This clever banking scam keeps phishing by faking its own demise – how it works

You won't see the 'suspended' sign because it's not meant for you.

Read full bio

November 3, 2026, 9:15 am ET

Yuliya Taba/iStock/Getty Images Plus

ZDNET’s key takeaways

Fake banking websites are faking their own suspensions to fly under the radar

While scanners see a takedown notice, victims don’t.

Hundreds of fake domains are still active.

KELA researchers have exposed an active financial-scam infrastructure that hosts hundreds of fraudulent websites capable of faking their own suspensions to stay online. As of Oct. 25, 2026, 248 financial scam and phishing domains tied to 189 major US banks and financial services have been linked to the same infrastructure.

According to the cybersecurity firm’s report, published on Tuesday, the “Suspended” infrastructure operation runs websites that have cloned the official domains of victim organizations, with a particular focus on business banking. Many domains use the [keyword]-[bank].com format, slotting in keywords such as “secure,” “disable,” “protect,” and “cancel.”

Also: Beware of Bluetooth sniffers: How your favorite gadgets could be exposing your data

A handful of servers spread across two shared hosting providers run the backend of Suspended infrastructure, which has also been tied to phishing campaigns targeting cryptocurrency exchanges and government services in the UK, the Netherlands, Australia, and New Zealand. As a result, the researchers believe that either a single operator is behind the setup or that the server infrastructure is part of a wider phishing-as-a-service platform.

This phishing campaign stands out because of how the cybercriminals behind the scam are protecting it: by issuing takedown notices.

When you visit a website and see a message that it has been taken down or suspended, it’s usually because the domain has been associated with malicious or illegal activity, including phishing and scams. Law enforcement agencies, often with help from technology firms, find these websites, obtain the necessary court orders, and seize the infrastructure or accounts behind them to force a suspension through a registrar or hosting provider.

You see the notice, you move on — and this also goes for scanners and security teams.

However, in this case, the scam artists created a mechanism to show it themselves, to avoid being flagged and taken down. But it’s when they show it that matters.

The false suspension notice appears deceptively simple at first glance. A phishing kit embedded in the domain registers the IP address of each visitor, and on their second visit, they are shown a fake “account suspended” page. The kit is disguised as a challenge page similar to those legitimately used by Cloudflare.

Researchers also detected other decoys, including “Sorry, you’ve been blocked” notices, blank pages, and redirections to Google. Some pages also have reCAPTCHAs, and the researchers detected scripts that block browser developer tools, likely to slow analysis.

Also: Don’t use Muse? Meta’s AI agent can still access your private messages – here’s how

But why show fake suspension notices in the first place? To scanners and cybersecurity teams, it looks like someone else has already dealt with the malicious domain, and they can move on to the next suspicious website.

“That design targets exactly the people who could shut a site down,” KELA says. “A victim typically follows a link once. A scanner, a security team or a takedown provider checks a reported site and then checks it again to confirm, and the second check shows what looks like a completed takedown.”

As shown in the image below, while scanners would detect a suspension notice, victims would still see the cloned website, complete with lures to entice them into entering their information, leading to financial fraud and potentially identity theft. After all, one visit is enough.

As of this writing, there are 248 live domains, plus those taken offline after the researchers disclosed their findings to law enforcement; over 300 scam domains have been hosted on the same infrastructure since May this year. Unfortunately, this phishing campaign remains active, with new domains appearing every day.

One lead could reveal the operator: a remote desktop connection to the malicious infrastructure through a standard UK home broadband connection, but it has not been verified.

Use a phishing link checker to verify whether a URL is trustworthy, and remember that any email or message claiming to be from your bank may be fraudulent.

Typical signs of a bank phishing email include:

When it comes to organizations, KELA has released a free Bank Phishing Check tool that compares official domains and organizations against the websites uncovered during the firm’s research.

Log In to Comment

Log Out

Community Guidelines

Please accept cookies to view the comments powered by Disqus.