Your Bank Authenticates You. But Who Authenticates Your Bank?
Imagine receiving a message that appears to come from your bank.
Perhaps it warns that your account has been compromised. Maybe it asks you to verify suspicious activity, protect your funds, or prevent an unauthorized transaction.
The message includes a link. You click it.
The website looks familiar. The bank's name is there. The branding appears legitimate. Even the web address contains reassuring words such as secure, protect, or cancel.
You enter your credentials, believing you're protecting your account.
Except you're not communicating with your bank.
You're communicating with someone pretending to be your bank.
And that distinction is at the heart of the bank-impersonation campaign documented by KELA. The opening message is an imagined example; KELA has not established how victims were directed to these sites.
But the larger story isn't simply about phishing.
It's about the dangerous assumption that something appearing trustworthy must actually be trustworthy.
Hundreds of Fake Domains. One Campaign. A Familiar Weakness.
KELA’s primary research describes impersonation of U.S. financial institutions, with many lookalikes aimed at regional and commercial banking customers.
As of October 25, 2026, the snapshot recorded 248 live domains and 189 impersonated U.S. financial institutions; 183 institutions still had live lookalikes. More than 300 refers to domains identified since May, including domains already offline.
The attackers constructed convincing website addresses using combinations of banking names and security-related terminology.
Words such as secure, disable, protect, and cancel weren't chosen accidentally.
They were designed to create an impression of legitimacy, urgency, and authority.
The objective was straightforward: convince customers to surrender their banking credentials, potentially enabling fraudulent financial transactions, including wire transfers and Automated Clearing House (ACH) payments.
The actual number of victims remains unknown.
These figures describe brand impersonation, not breaches of bank systems. The number of victims remains unknown.
That distinction matters.
Because the attackers didn't necessarily need to penetrate a bank's infrastructure to exploit the trust its customers had already established.
They could simply pretend to be the bank.
The Attackers Were Manipulating More Than Customers
One of the most revealing aspects of this campaign was a technique designed to frustrate investigators.
According to Kela, when someone visited certain phishing pages a second time from the same IP address, the website could display an entirely different result.
Instead of the fraudulent banking page, the visitor might encounter a fake account suspension notice, a blocked page, or even a redirect to Google.
Why?
Because investigators, automated scanners, and takedown teams frequently revisit suspicious websites to confirm malicious activity.
By changing what repeat visitors saw, the attackers could make an active phishing operation appear inactive.
Think about what that means.
A customer might encounter a convincing imitation of a legitimate banking website.
An investigator examining the same domain later might see something entirely different.
Both individuals would be making judgments based on what appeared in front of them.
And the attacker was attempting to control those appearances.
This wasn't merely an effort to steal credentials. It was an effort to manipulate the evidence upon which people make trust decisions.
That's what makes this campaign particularly instructive.
When Appearance Becomes a Substitute for Identity
For years, financial institutions have invested heavily in verifying the identities of their customers.
Passwords. Security questions. One-time passcodes. Multi-factor authentication. Device recognition. Behavioral analytics.
All intended, in different ways, to answer an essential question:
Is this really the person authorized to access the account?
It's a legitimate and necessary question.
But there's another question that deserves just as much attention.
Is the customer actually interacting with the financial institution they believe they're interacting with?
Those are two distinct trust decisions.
And confusing them creates opportunities for attackers.
A convincing website is not proof of identity.
A familiar logo is not proof of identity.
A reassuring domain name is not proof of identity.
Even a message that appears to originate from a trusted organization cannot, by appearance alone, establish that the organization is genuinely behind it.
Yet these are precisely the signals that attackers exploit.
They understand that people make trust decisions quickly, often based on familiarity, context, and perceived authority.
And they design their attacks accordingly.
Authentication Shouldn't Be a One-Sided Conversation
Consider a typical digital banking interaction.
The customer is expected to demonstrate that they are authorized to access an account.
But what assurance does the customer have that the party requesting those credentials is genuinely the bank?
In a properly secured authentication system, the answer should involve more than visual recognition or a reassuring message.
It should involve mechanisms that establish the legitimacy of the service itself.
This is one reason phishing-resistant authentication technologies are so important.
For example, properly implemented FIDO2/WebAuthn scopes a credential to a relying party ID, while the browser and relying party validate the applicable origin. A lookalike domain cannot simply request the bank’s credential.
That's a meaningful security advancement.
But phishing resistance is not the end of the trust conversation.
Organizations must also consider how service identity is established, how authentication is initiated, how sessions are protected, how account recovery is handled, and how sensitive transactions are authorized.
A secure digital relationship involves more than verifying one participant at one moment.
It requires confidence in the identities and legitimacy of the parties participating in the interaction.
This is the broader principle behind mutual authentication.
