These emails do not look like the phishing of five years ago. The campaign references real recent transactions, uses your bank's actual branding and language, and arrives in inboxes that already passed basic filtering. The link opens a careful clone of the bank's login page — padlock and all — that captures the username, the password, and the one-time code as they are entered.
From the moment credentials are submitted, the attacker has what is needed to log in as the victim. With a real-time proxy in front of the fake page, the stolen session can be used before the victim has finished noticing that the next click did not work.
How the scam works
It follows the pattern that has become standard for banking fraud:
- The hook. An email or text appears to come from your bank: "unusual activity detected," "security update required," "new payee awaiting approval."
- The clone. The link opens a fake banking site that looks and behaves like the real one.
- The harvest. The victim enters username, password, and the one-time code — which the fake site relays to the attacker as it is typed.
- The withdrawal. The attacker logs in immediately, often adding a payee or initiating a transfer within minutes.
Red flags to train staff on
Even polished campaigns leave traces. Make sure everyone — and especially anyone with payment responsibilities — knows these:
- Check the sender's full address, not the display name. A display name reading "Chase" over a lookalike domain is still a scam.
- Generic greetings ("Dear Customer") where your bank would use your name.
- Hover before you click. The destination rarely matches the text on the link. When in doubt, do not click.
- Artificial urgency. "Act within 24 hours or your account will be closed" is pressure, not policy.
- Unexpected attachments or login prompts arriving by email at all. Banks do not operate that way.
If someone already clicked: change the banking password immediately from a known-good device, call the bank's fraud line, and preserve the email for review. Speed matters, because the transfer often happens within minutes. Then call us — we will sweep the mailbox for other recipients of the same campaign and check whether anything else was touched.
The four controls that stop this cold
Awareness is necessary and never sufficient. These are the controls we deploy and monitor in every managed environment:
- Email authentication and filtering. Enforce SPF, DKIM, and DMARC on your own domain, and run filtering that catches lookalike domains before a user ever sees them.
- Phishing-resistant multi-factor authentication. For banking and financial systems, prefer an authenticator app or a hardware key over SMS codes, and pair it with number-matching approvals.
- Phishing simulations. Quarterly campaigns tuned to the threats actually in circulation, so recognition is rehearsed rather than theoretical.
- Endpoint detection on every device. If someone does fall for it, endpoint detection catches the follow-on activity — new browser extensions, credential access, unusual outbound traffic — that a harvested session sets up.
No single control is a wall. Together they are the difference between one clicked email and a drained operating account.
This campaign targets organizations of every size. If you would like us to review your exposure — mail authentication, MFA coverage, and the resilience of your financial workflows — start the conversation, or see how we approach evidence and controls.