🚨 Our latest research suggests that a significant share of newly registered business accounts in France may be linked to mule activity, highlighting how business-grade payment infrastructure combined with fast remote onboarding has created an attractive entry point for large-scale financial crime operations
Key Highlights:
🔹Verified mule business accounts are sold on underground markets for $300–$700, with sellers offering escrow services, replacement guarantees, and daily inventory.
🔹Threat actors bypass KYC by using real victims harvesting PII via phishing and socially engineering them to complete identity verification.
🔹Operations rely on SIM farms, anti detect environments, and cheap Android devices to scale account creation and maintain infrastructure.
🔹Detecting these operations requires analysing the entire account lifecycle, since sign up, KYC, and first login can appear legitimate in isolation.
Read the full technical analysis.
#FraudPrevention #FintechSecurity #CyberSecurity
Key Highlights:
🔹Verified mule business accounts are sold on underground markets for $300–$700, with sellers offering escrow services, replacement guarantees, and daily inventory.
🔹Threat actors bypass KYC by using real victims harvesting PII via phishing and socially engineering them to complete identity verification.
🔹Operations rely on SIM farms, anti detect environments, and cheap Android devices to scale account creation and maintain infrastructure.
🔹Detecting these operations requires analysing the entire account lifecycle, since sign up, KYC, and first login can appear legitimate in isolation.
Read the full technical analysis.
#FraudPrevention #FintechSecurity #CyberSecurity
🔥7❤4👍4
🚨The Checker You Pay For: How Spend-Management Onboarding Became Fraud Infrastructure
How can cybercriminals turn a legitimate financial platform into a tool for fraud?
In a new investigation, Group-IB researchers examined a suspected Classiscam operation that abused a spend-management platform’s notification systems to distribute Poshmark-impersonation phishing and its open-banking account-linking flow to validate stolen bank and card credentials.
🔹 Trusted payment notifications used to deliver phishing.
🔹 Open-banking abused to check stolen credentials.
🔹 Device and graph analysis linked phishing and card-testing accounts.
🔹 Group-IB reduced fraudulent account blocking time from several hours to under a minute, stopping more than 230 accounts assessed as fraudulent in May 2026 alone.
Read the full investigation.
#FraudPrevention #ThreatIntelligence #FinTechSecurity
How can cybercriminals turn a legitimate financial platform into a tool for fraud?
In a new investigation, Group-IB researchers examined a suspected Classiscam operation that abused a spend-management platform’s notification systems to distribute Poshmark-impersonation phishing and its open-banking account-linking flow to validate stolen bank and card credentials.
🔹 Trusted payment notifications used to deliver phishing.
🔹 Open-banking abused to check stolen credentials.
🔹 Device and graph analysis linked phishing and card-testing accounts.
🔹 Group-IB reduced fraudulent account blocking time from several hours to under a minute, stopping more than 230 accounts assessed as fraudulent in May 2026 alone.
Read the full investigation.
#FraudPrevention #ThreatIntelligence #FinTechSecurity
👍4🔥3