Beware Scammers Imitating Bank Websites

Thousands of lookalike websites are being set up to trick innocent customers and around 2,000 websites that appear to imitate UK banks were detected last year. These copycat websites play a crucial role in impersonation scams.

Fraudsters use details, such as account numbers, collected from unsuspecting bank customers to later con those same people into sending them money, often by posing as bank staff.

Although banks attempt to get lookalike websites taken down, the number being registered, and sometimes inadequate response from the firms that register domains, means they're up long enough to find victims.

To understand the scale of the problem of copycat bank websites, the consumer advice service Which? joined with the DNS Research Federation (DNSRF), an Oxford-based institute that does data-driven policy research on domain names and Internet governance.

These are lists of websites that have been reported as hosting illegal content. If you attempt to view blacklisted sites you’ll typically see a stern warning on your browser not to proceed as the site is phishing or contains malware (software that can damage or steal data).

Which supplied DNSRF with a list of the major UK banking brands, and it scoured a specialist phishing blocklist for sites reported in 2023 that had the names of those brands somewhere in their web address (the URL) to take one copycat example ‘helphsbc.net’.

Which specifically enquired about AIB (Allied Irish Bank), Barclays, Bank of Scotland, The Co-Operative Bank, Danske Bank, First Direct, HSBC, Halifax, Lloyds, Metro Bank, Monzo, Nationwide, NatWest, RBS, Santander, Starling, TSB, Ulster Bank and Virgin Money/Clydesdale.

The DNSRF found that more than 2,000 URLs containing our specified UK bank brands were reported to a phishing blocklist in 2023. The affected banks were Barclays, HSBC, Halifax, Lloyds, Monzo, Nationwide, NatWest, Santander and Starling.

The majority of sites in the raw data look like blatant attempts to lead bank customers astray, with  Santander and Lloyds Bank being just two examples of this kind of copycat website.

DNSRF also examined another bloacklist, run by Scamadviser.com, from 2023. In this case, it extracted data on URLs containing our specified bank brand names which had a ‘trustscore’ of less than 50 out of 100. Which researchers found more than 2,000 URLs containing the names of the specified brands. Copycats accurately simulated the same brands as in the phishing blocklist.

A Weak Link In The Fight Against Fraud

You might wonder why it is that anybody can register a domain that looks like a blatant attempt at impersonating a bank. In the early days of the internet, domains were being registered at such high volumes that it was felt to be impossible to conduct detailed checks on those buying them. Therefore the domains industry operated - and continues to operate - on a first-come-first-served basis.

However, the volume of domains being sold has dropped significantly since that time, and it’s arguable that greater checks could be put in place today. To set up a copycat website, fraudsters need to use a domain registrar. To take one down, you need to contact a web hosting company.

Many companies do both, although there is no formal regulation of this, while the UK government is currently consulting on new powers to seize domains being used for criminal purposes.

One of the barriers to change has been the enormous complexity of the industry, which involves a plethora of domain registrars, resellers and hosting companies from the very large, such as GoDaddy, to the very small and obscure, many based outside the UK.

To protect yourself when banking online, Which recommends the following: 

  • Use trusted details:    It’s always safest to avoid clicking on links or calling numbers contained in emails, texts and instant messages. Instead, try to go direct by finding the authentic phone number and website on your bank card or statement. Contact your bank to query any unusual requests.
  • Don’t ignore warnings:    Pay attention to warning screens on your browser. Antivirus software can also warn you about suspicious websites and scan downloads. 
  • Check a site’s birthday:   You can use a domain lookup service such as Who.is to see when a site has been registered. A major bank wouldn’t have a website registered last month. These services will also show you an ‘abuse’ email address for reporting the rogue site to its hosting company. Scam sites can also be reported to the National Cyber Security Centre.

If you've a victim of onine fraud in the United Kingdom, you are strongly advised to report it to Action Fraud 

Which     |     DNS Research Foundation

Image: jpkirakun

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

 


Cyber Security Intelligence: Captured Organised & Accessible

« The Changing Role Of The CISO 
Helping CISOs Embrace Artificial Intelligence »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BPC Banking Technologies

BPC Banking Technologies

BPC’s advanced fraud prevention solution helps card issuers and acquirers combat the growing threat by monitoring 100% of transactions, online, in real-time across all channels.

Team8

Team8

Team8 is Israel’s most prestigious cybersecurity think tank and venture creation foundry.

Wibu-Systems

Wibu-Systems

Wibu-Systems is a leading provider of solutions for the Digital Rights Management (DRM) and anti-piracy industry.

Institute for Cyber Security Innovation - Royal Holloway

Institute for Cyber Security Innovation - Royal Holloway

The Institute for Cyber Security Innovation aims to bring together Academia, Industry and Government to be a catalyst for applied research and innovation in cyber security policy and solutions.

Steganos

Steganos

Steganos offers highly secure and easy to use software tools that protect and secure on and offline data.

Go Grow

Go Grow

Go Grow is a business oriented accelerator program at Copenhagen School of Entrepreneurship. Targeted technologies include IoT, AI and Cybersecurity.

DarkOwl

DarkOwl

DarkOwl provides the world’s largest index of darknet content and the tools to efficiently find leaked or otherwise compromised sensitive data.

Ultra Electronics

Ultra Electronics

Ultra specialises in providing application-engineered bespoke solutions. We focus on mission critical and intelligent systems in the defence, security, critical detection & control markets.

Cyber Security Authority (CSA) - Ghana

Cyber Security Authority (CSA) - Ghana

The Cyber Security Authority has been established to regulate cybersecurity activities in Ghana.

Ward Solutions

Ward Solutions

Ward Solutions are an information security consultancy and managed services company. We help organisations protect their brand, people, assets, intellectual property and profits.

Cyberwatch Finland

Cyberwatch Finland

Cyberwatch Finland's services improve decision-makers’ strategic situational picture and enable successful holistic cyber risk management.

RealTyme

RealTyme

RealTyme is a secure communication and collaboration platform with privacy and human experience at its core.

Pillr

Pillr

Pillr is a cybersecurity operations platform capable of adapting to the demands of your business and team — and the global threat landscape.

RAND Corporation

RAND Corporation

The RAND Corporation is a non-profit institution that helps improve policy and decision making through research and analysis.

Curatrix Technologies

Curatrix Technologies

Curatrix Technologies is a Managed IT Service provider based in Hampshire, UK, providing high quality and reliable Managed IT Services since 2015.

Mobilen Communications

Mobilen Communications

Mobilen are dedicated to providing our customers with the highest level of secure data in transit and to bring privacy back to a mobile world.