Antiphishing.biz

Scotiabank Phishing – Fake Login Page Stealing DNI and Password

This phishing campaign impersonates Scotiabank, a major international bank with operations across Latin America (including Mexico, Peru, Chile, Colombia, and other countries). The page is designed to steal customers’ online banking credentials—specifically the DNI (national identification number) and password.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Scotiabank login page. When the victim enters their DNI and password and clicks “Siguiente” (Next), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Scotiabank online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain (scotiabankverificaenlinea23.abmx.com) that is not the official Scotiabank domain. Legitimate Scotiabank online banking is accessed through domains like scotiabank.com, scotiabank.com.mx, scotiabank.com.pe, etc. The use of a non-standard domain with extra words (“verificaenlinea23”) is a clear red flag.
• Unsolicited login request: Scotiabank does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the official URL directly or using the official mobile app.
• Minimal design: The page lacks the full Scotiabank branding, navigation menus, security notices, and personalized elements that appear on the legitimate login page.
• No security image or personalization: Legitimate Scotiabank login pages often display a security image or phrase after entering the DNI. This page does not have that feature.
• Generic “Bienvenido” header: The page uses a generic welcome message rather than personalized content.

What to do if you encounter this:

• Do not enter your DNI, password, or any other personal information on this page.
• If you are a Scotiabank customer, always access online banking by typing the official Scotiabank URL for your country directly into your browser (e.g., scotiabank.com for the US, scotiabank.com.mx for Mexico, etc.) or by using the official Scotiabank mobile app.
• If you have already entered your credentials, contact Scotiabank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Scotiabank’s fraud department (e.g., by forwarding the original message to the bank’s official phishing reporting address).

Why this scam is effective:
Scotiabank has millions of customers across Latin America, making it a frequent target for phishing. The page uses the Scotiabank logo and a simple, clean design that resembles the bank’s login interface. The use of “DNI” (national ID) as the username is consistent with how many Latin American banks authenticate users. The “Siguiente” (Next) button mimics the flow of the legitimate login process, where users often enter credentials on one page and then a second factor on the next.

Protective measures:

• Bookmark the official Scotiabank login page for your country and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate Scotiabank domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Scotiabank account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Scotiabank domains end with scotiabank.com or country-specific variations (e.g., .com.mx, .com.pe). Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Scotiabank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

Threat Analysis: Société Générale Phishing – Fake “Pass Sécurité” & Credential Harvesting

This phishing campaign impersonates Société Générale, one of the largest banks in France. The scam uses a two-step approach: first presenting a page about the bank’s legitimate “Pass Sécurité” security feature to build trust, then directing the victim to a fake login page that steals their code client (client code) and subsequent password.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, the need to activate Pass Sécurité, or another account-related issue. The message includes a link to the first phishing page.

Step 1 – Fake Pass Sécurité Information Page
The first page mimics Société Générale’s official information about Pass Sécurité—a legitimate security feature used by the bank for transaction confirmation. The page includes:

• Descriptions of the Pass Sécurité service
• Legal disclaimers and footnotes copied from the real bank website
• No login form; instead, it sets the stage for the victim to believe they need to log in to activate or use the service

Step 2 – Fake Login Page
The second page mimics Société Générale’s “Espace client” (client space) login interface. It asks for the victim’s code client (client code). After entering the code, the victim would likely be taken to a subsequent page asking for their password and possibly Pass Sécurité codes.

The goal:
The attacker aims to steal the victim’s Société Générale online banking credentials (client code and password). With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud. The inclusion of Pass Sécurité references is designed to make the phishing pages appear more legitimate and to potentially capture the second-factor codes on subsequent pages.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not societegenerale.fr or any official Société Générale domain. Legitimate SocGen login pages are accessed through the official bank website. Always check the address bar.
• Unsolicited login request: Société Générale does not send emails or messages with links requiring customers to log in to activate security features or resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Copied content, mismatched context: The first page contains legitimate-looking information about Pass Sécurité, but it is hosted on a phishing domain. Attackers copy this content to appear credible. The presence of such content does not make the page legitimate.
• Minimal login page: The second page lacks the full branding, security notices, and personalized elements that would appear on a legitimate logged-in session.
• No personalization: The login page does not address the victim by name or display a security image, which would be present on the real SocGen login page after initial identification.

