, data-center IP ranges, proxies, and residential IP addresses to spread activity and avoid simple rate-limiting.

A Blind Spot for Traditional Fraud Monitoring

Group-IB notes that this kind of abuse is easy for fraud teams to miss because it doesn’t look like a conventional loss. There is no unauthorized purchase, no chargeback, and no direct account takeover on the platform’s own books. The victims are often marketplace sellers or cardholders who were never customers of the platform in the first place, and the cost shows up buried in an aggregator invoice rather than as a flagged fraud incident.

That makes detection a matter of watching behavior rather than waiting for losses to appear. Group-IB recommends monitoring three specific moments: account creation, the first outbound messages a new account sends, and the first attempt to link a bank account or card. Red flags include disposable email domains, device or location fingerprints that repeat across supposedly unrelated accounts, unusually fast messaging to unfamiliar recipients, and bank-linking attempts that happen almost immediately after signup.

Lessons for Fintech and Platform Security Teams

Beyond behavioral monitoring, Group-IB suggests practical controls: applying extra verification or rate limits to new and low-trust accounts, scanning outbound links before notification emails are sent, and having finance teams periodically reconcile aggregator billing against expected customer volume to catch anomalous spikes. After Group-IB’s involvement, one affected client reportedly cut its time to block fraudulent accounts from several hours down to under a minute, and stopped more than 230 malicious accounts in a single month.

The case is a reminder that fraud prevention increasingly has to account for infrastructure abuse, not just direct theft. As more fintech products plug into shared open-banking rails, the convenience that benefits legitimate customers can just as easily become a quiet subsidy for the criminals testing someone else’s stolen data.