Bank Phishing Sites Fake a 'Suspended' Page to Dodge Takedowns: 248 Look-Alikes of 189 US Banks, and What Finance Teams Should Check

Researchers at the threat intelligence firm KELA say one phishing operation has built hundreds of fake websites that copy US bank logins, mostly business banking and treasury portals. Some of these sites hide by pretending to be shut down. If anyone at your company logs in to a bank portal to send wires or ACH payments, this campaign is aimed at them, and a phishing link that now looks dead may still be working.

What happened with the bank phishing sites

KELA's report was last updated November 3, 2026. All of the following figures come from KELA's own research:

• As of October 25, 2026, KELA counted 248 live phishing domains impersonating 189 US financial institutions.
• Since May 2026 it has tied more than 300 domains to the same infrastructure, some of them now offline.
• Most of the targets are regional banks and commercial lenders, and many of the cloned pages are business banking or treasury logins, not personal accounts.
• In the week to October 25, 49 new domains went live and 15 were taken down. The operation is still growing.
• A few domains date back to late 2025. Most were registered between July and September 2026, with the peak in August.

The domain names follow a simple pattern: [keyword]-[bank].com, using words such as secure, disable, protect and cancel. KELA also reports a growing group of business-themed names built on a bank's name, such as help-desk, live-support and treasury-portal.

How the fake suspended page works

According to KELA, the phishing kit records each visitor's IP address. On a first visit you get a convincing bank login form asking for a user ID and password, and the business banking versions add a Company ID field. Come back from the same IP address and some domains show a "This account has been suspended" page with a "Contact your hosting provider" link instead. It is built to look like a web host closed the site.

Not every domain uses that page. KELA says some show other decoys: a "Sorry, you have been blocked" notice, a blank page, or a redirect to Google. Some newer domains also block traffic from anonymization networks. KELA did not say how many domains use each decoy.

The trick works because of how phishing gets checked. A person or tool opens a reported link, sees the phishing page, and reports it. When someone checks again to confirm the takedown, they see what looks like a closed site. In KELA's words: "a takedown provider can mark a look-alike domain as down while it is still serving the phishing page to new visitors."

KELA describes other features as well. The browser tab title copies the title of Cloudflare's challenge page while the page itself shows bank branding. Some deployments show a reCAPTCHA before the login form, and the pages load a script that blocks the browser's developer tools. The domains sit behind Cloudflare, but brief gaps exposed real servers at two shared hosting providers.

What is confirmed and what is not

Confirmed by the researchers: the domain counts, the naming pattern, the IP-based decoy pages, and the hosting links above. KELA also says the backend runs phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand, which it says points to a single operator or a phishing-as-a-service platform.

Not known:

• Who runs the operation. KELA has leads, including a management server and a jump server, but has not named anyone.
• How many people entered their details, or how much money was lost.
• Whether any bank or business has publicly confirmed fraud tied to these domains.
• How victims reach the sites. In the parts of the report we read, KELA does not say whether the links arrive by email, text, search ads or something else.

These are KELA's findings. As of November 5, 2026, we have not seen a bank or government agency confirm the figures on its own.

The wider problem is well documented, though. In a public service announcement dated November 25, 2025, the FBI's Internet Crime Complaint Center (IC3) said it had received more than 5,100 complaints of account takeover fraud since January 2025, with losses over $262 million. The FBI described criminals using phishing websites that copy real bank or payroll login pages, and buying search ads that imitate real ones. That alert is not about this campaign, but it shows where stolen bank logins end up.

Why this matters for a company

A stolen personal banking password is bad. A stolen business banking or treasury login can send money out of the company. This campaign goes after exactly those logins, at regional banks and commercial lenders that many companies use for operating accounts and payroll.

The decoy also changes how your team should handle a reported link. If an employee forwards a suspicious link and IT opens it later from the same office connection, IT may see a "suspended" page and close the ticket. By KELA's account, scanners and takedown services can be fooled the same way. A link that looks dead is not proof that nobody was phished.

If your own brand is ever copied like this, the same applies: a vendor's "taken down" status is worth checking from a different network before you call it done.

What to do this week

If someone has already typed in bank credentials, the FBI's guidance is: call the bank right away to ask for a recall or reversal and a Hold Harmless Letter or Letter of Indemnity, reset every exposed password (including anywhere the same one was reused), and file a complaint at ic3.gov that includes the words "Account Takeover".

Bank phishing questions people are asking

How do I know if a bank website is fake?

Check the address bar, not the logo. These sites use names like [keyword]-[bank].com. The safest habit is never to log in from a link at all: use a saved bookmark.

Does a "This account has been suspended" page mean a phishing site is gone?

No. KELA found that some live phishing sites show this page to repeat visitors on purpose, while new visitors still get the fake login.

Can my email filter catch these phishing sites?

It may or may not. KELA says the decoy can fool scanners and takedown services that check a site more than once. Ask your vendor how it handles cloaked links, and do not rely on filtering alone.

Is my bank being impersonated?

KELA's report links a free Bank Phishing Check tool. Your bank's fraud team can also tell you about active impersonation.

Does MFA stop bank phishing?

It helps, and the FBI says to keep it on. A fake page still collects your password, though, so the bookmark habit matters just as much.

What should I do if someone on my team entered bank login details?

Call the bank's fraud line right away, reset the credentials, and report it at ic3.gov.

The bigger lesson

Attackers now design phishing sites to fool the people and tools that check them, not just the victims. A page that looks closed is not proof that it is. The defense that does not depend on spotting the fake is the boring one: reach your bank only through a bookmark, and set up payment approvals so one stolen login cannot move money.

Want help locking down the systems your finance team relies on? See security hardening or request a tech quote.

Get security alerts like this one by email, plus our free checklist, at security alerts.

Sources: KELA: Bank Phishing Campaign Fake Takedown; FBI IC3 Public Service Announcement I-112525-PSA.