Antiphishing.biz

---

Threat Analysis: Banco Regional Phishing – Multi-Step Credential & 2FA Code Harvesting

This phishing campaign impersonates Banco Regional, a financial institution operating in Paraguay and other South American countries. The scam uses a multi-page flow to capture the victim’s document number, access password, email credentials, and the transactional PIN (two-factor authentication code) sent via SMS or email.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page. The scam unfolds in three steps:

Step 1 – Fake Document Number & Password Page
The first page asks for the victim’s document number (likely national ID) and access password. The page includes security warnings copied from the legitimate bank to appear authentic.

Step 2 – Fake Email & Email Password Page
The second page asks for the victim’s email address and email password. This step is designed to capture credentials for the victim’s personal email account, which can then be used to intercept further communications or reset passwords for other services.

Step 3 – Fake Transactional PIN Page
The third page asks for the transactional PIN—a one-time code sent via SMS or email, typically used to authorize transactions. This is the two-factor authentication (2FA) step. By capturing this code, the attacker can bypass security measures and complete fraudulent transactions in real time.

The goal:
The attacker aims to:

• Steal the victim’s Banco Regional online banking credentials (document number and password)
• Capture the victim’s email account credentials (to access password resets and intercept communications)
• Obtain the transactional PIN (2FA code) to authorize unauthorized transfers or payments

With all three pieces of information, the attacker can log into the victim’s bank account and complete fraudulent transactions, often within minutes.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not the official Banco Regional domain. Legitimate Banco Regional online banking is accessed through the bank’s official website—never through links in unsolicited messages.
• Request for email credentials: Legitimate banking login processes never ask for your email account password. This is a clear indicator of a phishing attack designed to take over your email as well.
• Multi-step design: The flow asks for credentials in stages, which is common in sophisticated phishing kits. Each step builds legitimacy while capturing different pieces of information.
• Ironically, the security warning itself: The page contains a warning that the bank never requests personal information via email or phone—yet the page itself is doing exactly that. This is a contradiction that users should notice.
• Unsolicited login request: Banco Regional does not send emails or messages with links requiring customers to log in to resolve account issues.
• Generic design: While the pages mimic the bank’s branding, they lack the full navigation, account-specific information, and personalization that would appear on a legitimate logged-in session.

What to do if you encounter this:

• Do not enter any document numbers, passwords, email credentials, or transactional PINs on these pages.
• If you are a Banco Regional customer, always access online banking by typing the official bank URL directly into your browser or by using the official mobile app.
• If you have already entered your banking credentials, contact Banco Regional immediately through their official customer service hotline to block your account and change your password.
• If you entered your email credentials, change your email password immediately and check for any unauthorized forwarding rules or account changes.
• Report the phishing page to Banco Regional’s fraud department.

Why this scam is particularly dangerous:
This is a full account takeover phishing kit. By capturing the document number, password, and the transactional PIN (2FA), the attacker obtains everything needed to log in and complete transactions. The request for email credentials is an added layer—if the victim’s email is compromised, the attacker can intercept bank communications, delete alerts, and further entrench their access. The multi-step design also makes the scam feel more “official” to victims who are used to multi-page login flows.

Protective measures:

• Bookmark the official Banco Regional login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bank domains, not on phishing sites.
• Enable two-factor authentication (2FA) on both your bank account and email account, using an authenticator app rather than SMS where possible.
• Never enter your email password on any page that claims to be your bank. Bank login processes do not require this.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco Regional domains are associated with the official bank website. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact the bank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Banco República (BROU) Phishing – Credential & Digital Key Harvesting

This phishing campaign impersonates Banco República (BROU) , the largest and state-owned bank in Uruguay. The scam uses a multi-step process to capture the victim’s document number, password, and the “Llave Digital” (Digital Key)—a one-time code used for transaction authorization—allowing attackers to bypass two-factor authentication and take over the account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Document Number & Password Page
The first page mimics BROU’s login interface. It asks for:

• Country (pre-selected as Uruguay)
• Document type (pre-selected as C.I. – national ID)
• Document number
• Password

This page captures the victim’s primary banking credentials.

Step 2 – Fake “Llave Digital” (Digital Key) Page
The third page (the second image failed to load) asks for the victim’s Llave Digital—a 6-digit two-factor authentication code (either generated by an app, sent via SMS, or from a physical token). This code is typically required to authorize transactions or complete login. By capturing it, the attacker can bypass security measures.

