Fake Bank Websites
Fraudsters are building polished, convincing fake bank websites that can trick unsuspecting consumers into entering sensitive information that can be used to access bank accounts and/or initiate transactions. For customers who are simply trying to log in to online banking, apply for a loan or find contact information, a result that appears at or near the top of a search page can seem trustworthy, but it may not necessarily be the legitimate bank website they are seeking.
Cybersecurity researchers have identified large-scale campaigns involving thousands of fake banking websites targeting users in the United States and the United Kingdom. These sites impersonate legitimate financial institutions, offer fake financial services and use search engine optimization to increase their visibility in search results.
Why This Matters
Many people assume the first search result is the safest or most relevant option. Criminals take advantage of that misconception by purchasing search ads, manipulating search visibility or creating look-alike domains that resemble a real bank’s website. Once someone lands on a fake site, the page may ask for online banking credentials, personal information, one-time passcodes, debit card details or payment information. In some cases, the scam may continue through a follow-up call or text from someone pretending to be the bank.
This type of scam can be especially deceptive because the victim may not believe they clicked a suspicious link. From their perspective, they searched for a bank, clicked a result that looked official and landed on a website that appeared legitimate. That is why it is important to slow down, check the web address carefully and use trusted ways to access your bank’s website.
How to Protect Yourself
- Avoid using a search engine to access online banking. Type the bank’s verified website address directly into your browser or use the official mobile app.
- Bookmark the legitimate website. Once you confirm you are on the correct site, save it and use that bookmark going forward.
- Review the full web address before entering information. Look for misspellings, extra words, unusual domain endings or anything that does not match the bank’s official website.
- Be cautious with sponsored or promoted results. A result appearing at the top of the page does not guarantee that it is legitimate.
- Never share authentication codes, passwords or full online banking credentials with anyone. Criminals may use a fake website and then call or text you to pressure you into giving them access. Real MidFirst Bank employees will never ask for your online banking password.
- Stop and contact the bank using a known number. If anything feels unusual, stop what you are doing and contact the bank through a verified phone number, not one displayed on a suspicious website, email or text message.
Red Flags You May Notice
- The website address is slightly different from the bank’s known address.
- The page asks for more information than usual, such as a full Social Security number or debit card PIN.
- You receive a suspicious call or text shortly after entering information online.
- The site creates urgency, says the account is locked or claims immediate action is required.
- You’re asked to pay a fee before receiving account access or other financial services.
- You’re directed to send money through cryptocurrency, gift cards, wire transfer or another difficult-to-recover method.
What to Do If You Think You Used a Fake Bank Website
If you believe you entered information on a fake bank website, act quickly. Contact your bank using a verified phone number typically included in your account documentation or on your debit/credit card. MidFirst Bank customers can call 888.MIDFIRST (888.643.3477). Explain what happened and follow their instructions. You may need to change your online banking password, review recent transactions, monitor your accounts and watch for additional calls, texts or emails from scammers who may try to continue the fraud.
You should also report suspected fraudulent websites to the FBI’s Internet Crime Complaint Center at ic3.gov. Reporting helps law enforcement identify trends, investigate fraud networks and warn others about similar scams.