lili.co

I discovered a phishing campaign within Stripes merchant platform I'll add more details later, but essentially Stripes merchant dashboard, specifically within their "radar" module, you can link external bank accounts associated with you or your business. When following the link to add an external account there is a pop-up window that resembles Plaid's external acct API. However Stripe confirmed to me that they are using their own code for this element. There is a "bank" listed under the name Lili, which you may recognize as the popular mobile banking app featuring a yellow and black logo. The form simply displays a field for your username and password, and then a link at the bottom "continue to financial institution" as well as "Submit." Following the former will redirect you to the domain "lilibank.com," which appears to be some sort of real estate company based out of Canada. However, there's little to no actual information on this site. And the few listings I attempted to verify were not even for sale. The site also has no real information on who controls it or how to contact them, lots of 404's etc. Regardless, whatever "lilibank.com" is, they certainly don't seem to have a need for bank credentials to link to Stripes platform as an "external account." Stripe wouldn't tell me how long they had been allowing this phishing/misrepresentation campaign to go on but from what I was able to dig up it seems to have started sometime around January 2023. Or am I missing something here? Lili's authentic domain is "lili.co", not "lilibank.com", and can usually be found via Plaid's tool, you just have to use the search function. I was asked by Stripe continuously to reach out to my bank to ensure I had the correct domain. And as of the time of this post the extremely misleading/fraudulent representation of Lili is still collecting creds.