The goal:
The attacker aims to:

• Steal the victim’s BROU online banking credentials (document number and password)
• Capture the Llave Digital (2FA code) to authorize transactions
• Gain full access to the victim’s bank account, enabling fund transfers and other fraudulent activities

With both the login credentials and the one-time code, the attacker can log in and complete transactions in real time—often before the victim realizes their account has been compromised.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not brou.com.uy or any official BROU domain. Legitimate BROU online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: BROU does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Multi-step design: The flow asks for credentials in stages, which is common in sophisticated phishing kits designed to capture both primary credentials and 2FA codes.
• Generic design elements: While the pages mimic BROU’s branding, they lack the full navigation, personalized security images, and account-specific information that would appear on a legitimate logged-in session.
• Request for Llave Digital: The third page asks for the 2FA code without context. Legitimate banking processes only ask for this code after the user has already initiated a login or transaction within a trusted environment.

What to do if you encounter this:

• Do not enter your document number, password, or Llave Digital (2FA code) on these pages.
• If you are a BROU customer, always access online banking by typing brou.com.uy directly into your browser or by using the official BROU mobile app.
• If you have already entered your credentials, contact BROU immediately through their official customer service hotline to block your account and change your password.
• If you entered a Llave Digital code that you received via SMS or generated from an app, that code may have already been used by the attacker to authorize a transaction. Check your account for unauthorized activity immediately.
• Report the phishing page to BROU’s fraud department.

Why this scam is particularly dangerous:
This is a real-time account takeover phishing kit. By capturing both the login credentials and the one-time Llave Digital (2FA code), the attacker can bypass the bank’s primary security control. The multi-step design also makes the scam feel more “official” to victims who are accustomed to multi-page login flows on the real BROU site.

Protective measures:

• Bookmark the official BROU login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate brou.com.uy domains, not on phishing sites.
• Never share your Llave Digital with anyone or enter it on a page you reached via a link. BROU will never ask for this code via email or unsolicited messages.
• Enable additional security alerts on your bank account to receive notifications of transactions.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate BROU domains end with brou.com.uy. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact BROU directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Scotiabank Phishing – Fake Login Page Stealing DNI and Password

This phishing campaign impersonates Scotiabank, a major international bank with operations across Latin America (including Mexico, Peru, Chile, Colombia, and other countries). The page is designed to steal customers’ online banking credentials—specifically the DNI (national identification number) and password.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Scotiabank login page. When the victim enters their DNI and password and clicks “Siguiente” (Next), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Scotiabank online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain (scotiabankverificaenlinea23.abmx.com) that is not the official Scotiabank domain. Legitimate Scotiabank online banking is accessed through domains like scotiabank.com, scotiabank.com.mx, scotiabank.com.pe, etc. The use of a non-standard domain with extra words (“verificaenlinea23”) is a clear red flag.
• Unsolicited login request: Scotiabank does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the official URL directly or using the official mobile app.
• Minimal design: The page lacks the full Scotiabank branding, navigation menus, security notices, and personalized elements that appear on the legitimate login page.
• No security image or personalization: Legitimate Scotiabank login pages often display a security image or phrase after entering the DNI. This page does not have that feature.
• Generic “Bienvenido” header: The page uses a generic welcome message rather than personalized content.

What to do if you encounter this:

• Do not enter your DNI, password, or any other personal information on this page.
• If you are a Scotiabank customer, always access online banking by typing the official Scotiabank URL for your country directly into your browser (e.g., scotiabank.com for the US, scotiabank.com.mx for Mexico, etc.) or by using the official Scotiabank mobile app.
• If you have already entered your credentials, contact Scotiabank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Scotiabank’s fraud department (e.g., by forwarding the original message to the bank’s official phishing reporting address).

Why this scam is effective:
Scotiabank has millions of customers across Latin America, making it a frequent target for phishing. The page uses the Scotiabank logo and a simple, clean design that resembles the bank’s login interface. The use of “DNI” (national ID) as the username is consistent with how many Latin American banks authenticate users. The “Siguiente” (Next) button mimics the flow of the legitimate login process, where users often enter credentials on one page and then a second factor on the next.

