Stolen Cards Used to Pay Genuine GCC Bills: How Fraud Can Hide Behind Legitimate Transactions

A newly identified fraud scheme across the Gulf Cooperation Council has demonstrated how criminal activity can be concealed behind transactions that appear entirely legitimate.

Cybersecurity firm Group-IB has uncovered a multi-stage scheme in which stolen credit cards are used to pay genuine government bills, fines and other official charges on behalf of members of the public.

The customers are offered substantial discounts, often between 50 and 80 per cent, to have their legitimate bills settled.

They then pay the fraudster a reduced amount through a local bank transfer or cryptocurrency.

The government institution receives the correct payment and the customer's genuine liability is settled. However, the original payment has been made using a compromised card.

According to Group-IB, approximately 300 related incidents were detected across several major GCC retail banks between October 2025 and August 2026.

In a validated sample involving 80 compromised cards and three types of government-payment channels, confirmed fraudulent transactions reached $2.01 million.

The scheme illustrates an important challenge for businesses, banks and individuals: a transaction can look legitimate at the point of payment while being connected to fraud elsewhere in the chain.

How the Scheme Works

The fraud identified by Group-IB involves several stages rather than a single compromised transaction.

The first stage involves phishing.

Researchers identified more than 400 fraudulent online resources using multiple designs to imitate government portals and insurance services.

These sites are intended to obtain personal information, payment-card details and authentication data from victims.

Group-IB says the attackers can then compromise the victim's mobile or banking access, enabling them to approve authentication requests associated with fraudulent transactions.

The stolen cards are subsequently used to settle genuine bills through legitimate government payment portals.

The fraudsters then recruit people through online channels by offering to pay traffic fines, utility bills, legal charges and other official liabilities at substantial discounts.

A customer with an AED1,000 liability, for example, may be offered the opportunity to have it settled for significantly less.

The customer sends the discounted amount to the intermediary.

The fraudster pays the full AED1,000 liability using compromised card details.

From the customer's perspective, the bill has genuinely been paid.

That apparent legitimacy is one of the features that makes the scheme particularly difficult to identify.

Why a Genuine Payment Can Still Be Connected to Fraud

Fraud controls commonly examine unusual transactions, suspicious recipients and abnormal payment behaviour.

This scheme presents a different problem.

The recipient of the fraudulent card payment is a genuine government institution.

The amount may correspond to a real bill or fine.

The person whose liability is being settled may also be a genuine customer.

Viewed individually, many parts of the transaction appear legitimate.

It is only when the complete chain is examined that the underlying fraud becomes visible.

Group-IB found that fraudulent payments in the confirmed cases had successfully passed 3D Secure authentication.

Rather than simply bypassing authentication controls, the criminals had obtained sufficient access to approve the security challenges themselves.

This highlights why fraud investigations may need to look beyond an individual transaction.

Understanding where funds originated, who arranged a payment and where the proceeds ultimately moved can be just as important as identifying the immediate recipient.

The Importance of Following the Transaction Chain

Complex financial fraud rarely ends with the first transfer.

Funds may move through multiple bank accounts, digital payment services, cryptocurrency wallets, companies or individuals before reaching their ultimate destination.

This can make the apparent purpose of a transaction very different from its actual role in a wider scheme.

For businesses and legal advisers dealing with suspected fraud, understanding that broader financial picture can be critical.

Conflict Advisory Group provides Asset Tracing support in matters where clients need to identify relevant assets, business interests, corporate relationships and financial connections across jurisdictions.

An asset-tracing exercise does not necessarily involve following a single payment from one account to another.

Depending on the circumstances, it may involve examining:

• Corporate ownership and connected entities.
• Property and other identifiable assets.
• Business interests.
• Relevant individuals and associates.
• Overseas corporate structures.
• Available financial and commercial information.
• Relationships between companies and counterparties.

The purpose is to establish a clearer picture of where assets may be held and how individuals or entities are connected.