What to do if you encounter this:

• Do not enter your code client, password, or any other personal information on these pages.
• If you are a Société Générale customer, always access online banking by typing societegenerale.fr directly into your browser or by using the official Société Générale mobile app.
• If you have already entered your credentials, contact Société Générale immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Société Générale’s fraud department (e.g., by forwarding the original message to [email protected] or using their official reporting channels).

Why this scam is effective:
Société Générale has millions of online banking customers in France. The inclusion of detailed information about Pass Sécurité—a real security feature—adds a layer of legitimacy. The two-page flow (first explaining a security feature, then presenting a login page) mimics the experience of a legitimate bank website where users navigate from informational pages to the login portal. Victims who are familiar with SocGen’s branding and security terminology may not immediately notice that the URL is incorrect.

Protective measures:

• Bookmark the official Société Générale login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate societegenerale.fr domains, not on phishing sites.
• Enable the Pass Sécurité feature through the official app if you haven’t already, and be cautious if a page asks for your Pass Sécurité codes outside of the normal login flow.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Société Générale domains end with societegenerale.fr. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Société Générale directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

Threat Analysis: Banrural Phishing – Full Account Takeover with SMS Code Harvesting

This phishing campaign impersonates Banrural (Banco de Desarrollo Rural), one of the largest banks in Guatemala. The scam uses a multi-step process to capture the victim’s username, password, and the SMS verification code (two-factor authentication), allowing attackers to bypass security measures and take over the account.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to the first phishing page.

Step 1 – Fake Username Page
The first page asks for the victim’s username. It uses Banrural branding and includes a “Siguiente” (Next) button.

Step 2 – Fake Password Page
The second page asks for the victim’s password. After entering the password, the victim clicks “Ingresar” (Login).

Step 3 – Fake “Processing” Waiting Page
The third page displays a fake loading screen (“Por favor espera mientras validamos tu información” – “Please wait while we validate your information”) with a countdown timer. This page is designed to create a sense of legitimate processing while the attacker, in the background, uses the stolen username and password to log into the real Banrural site and trigger an SMS verification code to the victim’s phone.

Step 4 – Fake SMS Code Page
The fourth page asks for the SMS verification code (labeled as “Código SMS”). This is the two-factor authentication (2FA) code that the victim receives on their phone. When the victim enters this code, the attacker captures it and uses it to complete the login on the real Banrural site.

The goal:
The attacker aims to gain full access to the victim’s Banrural online banking account. By capturing the username, password, and SMS 2FA code in real time, they can log in and perform unauthorized transactions before the victim realizes what has happened.

Red flags to watch for:

• Suspicious URL: The pages are hosted on domains that are not banrural.com.gt or any official Banrural domain. Legitimate Banrural online banking is accessed through the official website. Always check the address bar.
• Unsolicited login request: Banrural does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official app.
• Multi-step design with fake waiting page: The inclusion of a “processing” page with a timer is a classic phishing tactic designed to buy time for the attacker to trigger the real SMS code on the legitimate site.
• No personalization or security image: Legitimate Banrural login pages may display a security image or personalized greeting after entering the username. These pages lack such features.
• Request for SMS code without context: The fourth page asks for the SMS code without displaying the phone number or providing context, which is common in phishing kits.

What to do if you encounter this:

• Do not enter your username, password, or SMS verification code on these pages.
• If you are a Banrural customer, always access online banking by typing banrural.com.gt directly into your browser or by using the official Banrural mobile app.
• If you have already entered your credentials but not the SMS code, contact Banrural immediately to change your password and secure your account.
• If you have entered the SMS code as well, the attacker may have already accessed your account. Contact Banrural’s fraud department immediately to block your account and reverse any unauthorized transactions.
• Report the phishing page to Banrural’s security team.

Why this scam is particularly dangerous:
This is a real-time account takeover phishing kit. The attacker does not just collect credentials for later use—they use the stolen username and password immediately to log into the real bank and trigger an SMS code. The fake “processing” page is designed to keep the victim waiting while this happens. When the victim enters the SMS code on the phishing page, the attacker uses it to complete the login, often gaining full access to the account within minutes.

