Cybercriminals are using deceptive tactics to mimic website suspensions, allowing them to remain active and deceive victims.
A recent report has shed light on a novel phishing scheme that has banking scammers evading detection by fabricating their own website suspensions. This strategy helps them maintain a presence online, putting unsuspecting users at risk.
Understanding the Operation
KELA, a cybersecurity research firm, has discovered an extensive network of fraudulent banking websites. As of October 25, 2026, they identified 248 phishing domains tied to 189 major U.S. banks and financial organizations. These fake sites predominantly target the business banking sector, employing misleading domain names that include terms like "secure," "disable," "protect," and "cancel" to create a false sense of security.
The Unique Approach of Scammers
This phishing operation is particularly notable due to its innovative method of deception. Usually, when a domain is reported for malicious activity, law enforcement acts swiftly to suspend it, often leading to visible takedown notices that inform users of the action. However, the cybercriminals behind this scheme have devised a tactic to display their own fake suspension notices.
When a victim revisits one of the scam sites, they encounter a fabricated message indicating their account has been suspended. This tactic effectively misleads visitors into thinking the site has been appropriately dealt with, allowing the scammers to continue to operate undetected. It is a clever diversion designed to confuse security scanners and unsuspecting users alike.
Working of the Phishing Infrastructure
The mechanism behind this operation relies on a phishing kit that records the IP addresses of visitors. Upon a second visit, users see a fake "account suspended" page that resembles legitimate security notices, such as those used by reputable service providers like Cloudflare. This page is designed to deter further scrutiny by security entities.
In addition to fake suspension notices, researchers found other deceptive tactics on these websites, including blank pages, misleading messages stating "you've been blocked," and scripted pop-ups that hinder users from analyzing the site's backend. These tactics are aimed at escaping detection by cybersecurity teams.
The Scale of the Phishing Threat
As of now, KELA reports that there are 248 active fraudulent domains, with more than 300 scam sites having operated from this infrastructure since May. The reality is that this phishing campaign continues to thrive, with new domains being created daily, endangering countless individuals.
Detecting Fake Banking Websites
To safeguard against these malicious websites, users should employ phishing link checkers to verify the credibility of URLs before entering any personal information. Additionally, awareness of potential signs of phishing emails is crucial. Look out for:
- Strange Email Addresses: Watch for domains with unusual spellings or slight alterations.
- Poor Formatting: Be cautious of messages with typos, poor grammar, or vague language.
- Emotional Manipulation: Phishing scams often create a sense of urgency or panic to elicit quick reactions.
- Suspicious Links/Attachments: Avoid clicking on links or downloading attachments from unknown sources.
KELA has also launched a free Bank Phishing Check tool to help organizations identify legitimate domains compared to the fraudulent ones discovered through their investigations. This resource can be invaluable for those looking to protect themselves from emerging phishing threats.