Protective measures:

• Bookmark the official Scotiabank login page for your country and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate Scotiabank domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Scotiabank account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Scotiabank domains end with scotiabank.com or country-specific variations (e.g., .com.mx, .com.pe). Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Scotiabank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Société Générale Phishing – Fake “Pass Sécurité” & Credential Harvesting

This phishing campaign impersonates Société Générale, one of the largest banks in France. The scam uses a two-step approach: first presenting a page about the bank’s legitimate “Pass Sécurité” security feature to build trust, then directing the victim to a fake login page that steals their code client (client code) and subsequent password.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, the need to activate Pass Sécurité, or another account-related issue. The message includes a link to the first phishing page.

Step 1 – Fake Pass Sécurité Information Page
The first page mimics Société Générale’s official information about Pass Sécurité—a legitimate security feature used by the bank for transaction confirmation. The page includes:

• Descriptions of the Pass Sécurité service
• Legal disclaimers and footnotes copied from the real bank website
• No login form; instead, it sets the stage for the victim to believe they need to log in to activate or use the service

Step 2 – Fake Login Page
The second page mimics Société Générale’s “Espace client” (client space) login interface. It asks for the victim’s code client (client code). After entering the code, the victim would likely be taken to a subsequent page asking for their password and possibly Pass Sécurité codes.

The goal:
The attacker aims to steal the victim’s Société Générale online banking credentials (client code and password). With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud. The inclusion of Pass Sécurité references is designed to make the phishing pages appear more legitimate and to potentially capture the second-factor codes on subsequent pages.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not societegenerale.fr or any official Société Générale domain. Legitimate SocGen login pages are accessed through the official bank website. Always check the address bar.
• Unsolicited login request: Société Générale does not send emails or messages with links requiring customers to log in to activate security features or resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Copied content, mismatched context: The first page contains legitimate-looking information about Pass Sécurité, but it is hosted on a phishing domain. Attackers copy this content to appear credible. The presence of such content does not make the page legitimate.
• Minimal login page: The second page lacks the full branding, security notices, and personalized elements that would appear on a legitimate logged-in session.
• No personalization: The login page does not address the victim by name or display a security image, which would be present on the real SocGen login page after initial identification.

What to do if you encounter this:

• Do not enter your code client, password, or any other personal information on these pages.
• If you are a Société Générale customer, always access online banking by typing societegenerale.fr directly into your browser or by using the official Société Générale mobile app.
• If you have already entered your credentials, contact Société Générale immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Société Générale’s fraud department (e.g., by forwarding the original message to [email protected] or using their official reporting channels).

Why this scam is effective:
Société Générale has millions of online banking customers in France. The inclusion of detailed information about Pass Sécurité—a real security feature—adds a layer of legitimacy. The two-page flow (first explaining a security feature, then presenting a login page) mimics the experience of a legitimate bank website where users navigate from informational pages to the login portal. Victims who are familiar with SocGen’s branding and security terminology may not immediately notice that the URL is incorrect.

Protective measures:

• Bookmark the official Société Générale login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate societegenerale.fr domains, not on phishing sites.
• Enable the Pass Sécurité feature through the official app if you haven’t already, and be cautious if a page asks for your Pass Sécurité codes outside of the normal login flow.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Société Générale domains end with societegenerale.fr. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Société Générale directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Banrural Phishing – Full Account Takeover with SMS Code Harvesting

This phishing campaign impersonates Banrural (Banco de Desarrollo Rural), one of the largest banks in Guatemala. The scam uses a multi-step process to capture the victim’s username, password, and the SMS verification code (two-factor authentication), allowing attackers to bypass security measures and take over the account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Username Page
The first page asks for the victim’s username. It uses Banrural branding and includes a “Siguiente” (Next) button.

Step 2 – Fake Password Page
The second page asks for the victim’s password. After entering the password, the victim clicks “Ingresar” (Login).

Step 3 – Fake “Processing” Waiting Page
The third page displays a fake loading screen (“Por favor espera mientras validamos tu información” – “Please wait while we validate your information”) with a countdown timer. This page is designed to create a sense of legitimate processing while the attacker, in the background, uses the stolen username and password to log into the real Banrural site and trigger an SMS verification code to the victim’s phone.

Step 4 – Fake SMS Code Page
The fourth page asks for the SMS verification code (labeled as “Código SMS”). This is the two-factor authentication (2FA) code that the victim receives on their phone. When the victim enters this code, the attacker captures it and uses it to complete the login on the real Banrural site.