Protective measures:

• Bookmark the official Banrural login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate banrural.com.gt domains, not on phishing sites.
• Be extremely cautious if a login process asks for your SMS code on a page you reached via a link. Legitimate banks only ask for 2FA codes after you have initiated a login on their official site.
• Enable additional security alerts on your bank account to receive notifications of logins and transactions.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banrural domains end with banrural.com.gt. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banrural directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

Threat Analysis: Crédit Agricole Phishing – Fake “SécuriPass” Security Update Scam

This phishing campaign impersonates Crédit Agricole, a major French banking group. The page (which could be an email or a landing page) claims that the bank has detected a malfunction or absence of the SécuriPass security service on the customer’s account. It pressures the victim to click a button to “activate” the service, which leads to a fake login page designed to steal banking credentials.

How it works:
The victim receives this message (likely by email) claiming to be from Crédit Agricole. The message:

• States that security updates have been made
• Claims a problem with the SécuriPass security service on the account
• Instructs the victim to click a button to activate SécuriPass
• Warns that ignoring the message could result in a banking restriction

When the victim clicks the “J’active SécuriPass” (I activate SécuriPass) button, they are taken to a fake Crédit Agricole login page (not shown in this screenshot) where they are asked to enter their online banking credentials.

The goal:
The attacker aims to steal the victim’s Crédit Agricole online banking credentials (typically a client ID and password, and possibly SécuriPass codes). With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not credit-agricole.fr or any official Crédit Agricole domain. The button leads to a phishing site. Always check the address bar before clicking links or entering credentials.
• Unsolicited security alert: Crédit Agricole does not send emails with links requiring customers to click to “activate” security services. Legitimate security updates are communicated through official app notifications, secure messages within the online banking portal, or postal mail—not via email links.
• Threat of consequences: The message warns that ignoring it could lead to a “banking restriction.” This is a classic fear-based tactic to pressure victims into acting without thinking.
• Vague language: The message refers to “un dysfonctionnement ou l’absence du service Sécuri2023” (a malfunction or absence of the Sécuri2023 service). SécuriPass is the real security feature; the variation “Sécuri2023” is unusual and suggests the attacker modified the name to appear current.
• Generic greeting: The message does not address the victim by name or reference a specific account number—common in phishing emails.
• Poor formatting: While the design mimics Crédit Agricole’s branding, subtle formatting inconsistencies may be present compared to official communications.

What to do if you encounter this:

• Do not click the button to “activate” SécuriPass or any other links in the message.
• Do not enter any banking credentials on any page reached via this link.
• If you are a Crédit Agricole customer, always access online banking by typing credit-agricole.fr directly into your browser or by using the official Crédit Agricole mobile app.
• If you have already clicked the link and entered your credentials, contact Crédit Agricole immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing email to Crédit Agricole’s fraud department (e.g., by forwarding it to [email protected] or using their official reporting channel).

Why this scam is effective:
Crédit Agricole has millions of online banking customers in France. SécuriPass is a real security feature used by the bank for transaction confirmation, so references to it are familiar to customers. The fear of losing access to banking services (“interdiction bancaire”) creates urgency. The message’s design and language closely mimic official bank communications, making it difficult for an untrained eye to distinguish from a legitimate notice.

Protective measures:

• Never click links in unsolicited emails claiming to be from your bank. Instead, type the official bank URL directly into your browser.
• Be suspicious of any message that creates urgency, threatens consequences, and asks you to click a link to “activate” or “verify” something.
• Check the sender’s email address carefully. Legitimate Crédit Agricole emails come from @credit-agricole.fr or specific subdomains—not from generic or misspelled addresses.
• Enable two-factor authentication (SécuriPass) through the official app, and remember that legitimate activation processes happen within the app or after logging into the official website—not via a link in an email.
• If in doubt, contact your bank directly using a phone number from your bank statement or the official website—never use contact information provided in the suspicious message.

