Group-IB Uncovers $2M GCC Payment Fraud
Group-IB has uncovered a GCC fraud scheme that used compromised bank accounts and valid 3D Secure authentication to pay genuine government bills with stolen cards. Confirmed fraudulent payments reached about $2 million.
The cybersecurity company said the scheme involved around 300 related incidents across several major retail banks between October 2025 and August 2026. Group-IB, confirmed losses involved 80 compromised cards linked to three government institutions.
Fraud passed valid 3D Secure checks
The attackers did not directly defeat individual payment controls. Instead, they compromised several authentication factors before making payments. In the confirmed cases, fraudulent transactions passed valid 3D Secure authentication.
This happened after attackers gained control of the cardholder’s mobile number and banking account. As a result, the payment itself could appear legitimate even though the identity and devices behind it had already been compromised.
The attackers compromised several authentication factors before making payments.
The fraud chain combined phishing, eSIM abuse, account takeover and official government payment portals. Group-IB said paid search advertisements directed victims to fraudulent pages.
There, attackers collected card information and other credentials. An eSIM swap could then give them control of the victim’s mobile number and access to authentication codes.
Government bills used to cash out stolen cards
Group-IB described the method as a “bill-discount cash-out.” Fraudsters offered to settle a person’s genuine government bill or fine at a significant discount. They then paid the full amount through the official portal using a stolen card. In return, they collected the discounted payment from the customer.
The confirmed fraudulent value included about $1.39 million used to settle legal fines. Another $561,323 went to utility bills, while $66,909 covered property and rental charges. Around 300 incidents were flagged overall. However, the confirmed figures covered three institutions and 80 compromised cards.
Group-IB stressed that the government institutions and payment providers were themselves being abused by the attackers. The report does not allege wrongdoing, negligence or compliance failures by those organizations.
eSIM and new-device activity provide warning signs
Group-IB found that 90% of investigated cases included a login from a previously unseen device fingerprint shortly before the fraudulent 3DS attempt.
The sessions also showed indicators such as GPS spoofing and eSIM swaps. iOS devices accounted for 83% of observed sessions across 209 unique fingerprints. Android accounted for 17% across 42 fingerprints.
In 90% of investigated cases, a previously unseen device appeared shortly before the fraudulent 3DS attempt.
The findings show why payment authentication should not be assessed in isolation. Group-IB recommends correlating web, mobile and 3DS activity. It also recommends applying extra scrutiny when high-value government payments follow new-device logins, eSIM changes, roaming activity or card-limit increases.
The company divides the operation into three functional layers. These include phishing and victim acquisition, account takeover and credential checking, and a cash-out marketplace used to recruit customers for discounted bill payments. However, Group-IB said the available evidence does not establish that a single organization operated all three layers.
