Key takeaway: Passing 3D Secure is no longer proof a payment is clean. Group-IB recommends that financial institutions treat high-value 3D Secure payments to government billers as higher risk. That risk rises when a recent device registration, eSIM change, or transfer-limit increase comes just before the payment. The firm also advises fraud detection teams to correlate web, mobile, and payment signals under a single customer identity. That beats relying on any one channel alone.
Group-IB has uncovered a multi-stage fraud scheme operating across the Gulf Cooperation Council. In it, criminals use stolen credit cards to pay real government bills and fines. They then resell those “paid” bills to members of the public at discounts of 50% to 80%.
The cybersecurity firm’s Fraud Protection team detected roughly 300 related incidents across several major retail banks. The incidents occurred between October 2025 and August 2026. Activity peaked in January 2026, as operators moved away from earlier digital-wallet cash-out methods. Group-IB confirmed USD 2.01 million in fraudulent value across a validated subset of 80 compromised cards. That subset covered three types of government bill payments: justice-sector fines, electricity bills, and property or rental charges.
The scheme runs in three layers, according to Group-IB. Fraudsters build more than 400 phishing resources from five phishing-kit families across roughly ten disguise patterns. They promote the resources through geo-targeted Google Search ads that clone government and insurance portals.
Victims hand over card numbers, PINs, and authentication data, and unknowingly approve telecom prompts that let attackers swap their eSIM. Attackers use the hijacked number to intercept one-time passcodes and spoof the victim’s GPS location. They then take over the victim’s online banking account, raise transfer limits, and approve 3D Secure challenges themselves. Group-IB linked 90% of these takeovers to new iOS device fingerprints from a geohash cluster in Ramtha, Jordan.
In the final stage, operators recruit members of the public through dedicated Telegram channels. They offer to settle real traffic fines, utility bills, and legal charges at a discount of 50% to 80%. The fraudsters pay the full bill through the official government portal with a stolen card. They then collect the discounted “clean” payment from the customer by cryptocurrency or local bank transfer.
Why it matters: Each piece of the chain looks routine on its own. A bank sees an authenticated 3D Secure payment. A threat-intelligence team sees phishing infrastructure, and an investigator sees Telegram and cryptocurrency activity. The fraudulent payment lands with a trusted government biller rather than a merchant. Single-channel transaction monitoring rarely flags it, so the fraud hides inside what looks like a legitimate bill payment.
Sources: Group-IB; Research Hub
