We're found that more than 2,000 websites that appear to imitate UK banks were reported in 2023 alone.
These copycat websites play a crucial role in impersonation scams. Fraudsters use details, such as account numbers, collected from unsuspecting bank customers to later con those same people into sending them money, often by posing as bank staff.
Although banks attempt to get lookalike websites taken down, the number being registered, and sometimes inadequate response from the firms that register domains, means they're up long enough to find victims.
Here we reveal the scale of the copycat bank websites, how to spot one, and what needs to be done to stop them appearing in the first place.
Thousands of suspicious websites reported
And the majority of sites in the raw data look like blatant attempts to lead bank customers astray – mysantander-suspend-login.com and lloydsbanklnggroup.com, for example.
The drawbacks of our data
The data is inexact and experimental. For instance, we excluded TSB from all the results as this proved a common string of letters that generated many false positives – for example mattsbong.com – seemingly unrelated to banking scams.
Moreover, it’s impossible for us to view and check the sites were genuinely fraudulent, as they’ve already been taken down by the web hosting companies or scammers themselves.
However, it’s also possible we’ve missed many copycat websites, because they’re not on blocklists Some sites may only be active for days or even hours before their content is wiped and the site abandoned.
Under-reporting of fraud is an enormous issue worldwide, with the Global Anti Scams Alliance (GASA) State of Scams Report 2023 finding that 59% of victims didn’t report their scam experience to the police or authorities.
It’s also unclear whether all web hosting companies are equally diligent at reporting sites to the relevant blocklists after being told about the sites by web users.
Find out more:A weak link in the fight against fraud
However, the volume of domains being sold has dropped significantly since that time, and it’s arguable that greater checks could be put in place today.
To set up a copycat website, fraudsters need to use a domain registrar. To take one down, you need to contact a web hosting company. Many companies do both – and yet, at the time of writing, this industry continues to self-regulate.
The UK government is currently consulting on new powers to seize domains being used for criminal purposes.
One of the barriers to change has been the enormous complexity of the industry, which involves a plethora of domain registrars, resellers and hosting companies from the very large – such as GoDaddy – to the very small and obscure, many based outside the UK.
We’ve seen examples of good practice, with scam sites swiftly taken down by hosting companies, and at the other end of the spectrum a total failure to respond to our reports.
Another issue is the lack of attention the industry receives. DNSRF founder Emily Taylor told us the web environment ‘is not sexy or trendy and so it gets forgotten’.
Ultimately, she says, this means ordinary web users have been forgotten: ‘It’s an industry where consumers’ voices aren’t strong, even though it’s consumers who are badly hurt by rogue sites.’
The role of banks
We approached Santander plus the ‘big four’ UK banking groups – Barclays, Lloyds, HSBC and NatWest – to ask them how they approach the problem of copycat websites.
All five responded, confirming they employ tools to monitor for sites maliciously impersonating their brands, and issue takedown requests when they find evidence of such sites.
NatWest Group was particularly candid, explaining that it employs Netcraft, a specialist takedown provider, as well as working directly with internet service providers (ISPs) TalkTalk and BT Group because they are both willing to block fraudulent domains on their networks.
The bank explained that, in most cases, it can’t act purely on the basis of a domain registration containing its brand name, as it may have a legitimate purpose. But the bank will carefully monitor such sites and act to remove them as soon as they go live if they show signs of malicious intent.
NatWest told us it goes further by driving the takedown of scam crypto and investment sites targeting people in the UK, therefore protecting all internet users and not just its own customers. It told us this amounts to about 15,000 sites taken down per month, but this has reached 37,000 at its peak.
Lloyds Bank fraud prevention director Liz Ziegler hinted at her frustration with the domains industry, telling us the process of detecting malicious sites ‘is complex, and the options available to us can be limited. This is why it is vital that tech firms do more to crack down on the criminals using their platforms to impersonate trusted brands.’
Santander cautioned that ‘in many cases these scams start with an SMS phishing text providing a fake link for customers to follow. We’re working with telecoms companies to prevent these at source and would urge customers to never click on links in a text or email purporting to be from their bank or another trusted organisation.’
Barclays warned that customers should 'never disclose their debit card PIN, full telephone banking passcode, full online banking membership number or login details to anyone.'
Find out more:Don't get caught out
To protect yourself when banking online, follow these tips:
Use trusted details:Don’t ignore warnings: Check a site’s birthday:source https://www.which.co.uk/news/article/beware-the-scammers-imitating-bank-websites-al9CB7b4P90g