Scam sites that copy US banks show a fake 'suspended' page on a second visit, so checkers think they are dead. Victims still see the real trap on the first.
Security firm KELA says it found a network of fake bank websites that pretends to be shut down. If the same person visits twice, the second visit shows an 'account suspended' notice. The first visit, the one a victim sees, shows a copy of the bank's real site built to steal information.
KELA calls the operation the 'Suspended' infrastructure. As of Oct. 25, 2026, it had linked 248 live scam domains to 189 major US banks and financial firms. The sites copy the look of the real organizations, with a particular focus on business banking. Since May, more than 300 scam domains have run on the same setup, and new ones keep appearing every day.
A normal takedown is a good sign. When a site is seized, visitors see a notice and move on, and so do security teams. These scammers show that notice themselves, but only at the right moment.
Hidden software records each visitor's IP address, which is the number that identifies an internet connection. On a repeat visit, it shows a fake suspension page. It is dressed up as a challenge page like the ones Cloudflare, a major web security company, legitimately uses. KELA also saw other decoys, including 'Sorry, you've been blocked' notices, blank pages and redirects to Google.
KELA explains why this matters. A victim usually follows a link once. A scanner or takedown team checks a reported site and then checks again to confirm, and that second check looks like a finished takedown.
The main targets are customers of US banks and financial services, especially people who use business banking. Many fake addresses follow a pattern: a word like secure, disable, protect or cancel joined to a bank's name, ending in .com. The same setup has also been tied to scams aimed at crypto exchange and government service users in the UK, the Netherlands, Australia and New Zealand.
The scam depends on someone following a link. People who always reach their bank by typing its address or using its app are not exposed through this route.
The steps are in the alert box above. The key idea is to start from your bank, not from a message. One more point: a 'suspended' page is not proof that a link is harmless. It may only mean you were the second visitor.
KELA cannot say whether one operator runs everything or whether this is a phishing-as-a-service platform, where criminals rent ready-made scam tools. The servers sit with two shared hosting providers. Some domains went offline after KELA shared its findings with law enforcement, but the campaign is still active.
One possible lead is a remote desktop connection to the scam servers from a standard UK home broadband line. KELA says this has not been verified, so it does not yet identify anyone.
Never reach your bank through a link in a message; type its address or use its app, and do not read a 'suspended' page as a sign a link is safe.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
