Clever Scam Makes Fake Suspensions to Evade Detection

Recent research by cybersecurity firm KELA has unveiled a sophisticated financial scam that uses deceptive tactics to evade detection. The investigation revealed hundreds of fake banking websites that not only mimic the official sites of numerous U.S. financial institutions but also generate false suspension notices to mislead both users and cybersecurity teams.

The Rooftop of Deceit

As of now, there are 248 active phishing domains associated with 189 prominent U.S. banks and financial services, all tied to the same scam infrastructure. These fraudulent sites cleverly adopt domain names that include misleading keywords like 'secure,' 'protect,' or 'cancel,' aiming to lure unsuspecting victims.

How the Scam Operates

This innovative approach to phishing goes beyond traditional tactics by creating its own takedown notices. When users attempt to visit the website, they may see a message stating that the site has been suspended, which typically indicates unlawful activity. However, this is a ruse orchestrated by the scammers to make it appear as though their site has been flagged and dealt with.

Researchers note that the so-called “suspended” notice is part of a larger phishing kit worked into the domain itself. When individuals revisit the site, they encounter a counterfeit 'account suspended' page designed to resemble legitimate content. Some pages may even redirect visitors to harmless-looking sites, attempt to block browsers from revealing the scam, or present fake CAPTCHA challenges to further confuse.

The Motives Behind the Deception

The primary strategy behind displaying these fake suspension notices is to outsmart cybersecurity checks. While a typical victim might visit the fraudulent site just once, security teams perform due diligence by revisiting to confirm any suspicious activity.

KELA emphasizes that this design is targeted specifically at those who could potentially eliminate the phishing site. Thus, when scanners see a suspension notice, they often consider the matter resolved and move on, leaving the scam operational.

The Extent of the Issue

Currently, hackers are maintaining 248 active domains, and researchers discovered that over 300 distinct scam domains have been hosted through this malicious framework since May of the current year. Alarmingly, new domains appear frequently, demonstrating the ongoing scale and adaptability of this phishing campaign.

Protecting Yourself from Phishing

To reduce the likelihood of falling victim to such scams, it is crucial to remain vigilant. Here are some tips for recognizing fake banking websites:

• Check Email Addresses: Watch for unusual or misspelled email addresses that might signify a fraudulent source.
• Look for Poor Formatting: Phishing emails often contain grammatical errors or awkward phrasing that can be a clear signal of deception.
• Be Wary of Emotional Triggers: Scammers often use panic-inducing language to provoke hasty reactions. Always verify the legitimacy of such communications by contacting your bank directly.
• Avoid Suspicious Links and Attachments: Malicious links and files may lead to phishing sites or malware, so it’s best to be cautious of them.

To assist organizations in protecting against such threats, KELA also released a free tool called the Bank Phishing Check. This tool allows users to verify the authenticity of banking domains in relation to the websites exposed in their research.