What Happened
Kela researchers found a bank phishing campaign built to survive takedowns, SecurityWeek reports. The operation has run since May 2026 and spans more than 300 fake domains. Of those, 248 impersonate 189 US financial institutions. The phishing kit logs each visitor’s IP address. A first-time visitor sees a branded login page asking for a user ID and password. A returning visitor sees a “This account has been suspended” notice, so a scanner or takedown provider checking twice concludes the site is dead.
The campaign targets business banking and treasury logins, not personal accounts. Kela counted 49 new domains in the week before October 25. About half used help-desk and live-chat templates, including lookalikes of JPMorgan, Citi, BMO, and Santander. Kela has not found how victims reach the sites.
Why This Matters for Canadian Organizations
BMO is one of Canada’s largest banks, and its name sits on Kela’s lookalike list. Kela names victims in the US, UK, Australia, and New Zealand, not Canada. The naming formula carries to any bank, though. Attackers swap in a new institution name and the Cloudflare layer hides the hosting. Canadian finance teams who run treasury, payroll, and wire portals face the same lure.
A stolen treasury login moves real money, and wire fraud rarely reverses. The fake suspended page also means your own security team or provider is liable to mark a live phishing site as gone. The risk is a false sense of safety.
What to Do
Bookmark every bank portal and tell finance staff to use only those bookmarks. Block newly registered domains with bank keywords such as secure, cancel, and authorize at your DNS filter. Ask your takedown provider to recheck suspect domains from a clean IP and from a different network before closing a case. Require phishing-resistant MFA on treasury accounts and set dual approval on wires. Report suspect domains to your bank and to the Canadian Anti-Fraud Centre. Read more Trends coverage and our latest news.