Threat Analysis: Banco Bisa Phishing – Fake “Banca EN-LINEA” Login Page

This phishing campaign impersonates Banco Bisa, a prominent Bolivian bank. The page mimics the bank’s “Banca EN-LINEA” (online banking) login interface to steal customers’ Usuario (username) and Contraseña (password).

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Banco Bisa login page. When the victim enters their Usuario and Contraseña and clicks “Siguiente” (Next), the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Banco Bisa online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not bisa.com or any official Banco Bisa domain. Legitimate Banco Bisa online banking is accessed through the bank’s official website. Always check the address bar.
• Mixed branding: The footer includes references to “PODCAST BISA” and logos for Apple Podcast, Spotify, etc. While Banco Bisa may have a legitimate podcast, the inclusion of these elements on a login page is unusual and suggests copied content. More importantly, the footer incorrectly shows “© 2020 Banco Bisa S.A.” when the screenshot is from 2023—an outdated copyright notice is a common phishing oversight.
• Unsolicited login request: Banco Bisa does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the official URL directly or using the official mobile app.
• Minimal design: The page lacks the full navigation, security notices, and personalized security elements (such as a security image or phrase) that would appear on a legitimate Banco Bisa login page.
• Generic form: The page only asks for Usuario and Contraseña without additional context or verification steps typical of the real bank’s login flow.

What to do if you encounter this:

• Do not enter your Usuario, Contraseña, or any other personal information on this page.
• If you are a Banco Bisa customer, always access online banking by typing bisa.com directly into your browser or by using the official Banco Bisa mobile app.
• If you have already entered your credentials, contact Banco Bisa immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Banco Bisa’s fraud department.

Why this scam is effective:
Banco Bisa is a well-known bank in Bolivia, and “Banca EN-LINEA” is its standard online banking portal. The page uses the bank’s logo and familiar layout. The inclusion of podcast links and other promotional content (copied from the real bank’s website) can make the page appear legitimate at first glance. However, the outdated copyright year (2020) and the unusual placement of promotional content on a login page are subtle red flags.

Protective measures:

• Bookmark the official Banco Bisa login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bisa.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Banco Bisa account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Banco Bisa domains end with bisa.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Banco Bisa directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

American Savings Bank Phishing – Credential & Phone Number Harvesting

This phishing campaign impersonates American Savings Bank (ASB) , a bank serving customers primarily in Hawaii. The page is designed to steal customers’ online banking credentials (Login ID and Password) along with their phone number, which can be used for identity theft or to bypass SMS-based two-factor authentication.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake ASB login page. When the victim enters their Login ID, Password, and Phone Number and clicks “Log In,” the information is captured and sent to the attacker.

The goal:
The attacker aims to:

• Steal the victim’s ASB online banking credentials (Login ID and Password)
• Obtain the victim’s phone number, which can be used for SIM swapping or to intercept SMS-based two-factor authentication codes
• Gain unauthorized access to the victim’s bank account to transfer funds or commit fraud

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not asbhawaii.com or any official American Savings Bank domain. Legitimate ASB online banking is accessed through the bank’s official website. Always check the address bar.
• Unusual request for phone number on login page: Legitimate ASB login pages typically ask only for Login ID and Password. Requesting a phone number on the same page as the login credentials is uncommon and should raise suspicion.
• Minimal design: The page lacks the full branding, security notices, and navigation elements present on the legitimate ASB website. The design is generic and stripped down.
• Unsolicited login request: American Savings Bank does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the official URL directly or using the official mobile app.
• No security image or personalization: Legitimate ASB login pages may display a security image or phrase. This page lacks such features.

What to do if you encounter this:

• Do not enter your Login ID, Password, Phone Number, or any other personal information on this page.
• If you are an American Savings Bank customer, always access online banking by typing asbhawaii.com directly into your browser or by using the official ASB mobile app.
• If you have already entered your credentials, contact American Savings Bank immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to ASB’s fraud department.

Why this scam is effective:
American Savings Bank has a loyal customer base in Hawaii, and the bank’s online banking portal is familiar to many. The page uses the bank’s logo and a simple, clean design that mimics the real login page. The request for a phone number may seem innocuous to victims who are used to providing it for security verification. However, legitimate ASB login pages do not ask for a phone number alongside Login ID and Password—this is a clear indicator of a phishing attempt.

