Antiphishing.biz

OTP Bank “Account Access Verification” Phishing
Target: OTP Bank Customers (Hungary, Russia, Romania, Serbia, etc.)
Threat Level: Critical (Real-time OTP Interception & Account Hijacking)

Phishing Method Description
This attack relies on Psychological Pressure. Victims receive a Smishing (SMS) or Email claiming that their “OTPdirekt access has been suspended” or that a “Suspicious login attempt” was detected from a new device.

The link leads to a high-fidelity clone of the OTP Bank login page. This sophisticated phishing kit is designed for a Man-in-the-Middle (MitM) attack, harvesting:

User ID / Account Number (HAZ / ID)
Password / PIN
Mobile Phone Number
Mobile Signature (SMS OTP): The fake site prompts the victim to enter the 6-digit security code received via SMS in real-time. The attacker immediately uses this code on the actual bank site to authorize a fraudulent transfer or link their own device to the account.

⚠️ Red Flags to Watch For
Deceptive Domain: The official domains are otpbank.hu, otpbank.ru, otpbanka.rs, etc.. Phishing sites use lookalikes such as otpbank-security.online, verific-otp.net, or free subdomains like otp-login.web.app.
Requesting OTP for “Blocking” or “Updates”: A real bank will never ask you for an SMS code to cancel a transaction or unblock an account. Codes are strictly for authorizing actions you started yourself.
Urgent Tone: Messages demanding you “Act within 2 hours” to avoid a total block are clear signs of a scam.

🛡️ How to Protect Yourself
Use the Mobile App: Manage your security exclusively through the official OTP SmartBank or m-bank app.
The “Manual Entry” Rule: Always type the official address manually into your browser’s address bar. Never click on links in bank messages.
Verify the SMS Source: Official alerts come from registered bank IDs. If a message comes from a standard mobile number, delete it.
Immediate Action: If you have entered data on a suspicious site, call the official OTP Bank support immediately at +36 1 3666 666 (Hungary) or +7 495 783-54-00 (Russia) to freeze your account.

💡 Expert Security Tip: The “Live Proxy” Hazard
The Method:
This case highlights the Real-Time Token Relay tactic. Scammers use automated kits that act as a “live bridge” between you and the real bank.

The Trap:
When you enter your Mobile Signature SMS code on the fake site, you aren’t “verifying” anything. You are providing the final authorization for a transaction the hacker has already prepared in the background.

How to Protect Yourself:
Read the SMS Content Carefully: If the SMS says “Code to authorize a transfer of X amount” while you are just trying to “log in,” do not enter it.
Switch to Biometric Auth: Use Fingerprint or FaceID inside the official app. These methods are much harder to phish than 6-digit SMS codes.
One-Time Rule: An OTP is meant for one specific action. If the site asks you to enter multiple codes in a row for a single “verification,” close the page—they are draining your account transaction by transaction.

Banking Phishing – Fake Virtual Keyboard & Credential Harvesting

This phishing page impersonates the online banking portal of Banco BISA (a Bolivian bank). The page is designed to steal customers’ login credentials by mimicking the bank’s legitimate authentication interface.

How it works:
The victim receives a phishing email, SMS, or other fraudulent message claiming there is an issue with their account, a security alert, or a promotion. The link leads to this fake login page. The page requests the user’s “usuario” (username) and features a “Teclado virtual” (virtual keyboard) button—a common security feature used by Latin American banks to protect against keyloggers.

The twist:
Cybercriminals replicate the virtual keyboard to trick users into thinking the page is legitimate. When the victim clicks the virtual keyboard button and enters their credentials, the information is captured and sent directly to the attacker. The fake “Siguiente” (Next) button then leads to a second page that likely requests additional sensitive data, such as a password, security token, or one-time code.

Red flags to watch for:

URL mismatch: The page is not hosted on the official bank domain. Banco BISA’s legitimate online banking URL would be something like www.bisa.com or a secure subdomain—not a random or unrelated address.

Generic promotion: The footer text about “Ahorro Plus” (earning 3.85% interest) is copied from the real bank’s marketing, but phishing pages often use outdated or slightly mismatched promotional content.

Virtual keyboard context: While many banks do use virtual keyboards, phishing pages replicate them. Always verify you are on the official site before interacting with any login form.

Lack of personalization: Legitimate banking portals often display a partial account number, security image, or personal greeting after entering the username—this fake page does not.

What to do if you encounter this:

Do not enter your username, click the virtual keyboard, or press “Siguiente.”

If you are a Banco BISA customer, always type the official bank URL directly into your browser or use the official mobile banking app.

Report the phishing page to Banco BISA’s fraud department so they can work to have it taken down.

Why this scam is dangerous:
Once the attacker obtains the username and password, they can attempt to log in to the victim’s real bank account. If the bank uses two-factor authentication (2FA), the phishing site may also ask for the 2FA code on a subsequent page, allowing real-time account takeover.

