Bank Phishing Sites Fake Their Own Takedowns

Researchers uncovered an active banking-phishing operation using hundreds of cloned financial websites. The sites show real victims a fake bank login page, but display a convincing “account suspended” notice to security scanners on a second visit, helping the criminals avoid takedown action. The campaign particularly targets business-banking users and uses domains with terms such as “secure,” “protect,” and “cancel.”

Key findings

• KELA linked 248 live financial scam and phishing domains to one infrastructure as of October 25, 2026.
• The infrastructure targeted 189 major US banks and financial-services organizations, particularly business banking.
• Domains cloned official bank websites and often used a "[keyword]-[bank].com" naming pattern with words such as "secure," "disable," "protect," and "cancel."
• On a visitor’s second visit, the phishing kit may show a fake suspension page intended to mislead scanners, security teams, and takedown providers.
• Other anti-analysis decoys included fake block notices, blank pages, redirects to Google, reCAPTCHAs, and scripts that block browser developer tools.
• Victims seeing the cloned site are lured to enter information, creating risk of financial fraud and identity theft.

Who’s being targeted

• Commonly targeted roles: Finance and treasury teams, Accounts payable staff, Business banking users, Executives with banking approval authority, Security operations and fraud teams.
• Affected industries: Banking, Financial services, Business banking.
• Attack channels: email, website.
• Impersonated: A major US bank or financial-services organization.

Awareness takeaways

• Do not trust a banking link simply because the site looks professional or uses words such as “secure” or “protect.” Open the bank through a saved bookmark, official app, or independently typed address instead.
• Treat unexpected bank alerts that create panic, such as demands for payment, late fees, or threats of legal action, as suspicious until verified independently.
• Security teams should not assume a “suspended” or “blocked” page means a reported phishing site has been remediated. Validate suspicious domains using multiple checks and first-visit behavior.

Red flags to watch for

• The link uses a lookalike domain rather than the bank’s known official domain.
• The message uses emotionally charged urgency about account security, payment, fees, or legal action.
• The website asks for information after an unsolicited message.