Hackers Abuse Open Banking for Free Credential Testing and Phishing
Fraudsters are exploiting open banking services to test stolen credentials and conduct phishing campaigns, using spend-management platforms to verify bank details and send malicious messages without incurring costs.
Cybercriminals have devised a novel method to leverage open banking services as a cost-free credential testing ground. A campaign identified by Group-IB reveals that fraudsters are exploiting the account-linking features of spend-management platforms. These platforms, designed for legitimate users to manage their finances, are being used to verify the validity of stolen bank and card credentials and to check if associated accounts contain funds. Crucially, the spend-management platform inadvertently covers the costs of these checks through its open-banking provider, effectively turning it into a free service for the attackers.
The scheme involves two primary tactics. Firstly, fraudsters use the platform's notification system to send out phishing messages. These messages impersonate legitimate services, such as the online marketplace Poshmark, claiming a sale is pending verification. Recipients are urged to click a link, which leads to a fake page designed to harvest personal and payment data. It's important to note that Poshmark itself was not involved in this activity, nor were its systems compromised. The phishing pages are sophisticated, requesting a wide range of sensitive information including names, card details, phone numbers, email addresses, one-time passcodes, and even online banking credentials.
Secondly, and perhaps more innovatively, the account-linking process itself is weaponized. When a user attempts to link a bank account or card through an open-banking aggregator, the platform typically retrieves account details like balance and transaction history with the user's permission. Attackers exploit this by using stolen credentials to initiate these links. A successful link confirms to the fraudster that the credentials are valid and the account is active, providing a valuable signal without them having to pay for the verification service. Group-IB estimates that each successful verification might cost the platform between $0.30 and $1.00.
Group-IB observed that both the phishing and credential-checking activities were occurring in parallel, often using the same compromised devices. This linkage helps investigators connect seemingly disparate incidents. The attackers are not directly stealing funds from the platforms but are using them as infrastructure for their fraudulent operations. This makes the activity harder to detect, as the costs are absorbed by the platform's aggregator invoices rather than appearing as direct fraud losses on the platform's own records.
The observed infrastructure included disposable email addresses, various hosting services, VPNs, and a mix of proxy and residential IP addresses. The attackers also employed techniques to obscure their origins, such as sharing device and location fingerprints across accounts created from different identities. This sophisticated approach means that traditional security measures like blocking single IP addresses or relying solely on basic rate limits may prove insufficient.
Group-IB recommends that platforms monitor for suspicious activity at key points: account creation, the initial outbound messages, and the first bank or card link. Indicators include the use of disposable emails, repeated device or location fingerprints, rapid messaging to unfamiliar recipients, and account linking shortly after sign-up. By analyzing these events collectively, security teams can identify connected malicious behavior rather than treating each action in isolation.
To mitigate these risks, platforms can implement stricter limits or additional verification steps for new or low-trust accounts, scan outgoing links for malicious content, and monitor for unusual spikes in account-linking activity. Financial teams should also reconcile aggregator invoices with normal customer demand to identify potential abuse. Following the implementation of these measures, one client reportedly reduced the time to block fraudulent accounts from several hours to under a minute, successfully stopping over 230 accounts in a single month.
This campaign highlights a growing trend where cybercriminals are finding innovative ways to monetize stolen credentials and conduct phishing operations by exploiting legitimate services and financial infrastructure, often at the expense of the service providers rather than directly from end-users.