The phishing email that told sellers their buyer had already paid did not come from the scammers' own servers. It came from a real spend-management platform, generated by that platform's own payment-notification system, and that is exactly why it worked.
Fraud analysts at Group-IB have documented a scheme in which a scam-as-a-service operation abused a legitimate business payments platform twice over: first to deliver phishing to people who were never its customers, and then to check whether the bank and card credentials that phishing collected were live. Group-IB assessed the activity as consistent with Classiscam, the long-running operation in which crews use Telegram bots to generate fake pages and harvest payment data from users of online marketplaces. The platform, a Group-IB Fraud Protection client, is not named.
A fake sale delivered by a trusted brand
At the end of April 2026 the platform reported that its payment-notification and email systems were being used to send phishing links to thousands of recipients a day. The method was simple. The operators added a victim's email address inside the platform, and the platform itself sent the fraudster's message: a "paid" expense notification impersonating the marketplace Poshmark, saying a sale was on hold until the recipient completed an identity check through a shortened link. Group-IB stresses that Poshmark was also impersonated and its systems were not compromised.
A notification from a legitimate payments business may be less likely to be filtered as spam, and its brand implies money is waiting. The link led to a Poshmark lookalike page with a countdown timer and a form asking for name, card details, phone number, billing address, one-time passcode and card balance.
The sign-up flow became a free credential checker
Stolen credentials have to be tested before they can be cashed out, and that step usually happens against the victim's bank. Here it ran against the platform's own bank-account linking flow, which is brokered by an open-banking aggregator. The login-based path returns live balances and transaction history, so a successful link confirms not just that a credential works but that the account behind it is funded.
Checking ran alongside the phishing in real time, so stolen one-time passcodes could be used at once. On 28 April alone, one device identity ran six phishing-sender accounts and six card-testing accounts. Switching to one account per device did not help: a shared device and geo-fingerprint still revealed one physical machine, despite disposable emails, VPNs, proxies and residential IPs used to dodge rate limits.
A cost that never hits the fraud ledger
The platform was not robbed; it was borrowed. Group-IB estimates open-banking verification is commonly billed at roughly USD 0.30 to 1.00 per successful link, and illustrates that if 0.5 to 1 per cent of one million annual links were checker traffic, the platform would quietly pay about USD 2,500 to 5,000 a year to run the fraudsters' testing. The bigger exposure, the researchers argue, is regulatory: rules in Australia, the US and the UK increasingly push scam-prevention duties onto firms whose services enable a scam, not only those whose customers lose money. None of them names spend-management platforms today.
The same pattern of borrowed trust has shown up before, as when genuine Docusign emails carried a phishing kit's lure, and the wider fraud economy has been scattering across Telegram where Classiscam-style bots live.
Block at sign-up, first message and first link
Group-IB's advice is to stop watching only the transaction and watch the steps before it. Three moments expose this abuse: account creation (disposable email, a device or geo-fingerprint already seen on other accounts, automated sign-up rhythm), the first outbound message (a brand-new account emailing strangers, inviting many recipients fast, or repeating the same text, checked against phishing and domain intelligence), and the first bank or card link. Graph analysis tied both sets of accounts to one operator. In this deployment, onboarding-stage blocking cut time-to-block from several hours to under a minute, and more than 230 fraudulent accounts were stopped in May 2026.
For any platform that pairs frictionless onboarding with free, instant open-banking links, the lesson is uncomfortable: the fraud you cannot see on your books may be the fraud you are eventually asked to answer for.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.