Protective measures:

• Bookmark the official American Savings Bank login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate asbhawaii.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your ASB account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate ASB domains end with asbhawaii.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact American Savings Bank directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

Threat Analysis: Bank of America Phishing – Fake “Security Challenge” Harvesting Phone Numbers

This phishing campaign impersonates Bank of America, one of the largest banks in the United States. The page presents a fake “Security Challenge” that asks the victim to complete a CAPTCHA and enter their phone number. This page is typically encountered after the victim has already entered their online banking credentials on a previous phishing page, or it may be used as a standalone data collection step.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to a phishing page. This specific page:

• Displays a Bank of America logo
• Presents a “Security Challenge” with a CAPTCHA (images of characters to type)
• Requests the victim’s phone number
• Has a “Continue” button

The goal:
The attacker aims to:

• Collect the victim’s phone number, which can be used for identity theft, SIM swapping, or to intercept SMS-based two-factor authentication (2FA) codes
• Potentially capture the victim’s banking credentials if this page is part of a longer multi-step phishing flow (with the CAPTCHA serving to make the page appear legitimate)

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not bankofamerica.com. Legitimate Bank of America login pages are accessed through the official website. Always check the address bar.
• CAPTCHA on a banking login flow: While CAPTCHAs are sometimes used to prevent bots, it is unusual for a legitimate bank to present one after the initial login screen. This is a common phishing tactic to make the page appear more “secure” to victims.
• Phone number request without context: A legitimate Bank of America security challenge would not ask for a phone number in this manner. If additional verification is needed, it would be handled through established 2FA methods (SMS to a number already on file) within a secure, authenticated session.
• Unsolicited login request: Bank of America does not send emails or messages with links requiring customers to log in and complete “security challenges.” Customers should always access online banking by typing the official URL directly or using the official app.
• Minimal branding: The page uses a simple Bank of America logo but lacks the full navigation, security notices, and account-specific information present on the legitimate site.

What to do if you encounter this:

• Do not complete the CAPTCHA or enter your phone number on this page.
• If you are a Bank of America customer, always access online banking by typing bankofamerica.com directly into your browser or by using the official Bank of America mobile app.
• If you have already entered your credentials on a previous page and reached this page, assume your credentials have been compromised. Contact Bank of America immediately to secure your account.
• If you have entered your phone number, be aware that attackers may use it for SIM swapping or other fraudulent activities. Contact your mobile carrier to add additional security to your account (such as a PIN or port-out protection).
• Report the phishing page to Bank of America’s fraud department (e.g., by forwarding the original message to [email protected]).

Why this scam is effective:
Bank of America has millions of online banking customers. The addition of a CAPTCHA and a phone number request creates the illusion of a legitimate security measure. Victims who have already entered their credentials on a previous page may be primed to trust this next step. The CAPTCHA also serves to make automated security tools less likely to flag the page, and it can convince victims that the page is “official” because it includes a verification step.

Protective measures:

• Never enter banking credentials or personal information on pages reached via unsolicited links.
• Bookmark the official Bank of America login page and use that bookmark to access online banking.
• Use a password manager: It will autofill only on legitimate bankofamerica.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) using an authenticator app rather than SMS where possible, to reduce the risk of SIM swapping.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account or complete “security challenges.”
• Check the URL carefully: Legitimate Bank of America domains end with bankofamerica.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Bank of America directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

Threat Analysis: PNC Bank Phishing – Fake “Online Banking” Login Page

This phishing campaign impersonates PNC Bank, one of the largest banks in the United States. The page mimics PNC’s online banking login interface to steal customers’ User ID and Password.

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake PNC login page. When the victim enters their User ID and Password and clicks “Sign In,” the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s PNC online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, pay bills, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not pnc.com or any official PNC domain. Legitimate PNC online banking is accessed through the bank’s official website. Always check the address bar.
• Unsolicited login request: PNC does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official PNC mobile app.
• Minimal design: While the page includes the PNC logo and some text, it lacks the full navigation, security notices, and personalized elements present on the legitimate PNC login page. The layout is simpler than the real site.
• No security image or phrase: Legitimate PNC login pages display a security image or phrase after entering the User ID as part of their fraud prevention measures. This page does not have that feature.
• Generic footer: The footer includes copyright information and links, but these are copied from the real site and do not guarantee legitimacy.

