CTM360 Analysis Shows How Fake Banks Exploit Search and Trust

CTM360 researchers have identified a large-scale fraud campaign involving thousands of fake banking websites that actively target users in the United States and the United Kingdom.

Over the past year, more than 11,000 fraudulent bank domains were observed, with 8,000+ in the U.S. and 3,000+ in the UK, all operating without regulatory authorization or physical presence.

These are not throwaway phishing pages. They are polished, SEO-optimized platforms that impersonate legitimate financial institutions, regulators, and lending services.

Not Your Typical Phishing Fraud

What sets this campaign apart is operational maturity. The fake banks offer services such as loans, mortgages, grants, and high-limit credit cards, often promising instant approval or no credit checks. Victims are funneled through simplified onboarding flows, fake KYC processes, and staged "approvals" designed to build trust before monetization.

Once engaged, users are pressured to pay activation or processing fees, typically via cryptocurrency wallets or PayPal's Friends and Family option—both methods that significantly reduce traceability and recovery chances.

SEO as an Attack Vector

Rather than relying on spam or malware delivery, threat actors are gaming search engine algorithms. CTM360 observed extensive keyword stuffing, region-specific financial terms, and abuse of trusted-looking domains such as .com, .net, and .live. The result: fake banks ranking alongside, or even above, legitimate financial institutions in search results.

This approach flips traditional fraud economics. Instead of chasing victims, attackers let victims find them.

Industrial-Scale Fraud Operations

Behind the scenes, the infrastructure is built for scale:

• Mass domain registrations with high churn
• Reused HTML, metadata, and branding across thousands of sites
• Shared and free hosting environments to blend malicious traffic with legitimate services
• Over 30 observed fraud templates, enabling rapid redeployment when domains are taken down

CTM360 maps this activity using its Fraud Navigator framework, inspired by MITRE, showing a full lifecycle, from resource development and SEO distribution to PII harvesting and crypto-based monetization.

Why This Matters

Fake banks are emerging globally, with more cases expected in other regions.

Fake banks are no longer an edge-case fraud. They represent a systemic abuse of digital trust, exploiting regulatory branding, search engines, and user expectations around online finance. As financial services continue to digitize, the attack surface expands not just for banks but also for consumers, regulators, and platforms that enable discovery.

The main point is clear: if visibility, credibility, and conversion can be weaponized, fraud will grow. Defense now needs ongoing monitoring of the external attack surface—domains, search results, and brand abuse, beyond inboxes and endpoints.

Read the full report here: https://www.ctm360.com/reports/rise-of-fake-banks-usa-uk