And it's a principle I've long believed deserves greater attention in our industry.
What Happens When We Treat Credentials as Proof of Trust?
There's another assumption worth challenging.
If someone possesses valid credentials, does that necessarily mean the interaction is legitimate?
Of course not.
Credentials can be stolen. Sessions can be compromised. Individuals can be deceived into approving malicious actions.
And even strong authentication doesn't automatically establish that a particular financial transaction is authorized or free from manipulation.
Authentication establishes identity-related assurance.
Authorization determines what an authenticated identity is permitted to do.
Transaction verification and fraud controls help determine whether a particular action should proceed.
These functions are related, but they are not interchangeable.
When we blur those distinctions, we risk asking authentication to solve problems that require a broader security architecture.
The campaign uncovered by Kela is a reminder that attackers don't necessarily attack the strongest technical control directly.
They often search for the assumptions surrounding it.
If customers can be persuaded that a fraudulent website is legitimate, attackers may obtain information, induce actions, or initiate additional social engineering attempts without ever defeating the institution's underlying infrastructure.
That's why trust must be evaluated throughout the digital interaction, not merely assumed because the initial screen looks familiar.
The Financial Services Industry Has a Particular Responsibility
Few industries depend more heavily on trust than banking.
Customers entrust financial institutions with their savings, businesses depend on them to move capital, and organizations rely on them to protect sensitive financial information.
A compromised business-banking relationship can have consequences far beyond an individual account.
Unauthorized wire transfers, fraudulent ACH payments, operational disruption, and financial losses can affect employees, customers, vendors, and entire businesses.
The stakes are significant.
And the attackers understand that.
They don't need every recipient to fall for a phishing message.
They need enough people to mistake a fraudulent interaction for a legitimate one.
This is why financial institutions should continually evaluate not only how they authenticate customers, but also how they help customers establish confidence in the services they're accessing.
That includes phishing-resistant authentication, effective domain and brand monitoring, secure account recovery, transaction-level protections, customer education, and appropriate mechanisms for verifying service legitimacy.
No single technology eliminates every threat.
But a security strategy that treats trust as something to be established rather than assumed is better positioned to address the underlying problem.
The Question We Should Have Been Asking All Along
The KELA findings reveal an active operation impersonating financial institutions through a network of fake domains and techniques intended to conceal malicious activity.
But beneath those technical details lies a remarkably simple question.
Why do we devote so much attention to proving that customers are who they claim to be, while allowing customers to rely on appearances when deciding whether they're dealing with the organization they trust?
That imbalance deserves scrutiny.
Not because banks have ignored security. They haven't.
Not because modern phishing-resistant authentication is ineffective. Properly deployed, it can provide substantial protection against credential phishing.
And certainly not because mutual authentication alone would eliminate every form of financial fraud.
It wouldn't.
The issue is that digital trust has multiple dimensions, and attackers exploit whichever dimension is weakest.
Sometimes that's a stolen password.
Sometimes it's a compromised session.
Sometimes it's a fraudulent transaction.
And sometimes it's a website that looks enough like your bank to convince you to hand over the keys.
The common denominator is an assumption of legitimacy that the attacker doesn't deserve.
Trust Must Work in Both Directions
At Identité®, we've built our approach to authentication around a conviction that has guided our thinking for years:
Trust shouldn't be a one-sided proposition.
Our patented Full Duplex Authentication® technology reflects that philosophy by emphasizing mutual authentication and the importance of establishing confidence between the parties involved in a digital interaction.
But the principle extends beyond any particular product or technology.
It challenges how we think about identity, access, and digital relationships.
It asks us to recognize that a familiar appearance isn't necessarily an authentic identity.
That valid credentials don't automatically establish legitimate intent.
And that authentication, authorization, and transaction integrity must work together rather than be treated as interchangeable safeguards.
The attackers behind this banking campaign understood something fundamental about human behavior.
People are inclined to trust what looks familiar.
They built an operation around exploiting that tendency.
Our responsibility as an industry is to build systems that don't require customers to make critical security decisions based on appearances alone.
Because the most important question in digital banking isn't simply:
Can you prove who you are?
It's also:
Can the party asking you to prove your identity establish who they are?
Until we consistently address both sides of that relationship, attackers will continue finding opportunities in the space between perceived trust and verified identity.
Trust Starts Here™.
And trust must work in both directions.
Sources and Further Reading
DataBreachToday: Phishing Campaign Actively Targets Customers of 300 US Banks
https://www.databreachtoday.com/phishing-campaign-actively-targets-customers-300-us-banks-a-33282
Kela: Bank Phishing Campaign: Fake Takedown
https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/
Kela: Bank Phishing Check
https://www.kelacyber.com/resources/free-tools/bank-phishing-check/