What to do if you encounter this:

• Do not enter your User ID, Password, or any other personal information on this page.
• If you are a PNC customer, always access online banking by typing pnc.com directly into your browser or by using the official PNC mobile app.
• If you have already entered your credentials, contact PNC immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to PNC’s fraud department (e.g., by forwarding the original message to [email protected] or using their official reporting channels).

Why this scam is effective:
PNC has millions of online banking customers across the United States. The page uses the PNC logo, the familiar “Online Banking” branding, and text copied from the legitimate website. The simple, clean design may appear credible to users who are not scrutinizing the URL. The inclusion of footer links and copyright information adds to the illusion of legitimacy.

Protective measures:

• Bookmark the official PNC login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate pnc.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your PNC account if available, to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate PNC domains end with pnc.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact PNC directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.

Threat Analysis: Bank of America Phishing – Fake “Checking Savings” Login Page

This phishing campaign impersonates Bank of America, one of the largest banks in the United States. The page mimics the bank’s login interface to steal customers’ Online ID and Passcode (password).

How it works:
The victim receives a phishing email, SMS, or other message claiming a security alert, account issue, or the need to verify their information. The message includes a link to this fake Bank of America login page. When the victim enters their Online ID and Passcode and clicks “Sign In,” the credentials are captured and sent to the attacker.

The goal:
The attacker aims to steal the victim’s Bank of America online banking credentials. With these, they can log into the victim’s real bank account, view balances, transfer funds, and commit fraud.

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain that is not bankofamerica.com. Legitimate Bank of America online banking is accessed through the official website. Always check the address bar.
• Unsolicited login request: Bank of America does not send emails or messages with links requiring customers to log in to resolve account issues. Customers should always access online banking by typing the URL directly or using the official mobile app.
• Copied promotional content: The page includes credit card offers and a podcast promotion that are copied from the legitimate Bank of America website. Attackers use such content to make the page appear authentic, but its presence does not guarantee legitimacy.
• Missing security elements: Legitimate Bank of America login pages include security features such as a “Secure” badge, site key phrase, or personalized greeting. This page lacks these.
• Mixed branding elements: The page uses the Bank of America logo and “Checking Savings” header, but the layout is simpler and less polished than the actual site.
• “Save Online ID” checkbox: While this feature exists on the real site, phishing pages copy it to appear legitimate. The real security check is the URL, not the presence of familiar interface elements.

What to do if you encounter this:

• Do not enter your Online ID, Passcode, or any other personal information on this page.
• If you are a Bank of America customer, always access online banking by typing bankofamerica.com directly into your browser or by using the official Bank of America mobile app.
• If you have already entered your credentials, contact Bank of America immediately through their official customer service hotline to secure your account and change your password.
• Report the phishing page to Bank of America’s fraud department (e.g., by forwarding the original message to [email protected]).

Why this scam is effective:
Bank of America has millions of online banking customers. This phishing page is particularly convincing because it includes real promotional content (credit card offers, podcast links) that is copied from the bank’s actual website. Victims who have seen these offers before may be reassured that the page is legitimate. The login form itself is simple and familiar, making it easy for a distracted user to enter credentials without checking the URL.

Protective measures:

• Bookmark the official Bank of America login page and use that bookmark to access online banking—never click links in emails or messages.
• Use a password manager: It will autofill only on legitimate bankofamerica.com domains, not on phishing sites.
• Enable two-factor authentication (2FA) on your Bank of America account to add an extra layer of protection.
• Be suspicious of any unsolicited message that creates urgency and asks you to log in to your bank account.
• Check the URL carefully: Legitimate Bank of America domains end with bankofamerica.com. Look for misspellings, extra words, or unusual top-level domains.
• If in doubt, contact Bank of America directly using a phone number from your bank statement or the official website—never use contact information provided in a suspicious message.