Vipps Payment Phishing – BankID Credential Theft

This phishing page impersonates Vipps, a widely used mobile payment app in Norway. The page is designed to steal victims’ fødselsnummer (Norwegian national ID number) and subsequently their BankID credentials, which would allow attackers to take over bank accounts and authorize fraudulent transactions.

How it works:
The victim receives a phishing email, SMS, or social media message claiming a payment issue, a refund, or a request to verify their Vipps account. The link leads to this fake page hosted on a suspicious domain (dreamwp.com). The page asks for the victim’s 11-digit fødselsnummer (birth number) and then prompts them to authenticate with “BankID Identifiering PÅ MOBIL” (BankID identification on mobile)—a common authentication method in Norway.

The goal:
If the victim enters their fødselsnummer and proceeds, they are likely taken to a subsequent fake BankID page that captures their BankID password or confirms a fraudulent transaction. With these credentials, the attacker can log in to the victim’s online banking, transfer money, or authorize payments in real time.

Red flags to watch for:

Suspicious URL: The page is hosted on fh9ujj9i.dreamwp.com, which is clearly not the official Vipps domain (vipps.no). Attackers often use compromised WordPress sites (like dreamwp.com) to host phishing pages.

Poor design and formatting: The page shows a distorted Vipps logo (“V:pps”) with inconsistent spacing and visual errors. Legitimate Vipps pages are professionally designed.

Immediate request for fødselsnummer: Vipps does not randomly ask for your full national ID number via a link sent in a message. Official authentication happens within the Vipps app or via BankID on a trusted, verified page.

Generic content: The page lacks personalization (no name, no partial account reference) that a legitimate payment service would display.

What to do if you encounter this:

Do not enter your fødselsnummer or any other personal information.

Do not click the “BankID Identifiering” button or attempt to authenticate.

If you are a Vipps user, always open the Vipps app directly to check for notifications or pending actions. Never click links in unsolicited messages claiming to be from Vipps.

Report the phishing page to Vipps’ security team at [email protected] (or via their official support channels).

Why this scam is particularly dangerous:
In Norway, the combination of fødselsnummer + BankID provides near-complete access to a person’s banking, tax, and healthcare records. Once compromised, victims may face significant financial loss and identity theft. These phishing pages often mimic BankID’s interface seamlessly, making them difficult to distinguish from the real thing.

BDO Online Banking Phishing – Credential Harvesting

This phishing page impersonates the login portal of BDO (Banco de Oro Unibank) , one of the largest banks in the Philippines. The page is designed to steal customers’ User ID and Password, giving attackers direct access to their bank accounts.

How it works:
The victim receives a phishing email, SMS, or social media message claiming a security alert, account suspension, or a “problem with your account.” The link leads to this fake BDO login page. The page closely mimics the real BDO Online Banking interface, including legitimate-looking footer links (Privacy Policy, Terms and Conditions, Toll-Free numbers) to appear authentic. When the victim enters their User ID and Password and clicks “Login,” the credentials are captured and sent to the attacker.

The goal:
With stolen User ID and Password, the attacker can log in to the victim’s real BDO account, transfer funds, pay bills, or even enroll in additional services to further compromise the account. Because BDO uses two-factor authentication (2FA) for some transactions, the attacker may attempt to use the credentials immediately or combine them with social engineering to obtain the 2FA code.

Red flags to watch for:

Suspicious URL: The page is hosted on a domain that is not bdo.com.ph. Attackers often use domains that look similar but contain misspellings, extra words, or unrelated extensions.

“Legin” typo: The page header says “Legin to BDO Online Banking” instead of “Log in to BDO Online Banking.” This typo is a clear indicator of a fake page.

Generic login form: Legitimate BDO Online Banking often displays a security image or personalized greeting after entering the User ID—this page does not.

Fake footer: While the footer contains real BDO information (toll-free numbers, etc.), phishing pages copy this text to appear credible. Always check the URL first, not the content.

What to do if you encounter this:

Do not enter your User ID, Password, or any other personal information.

Do not click any links on the page, including the “Forgot your password?” links—they may lead to additional phishing pages.

If you are a BDO customer, always type www.bdo.com.ph directly into your browser or use the official BDO mobile app to access your account.

Report the phishing page to BDO’s fraud department at [email protected] or through their official customer service hotline.

Why this scam is effective:
BDO has millions of online banking users in the Philippines, and phishing pages like this are often distributed via SMS (“smishing”) claiming “Your BDO account has been temporarily locked.” Because the page includes authentic-looking footer content (toll-free numbers, privacy policy links), many users mistakenly trust it. The typo “Legin” is one of the few visual red flags—underscoring how carefully users must scrutinize every detail.