Your bank's urgent security alert may not be from your bank
A network of 248 fake banking websites is impersonating 189 US financial institutions — most of them regional and community banks — using a technique specifically designed to fool the tools meant to find and shut them down.
The email arrives looking like it comes from your bank. The subject line says something like "Important — your account has been temporarily disabled" or "Security alert: action required to restore access." There is a button that says "Verify your account." The bank's logo is there. The colors look right.
The web address in that link is where the deception lives — and it is easy to miss when you are scanning through a message quickly. Security researchers at KELA documented 248 of these fake bank sites still running as of late October 2026, impersonating 189 US financial institutions. During just one week in October, 49 new sites were launched while only 15 were removed. The campaign is active and growing.
The naming trick — and how to spot it
Your real bank's website has a simple address: bankname.com. The fake sites follow a different formula. They place an urgency word in front of the bank's name:
- secure-bankname.com
- disable-bankname.com
- cancel-bankname.com
- protect-bankname.com
When you read the address quickly, it registers as your bank. The urgency word blends in with everything else a "security alert" email is supposed to feel like. That is the trick.
Most of the banks being targeted are regional and community institutions — not the largest national names. Attackers have learned that large banks have dedicated teams watching for fake sites around the clock. Smaller regional banks, while trustworthy, often have fewer resources for this kind of monitoring. And many people have decades-long relationships with their local bank, which makes an email claiming to be from that institution feel especially believable.
Why these sites slip past security tools
These fake sites use a technique that makes them particularly hard for security systems to detect and remove. When a security scanner, a fraud team, or a takedown service visits one of these sites — perhaps responding to a report from a customer — the site shows a convincing "account suspended" page. It looks exactly like the site has already been shut down. The investigator marks it as resolved.
But the site is still running. It only shows the harmless-looking page to anyone who has already visited it. A first-time visitor — someone who clicked a link in one of these emails — still sees the real credential-theft form.
This means URL-safety checks and email scanning tools can clear one of these domains even while it is actively collecting login information from new victims. By the time anyone at a bank or a security firm tries to verify the report, the page looks harmless. That is why these emails can arrive without a warning from your email provider. The usual safety nets do not catch all of them.
Who is most at risk
Adults 60 and older reported approximately $3 billion in fraud losses to the FTC in 2025 — up from $600 million just five years earlier. Financial impersonation scams, which include fake bank alerts, are among the leading categories. Older adults disproportionately bank with regional and community institutions, often with relationships that span decades. An email that uses familiar branding and cites an urgent account problem is exactly the kind of pressure that can override careful thinking. Clicking through seems like the responsible action to take.
If you have older parents or grandparents who bank locally, this is a conversation worth having with them before the email arrives — not after.
What to do
- Never click a link in a bank email to log in. Always open your browser and type your bank's address yourself. This is the single most effective step, and it costs nothing.
- Check the sender's actual email address. On most phones and computers, you can tap or click the sender's name to see the real email address behind it. A genuine bank email comes from bankname.com, not secure-bankname.com or any variation with an urgency word added.
- Look at the link before clicking it. On a computer, hover your cursor over any link to see the real destination address at the bottom of the screen. On a phone, press and hold the link for a moment — the real address appears in a preview. Look for the urgency-word pattern described above.
- Know what real bank addresses look like. Legitimate banks do not place words like "secure-," "cancel-," "disable-," or "protect-" before their own name in a web address. If you see that construction, do not click through.
- Call the number on your card if you think something is wrong. The right number is printed on the back of your debit or credit card, or on your paper statement — not in the email. A bank representative can confirm in seconds whether there is any real problem with your account.
- Enroll in genuine alerts from your bank. Setting up real account notifications directly in your bank's mobile app teaches you what an authentic alert from that institution actually looks and feels like. That makes a fake one easier to notice.
- If you clicked and entered your password, act now. Call your bank's fraud line immediately — the number on your card — and ask them to put a hold on online access to your account. Then change your password from a trusted device. Time matters here.
Related reading
- Protecting an older parent from email and phone scams — the full conversation to have with the people you love, and the account settings worth reviewing together.
- How to report a suspicious email — if you received one of these fake bank alerts, here is how to forward and document it properly so your bank and security researchers can act on it.
- If you already clicked and entered your credentials — step-by-step first-hour actions if you think you may have submitted your login information to one of these sites.
We flag the emails that lead to these sites.
These fake bank alert emails pass many standard spam filters because the sites behind them are engineered to look harmless to scanners. Family Sentinel reads every incoming message for the patterns these lures use — urgent financial language, lookalike domain constructions, pressure to act immediately — and alerts your family in minutes, before any login happens. Read-only by design, with a real Security Architect behind it.
Start your free month →Want the next threat before it reaches you?
Scam Watch goes out regularly — the newest scams and how to spot them, in plain English. Free.