Fake Suspended Bank Pages Hide Phishing Sites From Takedown Checks

Kela says 248 live look-alike domains impersonating 189 US financial institutions were still reachable as of October 25, 2026. Most go after business banking and treasury logins, the accounts that approve wire transfers and move company money. The operation’s key trick is a bank phishing fake account suspended page that makes takedown checks look as if the sites are already dead.

Kela published its research on Tuesday, November 3, and trade outlets picked it up on November 5. According to Kela’s blog, the threat actor has run look-alike bank sites since May 2026, and Kela has identified more than 300 fake domains overall. Kela’s live figures are a snapshot from October 25, so the current count may have shifted.

How the bank phishing fake account suspended page defeats takedowns

The mechanism depends on IP addresses. According to SecurityWeek, the kit logs each visitor’s address. A first-time visitor gets a convincing bank login page built to harvest credentials. A return visit from the same address gets a fake “account suspended” page instead.

That single switch works against the people whose job is to shut such sites down. Scanners and takedown teams usually re-check a reported site, often from the same network, and the re-check lands on the harmless-looking notice. The site is then marked inactive, while the phishing login stays reachable for real victims whose addresses the kit has not already flagged. PrivacyNeedle describes the same pattern.

Phishing kits that show scanners a clean page are an old evasion trick. What makes this version different is the keying on IP addresses, which lets one site look dead to a verification check while staying live for everyone else. Kela’s framing, as Mezha reported it, is that the design “targets exactly the people who could shut a site down.”

The fix on the verification side is not complicated, but teams skip it easily. The Hack Academy argues that a fake suspension page is not proof a phishing site is gone. Repeat checks from the same address do not count as independent confirmation.

Which banks and customers face the most risk

Coverage names J.P. Morgan, Wells Fargo, Zions Bank and Bank of Tennessee among the impersonated brands. BankInfoSecurity reports the campaign as a broad push against US bank customers, and the targeting is not limited to the largest names.

The reporting says the focus is business banking and treasury logins rather than personal accounts. That makes mid-sized and regional bank business customers the likeliest exposure, along with finance staff who approve wire transfers or change payment details. A compromised treasury login can authorize far larger movements of money than a typical consumer login, which is why the choice of target matters.

Business customers and their banks carry the most direct risk. Banks also take a reputational hit when their names appear on look-alike sites, even if their own systems are untouched. Takedown teams lose time, and their own verification can end up confirming that a phishing site is down when it is not. That last effect is what separates this campaign from a routine phishing wave: the defense process itself becomes part of the attack.

Kela also says the same hosting infrastructure runs phishing against banks, crypto exchanges and government services in the UK, the Netherlands, Australia and New Zealand. US readers should not assume the operator stops at American borders. The campaign has already been tested across several markets.

No victim counts or losses have been published. Until someone reports them, the amount of stolen credentials and money stays unknown.

Why the numbers differ across coverage

These figures are snapshots, and they get reshuffled as they move from research to headline. Here is what the reporting supports:

The 183 figure needs care. Kela’s blog says 183 of the domains still had live look-alikes on October 25, which differs from the “248 still live” framing in some press coverage. Kela’s summary of its findings also describes 183 of the 189 targeted institutions as having live look-alikes. Those are different measures, so check Kela’s blog before quoting either one. Some outlets describe the domains as “still being live,” which is another reason to treat every count as a point-in-time figure.

Headlines add another wrinkle. BankInfoSecurity’s headline refers to 300 US banks, but Kela’s count of impersonated US institutions is 189. The 300 figure refers to fake domains identified overall, not to banks. SecurityWeek adds that most of the domains were registered between July and September 2026, which points to a recent build-out rather than a long-running fixture.

How to check whether a bank message or site is real

These steps work whether or not you have heard of this campaign:

• Never sign in through a link in an email or text about a “suspended” or “disabled” account. Type your bank’s address yourself or open its official app.
• Treat any “account suspended” page as unverified. If you reported a suspicious site, check it from more than one network or device before assuming it is gone.
• Business owners should ask their bank whether it offers Kela’s free Bank Phishing Check or equivalent domain monitoring.
• Confirm that wire transfers and payee changes require a second approver or a call-back to a number you already have on file.
• Report suspected bank phishing to the bank and to the FBI’s Internet Crime Complaint Center (IC3).

The domain itself offers a clue. Most look-alikes follow a “[keyword]-[bank].com” format, using words such as “secure,” “disable,” “protect” and “cancel.” That structure is easy to copy for any bank, so a hyphenated security word attached to a bank name deserves suspicion. Compare any address against the one you already trust rather than judging it on appearance.

Kela says it reported the operating servers to law enforcement, intelligence agencies and the impersonated institutions. It also launched the free Bank Phishing Check tool so institutions can see whether they are being impersonated. For individuals, the most effective defense is simple: do not sign in from a message, and do not treat a suspension notice as proof of anything.

What to watch as the investigation continues

Several questions remain open. Kela says it has not found how victims are lured to the pages, and the reporting does not explain the lure. It is also unconfirmed whether one operator runs the campaign or whether it is a phishing-as-a-service platform. Kela says either is possible.

The reporting also does not establish which banks were actually compromised, as opposed to impersonated. The primary Kela report has not been independently verified beyond Kela’s own blog and secondary coverage, which makes Kela’s own updates the most important figures to watch.

Infrastructure is the next pressure point. USA 24 has covered the FBI’s seizure of the Virtualine domain, which disrupted a bulletproof hosting provider. If investigators tie this kit to similar hosting, the response could move from site-by-site takedowns to disruption at the infrastructure layer. Watch for a fresh count from Kela, and for whether takedown services begin checking suspicious sites from several vantage points before declaring them dead.