The goal:
The attacker aims to gain full access to the victim’s Banrural online banking account. By capturing the username, password, and SMS 2FA code in real time, they can log in and perform unauthorized transactions before the victim realizes what has happened.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not banrural.com.gt or any official Banrural domain. Legitimate Banrural online banking is accessed through the official website. Always check the address bar.
• Unsolicited login request: Banrural does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Multi-step design with fake waiting page: The inclusion of a “processing” page with a timer is a classic phishing tactic designed to buy time for the attacker to trigger the real SMS code on the legitimate site.
• No personalization or security image: Legitimate Banrural login pages may display a security image or personalized greeting after entering the username. These pages lack such features.
• Request for SMS code without context: The fourth page asks for the SMS code without displaying the phone number or providing context, which is common in phishing kits.

What to do if you encounter this:

• Do not enter your username, password, or SMS verification code on these pages.
• If you are a Banrural customer, always access online banking by typing banrural.com.gt directly into your browser or by using the official Banrural mobile app.
• If you have already entered your credentials but not the SMS code, contact Banrural immediately to change your password and secure your account.
• If you have entered the SMS code as well, the attacker may have already accessed your account. Contact Banrural’s fraud department immediately to block your account and reverse any unauthorized transactions.
• Report the phishing page to Banrural’s security team.

Why this scam is particularly dangerous:
This is a real-time account takeover phishing kit. The attacker does not just collect credentials for later use—they use the stolen username and password immediately to log into the real bank and trigger an SMS code. The fake “processing” page is designed to keep the victim waiting while this happens. When the victim enters the SMS code on the phishing page, the attacker uses it to complete the login, often gaining full access to the account within minutes.

Protective measures:

• Bookmark the official Banrural login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate banrural.com.gt domains, not on phishing sites.
• Be extremely cautious if a login process asks for your SMS code on a page you reached via a link. Legitimate banks only ask for 2FA codes after you have initiated a login on their official site.
• Enable additional security alerts on your bank account to receive notifications of logins and transactions.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banrural domains end with banrural.com.gt. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banrural directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Crédit Agricole Phishing – Fake “SécuriPass” Security Update Scam

This phishing campaign impersonates Crédit Agricole, a major French banking group. The page (which could be an email or a landing page) claims that the bank has detected a malfunction or absence of the SécuriPass security service on the customer’s account. It pressures the victim to click a button to “activate” the service, which leads to a fake login page designed to steal banking credentials.

How it works:
The victim receives this message (likely by email) claiming to be from Crédit Agricole. The message:

• States that security updates have been made
• Claims a problem with the SécuriPass security service on the account
• Instructs the victim to click a button to activate SécuriPass
• Warns that ignoring the message could result in a banking restriction

When the victim clicks the “J’active SécuriPass” (I activate SécuriPass) button, they are taken to a fake Crédit Agricole login page (not shown in this screenshot) where they are asked to enter their online banking credentials.

The goal:
The attacker aims to steal the victim’s Crédit Agricole online banking credentials (typically a client ID and password, and possibly SécuriPass codes). With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not credit-agricole.fr or any official Crédit Agricole domain. The button leads to a phishing site. Always check the address bar before clicking links or entering credentials.
• Unsolicited security alert: Crédit Agricole does not send emails with links requiring customers to click to “activate” security services. Legitimate security updates are communicated through official app notifications, secure messages within the online banking portal, or postal mail—not via email links.
• Threat of consequences: The message warns that ignoring it could lead to a “banking restriction.” This is a classic fear-based tactic to pressure victims into acting without thinking.
• Vague language: The message refers to “un dysfonctionnement ou l’absence du service Sécuri2023” (a malfunction or absence of the Sécuri2023 service). SécuriPass is the real security feature; the variation “Sécuri2023” is unusual and suggests the attacker modified the name to appear current.
• Generic greeting: The message does not address the victim by name or reference a specific account number—common in phishing emails.
• Poor formatting: While the design mimics Crédit Agricole’s branding, subtle formatting inconsistencies may be present compared to official communications.

What to do if you encounter this:

• Do not click the button to “activate” SécuriPass or any other links in the message.
• Do not enter any banking credentials on any page reached via this link.
• If you are a Crédit Agricole customer, always access online banking by typing credit-agricole.fr directly into your browser or by using the official Crédit Agricole mobile app.
• If you have already clicked the link and entered your credentials, contact Crédit Agricole immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing email to Crédit Agricole’s fraud department (e.g., by forwarding it to [email protected] or using their official reporting channel).