Discounted Payments Should Raise Questions

For consumers and businesses, one of the clearest warning signs in this type of scheme is the offer itself.

Government fines and official bills generally have clearly established payment processes.

An unknown third party offering to settle those liabilities at a discount of 50 to 80 per cent should therefore prompt obvious questions.

How is the discount being funded?

Why can the intermediary pay the full liability while accepting significantly less from the customer?

What does the intermediary receive in return?

And where is the money actually coming from?

An unusually favourable transaction is not automatically fraudulent.

However, unexplained discounts and unconventional payment arrangements should justify additional scrutiny.

This principle extends well beyond government bills.

Businesses may encounter similar risks when offered unusually favourable payment arrangements, discounted goods, investment opportunities or third-party settlement services.

The commercial benefit being offered should not remove the need to understand who is behind the transaction.

Due Diligence Can Help Identify Wider Relationships

Financial crime often involves intermediaries.

The person receiving funds may not be the person controlling the wider operation.

A company involved in a transaction may also sit within a larger network of related businesses, directors or beneficial owners.

Where there are concerns about the legitimacy of a counterparty or commercial arrangement, independent Due Diligence can help establish the people and entities behind it.

This may include examining ownership, management, corporate history, connected businesses and relevant adverse information.

For higher-risk relationships, understanding the ultimate counterparty can be particularly important.

A registered company name alone may not reveal who controls the organisation, where its funding originates or what other entities are connected to it.

Independent verification can therefore help businesses make decisions based on a broader evidence base rather than information supplied solely by the other party.

Fraud Is Increasingly a Combination of Cyber and Financial Crime

The GCC scheme also demonstrates how the distinction between cybercrime and conventional financial fraud is becoming less clear.

The initial compromise reportedly involves phishing, account takeover and manipulation of mobile authentication.

But the objective is ultimately financial.

The stolen credentials are used to make apparently legitimate payments, while the proceeds are extracted through bank transfers or cryptocurrency.

Businesses therefore need to consider cyber and financial risk together.

A compromised account can lead to fraudulent transactions.

A fraudulent commercial relationship may rely on stolen digital identities.

And money moved through legitimate institutions can still originate from criminal activity.

Looking at these issues in isolation can make it harder to identify the complete fraud chain.

What Businesses Should Take From the Case

The research has particular relevance for financial institutions and organisations processing high-value or high-volume payments.

However, the underlying lessons apply more broadly.

Businesses should be cautious where:

• Payment arrangements are unnecessarily complicated.
• A third party offers unusually large discounts.
• Funds are being routed through unexpected intermediaries.
• Payment instructions change without a clear commercial explanation.
• The identity or ownership of a counterparty is unclear.
• A transaction appears inconsistent with the normal business relationship.

None of these factors proves fraud.

They can, however, justify additional verification before money is transferred or a relationship progresses.

Where concerns arise after a transaction has already taken place, preserving records can also be important.

Banking information, communications, invoices, company details and digital records may all help establish how the transaction occurred and identify the people or entities involved.

The Wider Lesson for UAE and GCC Organisations

Group-IB's findings show why financial crime cannot always be identified by looking only at the apparent destination of a payment.

In this scheme, the immediate recipient could be a legitimate government institution and the liability being settled could be completely genuine.

The criminality exists elsewhere in the transaction chain.

For businesses, investors and professional advisers across the UAE and wider GCC, the broader lesson is that legitimacy should be assessed across the entire relationship.

Who provided the funds?

Who arranged the transaction?

Why is an intermediary involved?

And who ultimately benefits?

When significant financial or commercial decisions are involved, understanding those relationships can be as important as verifying the transaction itself.

Conflict Advisory Group supports businesses, legal advisers and private clients with asset tracing, due diligence and corporate intelligence enquiries across the UAE and internationally.

Where fraud is suspected, establishing the wider network of people, companies and assets behind a transaction can provide an important foundation for legal, commercial and recovery decisions.