Phishing Schemes Thrive by Faking Suspensions of Banking Sites
Researchers reveal how scammers are cleverly avoiding detection by fabricating website suspensions.
A recent investigation by KELA highlights a sophisticated phishing infrastructure that enables scammers to masquerade as legitimate banking websites while evading detection. This tactful scheme allows them to host numerous fraudulent sites targeting unsuspecting victims.
A Network of Deceit
As of October 25, 2026, KELA's research uncovered 248 fake domains linked to 189 major U.S. banks and financial services. These deceptive sites often utilize domain names that incorporate terms like secure, disable, and cancel, targeting particularly the business banking sector to lure in victims.
A Clever Tactic for Evasion
What sets this phishing campaign apart is the method used to conceal their activities. Typically, when a domain is flagged for illicit behavior, law enforcement steps in, leading to visible takedown notices. However, these cybercriminals have devised a means to display fake suspension notices, creating the illusion that their fraudulent operations have been interrupted.
On their second visit, unsuspecting users may come across a message indicating their account has been suspended, which cleverly distracts from the site's malicious intentions. This faked diversion not only misleads individual users but also confuses scanners and cybersecurity teams monitoring for fraudulent activity.
The Mechanics Behind the Deception
The operation relies on a phishing kit that logs the IP addresses of visitors. When a user returns, they are greeted with a faux
