Phishing Scam Uses Fake Shutdowns to Evade Detection
KELA reveals a new deceptive phishing scheme leveraging false website suspensions to mislead users and security teams.
Cybersecurity experts at KELA have uncovered a sophisticated phishing scheme that allows fraudulent banking websites to evade detection by simulating their own suspension. This unique tactic not only misleads potential victims but also disguises these sites from cybersecurity monitors.
How the Scheme Operates
As of late October 2026, there are 248 active domains linked to 189 major U.S. banks and financial institutions, all operating under the same fraudulent infrastructure. The scammers cleverly exploit domain names that incorporate misleading keywords such as “secure,” “protect,” and “cancel,” enticing users into sharing sensitive information.
Creating the Illusion of Closure
What sets this phishing operation apart is its ability to create false takedown notifications. Normally, when a domain is flagged for malicious activity, users will see a suspension notice indicating that the site has been taken down by law enforcement or hosting providers. The new scam artists have devised a method to display similar notices themselves, effectively tricking users and security teams into believing the site has been dealt with.
During their second visit to the site, users are greeted with a fabricated