Why this scam is effective:
Crédit Agricole has millions of online banking customers in France. SécuriPass is a real security feature used by the bank for transaction confirmation, so references to it are familiar to customers. The fear of losing access to banking services (“interdiction bancaire”) creates urgency. The message’s design and language closely mimic official bank communications, making it difficult for an untrained eye to distinguish from a legitimate notice.

Protective measures:

• Never click links in unsolicited emails claiming to be from your bank. Instead, type the official bank URL directly into your browser.
• Be suspicious of any message that creates urgency, threatens consequences, and asks you to click a link to “activate” or “verify” something.
• Check the sender’s email address carefully. Legitimate Crédit Agricole emails come from @credit-agricole.fr or specific subdomains—not from generic or misspelled addresses.
• Enable two-factor authentication (SécuriPass) through the official app, and remember that legitimate activation processes happen within the app or after logging into the official website—not via a link in an email.
• If in doubt, contact your bank directly using a phone number from your bank statement or the official website—never use contact information provided in the suspicious message.

---

---

Threat Analysis: Banco Bisa Phishing – Fake “Banca EN-LINEA” Login Page

This phishing campaign impersonates Banco Bisa, a prominent Bolivian bank. The page mimics the bank’s “Banca EN-LINEA” (online banking) login interface to steal customers’ Usuario (username) and Contraseña (password).

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Banco Bisa login page. When the victim enters their Usuario and Contraseña and clicks “Siguiente” (Next), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Banco Bisa online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not bisa.com or any official Banco Bisa domain. Legitimate Banco Bisa online banking is accessed through the bank’s official website. Always check the address bar.
• Mixed branding: The footer includes references to “PODCAST BISA” and logos for Apple Podcast, Spotify, etc. While Banco Bisa may have a legitimate podcast, the inclusion of these elements on a login page is unusual and suggests copied content. More importantly, the footer incorrectly shows “© 2020 Banco Bisa S.A.” when the screenshot is from 2023—an outdated copyright notice is a common phishing oversight.
• Unsolicited login request: Banco Bisa does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the official URL directly or using the official mobile app.
• Minimal design: The page lacks the full navigation, security notices, and personalized security elements (such as a security image or phrase) that would appear on a legitimate Banco Bisa login page.
• Generic form: The page only asks for Usuario and Contraseña without additional context or verification steps typical of the real bank’s login flow.

What to do if you encounter this:

• Do not enter your Usuario, Contraseña, or any other personal information on this page.
• If you are a Banco Bisa customer, always access online banking by typing bisa.com directly into your browser or by using the official Banco Bisa mobile app.
• If you have already entered your credentials, contact Banco Bisa immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Banco Bisa’s fraud department.

Why this scam is effective:
Banco Bisa is a well-known bank in Bolivia, and “Banca EN-LINEA” is its standard online banking portal. The page uses the bank’s logo and familiar layout. The inclusion of podcast links and other promotional content (copied from the real bank’s website) can make the page appear legitimate at first glance. However, the outdated copyright year (2020) and the unusual placement of promotional content on a login page are subtle red flags.

Protective measures:

• Bookmark the official Banco Bisa login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bisa.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Banco Bisa account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco Bisa domains end with bisa.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco Bisa directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

American Savings Bank Phishing – Credential & Phone Number Harvesting

This phishing campaign impersonates American Savings Bank (ASB) , a bank serving customers primarily in Hawaii. The page is designed to steal customers’ online banking credentials (Login ID and Password) along with their phone number, which can be used for identity theft or to bypass SMS-based two-factor authentication.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake ASB login page. When the victim enters their Login ID, Password, and Phone Number and clicks “Log In,” the information is captured and sent to the attacker.

The goal:
The attacker aims to:

• Steal the victim’s ASB online banking credentials (Login ID and Password)
• Obtain the victim’s phone number, which can be used for SIM swapping or to intercept SMS-based two-factor authentication codes
• Gain unauthorized access to the victim’s bank account to transfer funds or commit fraud

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not asbhawaii.com or any official American Savings Bank domain. Legitimate ASB online banking is accessed through the bank’s official website. Always check the address bar.
• Unusual request for phone number on login page: Legitimate ASB login pages typically ask only for Login ID and Password. Requesting a phone number on the same page as the login credentials is uncommon and should raise suspicion.
• Minimal design: The page lacks the full branding, security notices, and navigation elements present on the legitimate ASB website. The design is generic and stripped down.
• Unsolicited login request: American Savings Bank does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the official URL directly or using the official mobile app.
• No security image or personalization: Legitimate ASB login pages may display a security image or phrase. This page lacks such features.

