# Classiscam-linked actors abuse open banking account-linking to validate stolen credentials

> Group-IB reports that Classiscam-linked fraudsters abused a spend-management platform's open-banking account-linking flow as a free 'checker' for stolen bank and card credentials, at roughly USD 0.30-1.00 per link billed to the platform. The same platform's notification rails delivered Poshmark-impersonation phishing that harvested card data, OTPs and balances.

- **Published:** 2026-10-20T14:49:38Z
- **Last reviewed:** 2026-10-20T14:49:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3964
- **ID:** TL-2026-3964
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Group-IB Fraud Protection (Yuan Huang and Alexander Grabko, 'The Checker You Pay For', published 2026-10-20) describes a two-stage abuse of a legitimate spend-management platform that Group-IB does not name. The platform was not the fraud target. It was the fraudsters' infrastructure tool.

Stage 1 is phishing delivery. In late April 2026 the actors created accounts on the platform and used its payment-notification and email rails to send messages impersonating Poshmark payment notifications. The lure claimed funds were being held pending identity verification and used shortened links to fake verification pages. Poshmark itself was not compromised; it was only impersonated. The forms captured names, card details, phone numbers, email addresses, billing addresses, OTPs, card balances and payment-wallet access.

Stage 2 is credential validation. The actors fed the harvested bank and card credentials into the platform's open-banking account-linking flow, which is backed by third-party open banking aggregators. A successful link confirmed that the credentials were valid and that the account was funded. The aggregator billed the platform an estimated USD 0.30-1.00 per link, so the actors tested credentials at no cost to themselves. Group-IB's illustrative estimate for a platform with 1 million annual billable links at a 0.5-1% fraud rate is USD 2,500-5,000 per year in aggregator cost, plus reputational and regulatory exposure.

The operators adapted their tradecraft. Early on they used many disposable email accounts from one or a few devices. After detection they moved to one account per device. They routed traffic through VPNs, proxies, data-center ranges, residential IPs and hosting services. They cleared cookies and used private browsing to appear as separate devices. Device-fingerprint and geo-fingerprint clustering tied the phishing and card-testing accounts to the same hardware: device identity [496-] on April 27, and [524-] on April 28, which was linked to six accounts of each type. After Group-IB's engagement the client cut fraudulent-account blocking time from several hours to under one minute and stopped over 230 accounts in May 2026 before activation.

The sources do not publish domains, IPs or hashes, so the IOCs below are behavioral and device-level indicators only. Group-IB recommends monitoring three pre-transaction points: account creation, first outbound message, and first bank or card link attempt. It also recommends rate-limiting new accounts, scanning outbound links, capping link attempts per device, and reconciling aggregator invoices against expected demand.

## MITRE ATT&CK

- T1598.003 Spearphishing Link
- T1585.002 Email Accounts
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1056.003 Web Portal Capture
- T1090 Proxy
- T1657 Financial Theft

## Sources

- [The Checker You Pay For (Group-IB Fraud Protection)](https://www.group-ib.com/blog/spend-management-abuse-fraud-classiscam/)
- [Hackers Exploit Open Banking Services to Test Stolen Credentials Without Paying a Cent](https://cybersecuritynews.com/hackers-exploit-open-banking-services/)
- [Classiscam Scam-as-a-Service Operations (The Hacker News, background on Group-IB's Classiscam research)](https://thehackernews.com/2022/08/researchers-uncover-classiscam-scam-as.html)
- [Classiscam Scam-as-a-Service raked in $64.5 million (The Hacker News)](https://thehackernews.com/2023/09/classiscam-scam-as-service-raked-645.html)
- [2026 Nacha Rule Change: Proactive Fraud Monitoring of ACH Now a Requirement (Outseer)](https://www.outseer.com/blog/2026-nacha-rule-change-proactive-fraud-monitoring-requirement)
- [The Scams Prevention Framework legislation passes Parliament (Gilbert + Tobin)](https://www.gtlaw.com.au/insights/the-scams-prevention-framework-legislation-passes-parliament-time-to-get-your-house-in-order2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3964