Fake Poshmark Alerts Fuel Bank Login Testing

Criminals abused an unnamed spend-management platform’s open-banking connection feature to test stolen bank logins and identify accounts with available funds. They also used the platform’s legitimate notification system to send fake Poshmark sale alerts, directing victims to counterfeit pages that collected personal data, card details, bank credentials, and one-time passcodes.

Key findings

• Attackers used login-based open-banking connections to validate stolen bank credentials and view linked accounts’ balances and transaction histories without making payments.
• Fraudsters abused legitimate payment-notification and email systems to distribute phishing links to thousands of people each day.
• The messages impersonated Poshmark and claimed that a sale required identity verification.
• Victims who followed shortened links reached counterfeit marketplace pages with countdown timers and forms seeking personal data, payment-card details, bank credentials, and sometimes one-time passcodes.
• Shared device fingerprints linked the phishing operation with accounts conducting stolen-credential testing, enabling newly stolen verification codes to be used quickly.
• Group-IB found the activity consistent with the Classiscam scam-as-a-service operation, but did not definitively attribute it.

Who’s being targeted

• Commonly targeted roles: Bank customers, Online marketplace users and sellers, Financial-platform administrators, Fraud teams, Messaging and email platform teams, Bank security teams, Customer support teams.
• Affected industries: Financial technology, Banking, Open-banking platforms, Online marketplaces, Payment and messaging services.
• Attack channels: email, website.
• Impersonated: Poshmark.

Awareness takeaways

• Do not enter bank credentials or one-time passcodes after following a marketplace link in an unexpected sale notification; independently open the marketplace app or type its known address into a browser.
• Treat urgent verification requests and countdown timers as warning signs, especially when the message claims a transaction or sale cannot proceed without immediate action.
• Financial-platform teams should investigate repeated bank-linking attempts from newly created accounts, even if no payment has been made.
• Bank security teams should review and revoke unfamiliar third-party account connections when stolen credentials or credential-stuffing activity is suspected.

Red flags to watch for

• The notification is sent through an unfamiliar or unexpected payment-notification system.
• A shortened link leads to a counterfeit marketplace page rather than a known Poshmark domain.
• The page uses urgency tactics such as a countdown timer and asks for bank credentials or a one-time passcode.