This clever banking scam keeps phishing by faking its own demise – how it works

KELA researchers have uncovered a deceitful banking scam that keeps its phishing attempts alive by faking its own deactivation. As of October 25, 2026, 248 fraudulent websites targeting over 189 major US banks and financial services have been identified as part of a single infrastructure. According to the cybersecurity firm's report, the "Suspended" operation creates websites that mimic official domains, particularly focusing on business banking.

The scam's creators employ keywords like "secure," "disable," "protect," and "cancel" in their domain names.

The distinguishing factor of this phishing campaign is the use of takedown notices to conceal the operation. Upon visiting a website and encountering a "suspended" or "blocked" message, users typically move on, unaware that the site remains active. However, the criminals have engineered a mechanism to reveal this deception. A phishing kit embedded in the domain records the IP address of each visitor, and upon the user's second visit, they are directed to a fake "account suspended" page.

This is accomplished by disguising the kit as a legitimate Cloudflare challenge page, complete with decoys such as "Sorry, you've been blocked" notices, blank pages, and redirections to Google. Some pages also incorporate reCAPTCHAs and scripts that obstruct browser developer tools, potentially hindering analysis efforts.

The purpose of displaying fake suspension notices is to deceive both users and security measures. Scanners and cybersecurity teams perceive these notices as evidence of the malicious domain being handled externally, enabling them to disregard the site and proceed to the next suspicious URL. Conversely, victims may still encounter the cloned website, complete with enticing lures designed to deceive them into entering sensitive information, ultimately leading to financial fraud and potentially identity theft.

Despite the appearance of a completed takedown, the second visit reveals the fraudulent site, allowing the scammers to achieve their objectives.

Since May of this year, over 300 scam domains have been hosted on the same infrastructure. Although the phishing campaign remains active, new domains continue to appear daily. One potential lead could be a remote desktop connection to the malicious infrastructure through a standard UK home broadband connection, though this has not been verified.

To safeguard against such threats, users are advised to use a phishing link checker to verify the trustworthiness of URLs and remain vigilant against fraudulent emails or messages claiming to represent their bank.