GoKawiilKELA finds 248 fake bank sites using fake 'suspended' notices to dodge takedowns
Cybersecurity firm KELA has identified an active scam network of 248 fraudulent domains impersonating 189 US banks and financial firms, many using patterns like 'secure-bank.com' or 'disable-bank.com.' The sites display fake 'suspended' notices to automated scanners and security researchers while remaining fully live and functional for the victims they target, according to KELA's report published Tuesday.
GoKawiil's interpretation of the reporting above, not reported fact.
The tactic suggests scammers are adapting directly to automated detection tools, exploiting the trust placed in takedown notices to stay operational longer than typical phishing sites. This could mean existing scam-detection systems need to verify suspensions more rigorously rather than taking a displayed notice at face value, particularly for business banking customers who may be higher-value targets.
- 248 phishing domains tied to 189 US banks share the same scam infrastructure, per KELA.
- The sites fake their own 'suspended' status to evade automated security scanners while staying live for victims.
- Domains often follow a [keyword]-[bank].com pattern using words like 'secure,' 'disable,' or 'cancel.'
YubiKey 5 Series Security Key — With phishing campaigns getting this sophisticated at mimicking banks and even faking their own takedowns, relying on passwords alone is risky. A hardware security key like the YubiKey adds phishing-resistant two-factor authentication, so even if you land on a cloned banking site, attackers can't use stolen credentials without physical access to your key.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: zdnet.com — Charlie Osborne, 2026-11-03
Published there as: “This clever banking scam keeps phishing by faking its own demise – how it works”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.