What to do if you encounter this:

• Do not enter your Login ID, Password, Phone Number, or any other personal information on this page.
• If you are an American Savings Bank customer, always access online banking by typing asbhawaii.com directly into your browser or by using the official ASB mobile app.
• If you have already entered your credentials, contact American Savings Bank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to ASB’s fraud department.

Why this scam is effective:
American Savings Bank has a loyal customer base in Hawaii, and the bank’s online banking portal is familiar to many. The page uses the bank’s logo and a simple, clean design that mimics the real login page. The request for a phone number may seem innocuous to victims who are used to providing it for security verification. However, legitimate ASB login pages do not ask for a phone number alongside Login ID and Password—this is a clear indicator of a phishing attempt.

Protective measures:

• Bookmark the official American Savings Bank login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate asbhawaii.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your ASB account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate ASB domains end with asbhawaii.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact American Savings Bank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---

---

Threat Analysis: Bank of America Phishing – Fake “Security Challenge” Harvesting Phone Numbers

This phishing campaign impersonates Bank of America, one of the largest banks in the United States. The page presents a fake “Security Challenge” that asks the victim to complete a CAPTCHA and enter their phone number. This page is typically encountered after the victim has already entered their online banking credentials on a previous phishing page, or it may be used as a standalone data collection step.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to a phishing page. This specific page:

• Displays a Bank of America logo
• Presents a “Security Challenge” with a CAPTCHA (images of characters to type)
• Requests the victim’s phone number
• Has a “Continue” button

The goal:
The attacker aims to:

• Collect the victim’s phone number, which can be used for identity theft, SIM swapping, or to intercept SMS-based two-factor authentication (2FA) codes
• Potentially capture the victim’s banking credentials if this page is part of a longer multi-step phishing flow (with the CAPTCHA serving to make the page appear legitimate)

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not bankofamerica.com. Legitimate Bank of America login pages are accessed through the official website. Always check the address bar.
• CAPTCHA on a banking login flow: While CAPTCHAs are sometimes used to prevent bots, it is unusual for a legitimate bank to present one after the initial login screen. This is a common phishing tactic to make the page appear more “secure” to victims.
• Phone number request without context: A legitimate Bank of America security challenge would not ask for a phone number in this manner. If additional verification is needed, it would be handled through established 2FA methods (SMS to a number already on file) within a secure, authenticated session.
• Unsolicited login request: Bank of America does not send emails or messages with links requiring customers to log in and complete “security challenges.” Customers should always access online banking by typing the official URL directly or using the official app.
• Minimal branding: The page uses a simple Bank of America logo but lacks the full navigation, security notices, and account-specific information present on the legitimate site.

What to do if you encounter this:

• Do not complete the CAPTCHA or enter your phone number on this page.
• If you are a Bank of America customer, always access online banking by typing bankofamerica.com directly into your browser or by using the official Bank of America mobile app.
• If you have already entered your credentials on a previous page and reached this page, assume your credentials have been compromised. Contact Bank of America immediately to secure your account.
• If you have entered your phone number, be aware that attackers may use it for SIM swapping or other fraudulent activities. Contact your mobile carrier to add additional security to your account (such as a PIN or port-out protection).
• Report the phishing page to Bank of America’s fraud department (e.g., by forwarding the original message to [email protected]).

Why this scam is effective:
Bank of America has millions of online banking customers. The addition of a CAPTCHA and a phone number request creates the illusion of a legitimate security measure. Victims who have already entered their credentials on a previous page may be primed to trust this next step. The CAPTCHA also serves to make automated security tools less likely to flag the page, and it can convince victims that the page is “official” because it includes a verification step.

Protective measures:

• Never enter banking credentials or personal information on pages reached via unsolicited links.
• Bookmark the official Bank of America login page and use that bookmark to access online banking.
• Use a password manager: It will autofill only on legitimate bankofamerica.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) using an authenticator app rather than SMS where possible, to reduce the risk of SIM swapping.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account or complete “security challenges.”
• Check the URL carefully: Legitimate Bank of America domains end with bankofamerica.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Bank of America directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

---