A UK monitoring service says it found 511 lookalike sites copying brands like Sky, Amazon and HSBC in one day. Fake alerts are the common thread.
A UK monitoring service says it spotted 511 websites in a single day that look like they belong to well-known brands such as Sky, Amazon and HSBC. The sites are suspected fakes meant to steal logins, card numbers and one-time codes. The total has not been independently verified, but the tricks behind it are worth knowing.
CyberAware UK says its DarkWatch system flagged 511 potentially malicious web addresses within 24 hours. They imitated Sky, BT, Amazon, HSBC, Barclays, Nationwide, Lloyds and PayPal. The service has not published enough detail to show how many were actively used for phishing. Phishing means tricking you into handing over details by posing as a company you trust.
A fake page is no longer just a copy of a shop front. CyberAware UK says criminals build cloned login, delivery-tracking or billing pages and add fake alerts to create urgency. The aim is to collect card numbers, passwords and authentication codes, which could let them into an account within minutes.
Separate research from Check Point Research found Microsoft made up 33% of tracked brand copycat attempts in the third quarter of 2026, up from 23% in the quarter before. It also found fake prompts using DocuSign, Apple, Google Antigravity and Claude payment-failure notices. One fake install page showed a command that looked normal but secretly ran a script from an outside server, which could give an attacker remote control.
Surrey and Sussex Police described a woman who got a fake banking text and followed its link. She was later contacted on WhatsApp by someone posing as Barclays' fraud team. The fraudster got her security information and access to her devices, then stole £5,000. Police say scammers try to create panic so victims act before thinking.
These are separate findings, not one confirmed campaign. Ofcom's £437,500 fine on telecoms provider Tismi, issued on 21 October, concerns controls on phone numbers used in scams. It is not tied to the 511 domains. The police case is one account, not proof of how common the tactic is. The command trick matters mainly if you install software from web pages.
The steps in the alert box above cover the basics. The idea behind all of them is the same: never let a message choose where you go. Open the official app or type the address yourself.
Still unknown is how many of the 511 sites were live and who runs them. What is clear is the pattern. Open a message, follow a prompt, run a command or install an update. Each step feels routine, and the pressure to hurry is the warning sign.
If a text, email or call pushes you to act fast, stop and go to the real app or website yourself.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
