The Weekly Breach Breakdown Podcast: Fake Bank Alert - The Hotline Scam Exposed - S7E34

Welcome to the Identity Theft Resource Center’s Weekly Breach Breakdown for Friday, Nov. 6, 2026. I’m Tatiana Cuadras, Communications Assistant for the ITRC. Thanks to SentiLink for their continued support of this podcast and the ITRC.

Each week, we look at the most recent events and trends related to data security and privacy. This week, we're discussing a fake bank scam, which is essentially a phone-led fraud campaign targeting banking customers. This one involves fake bank websites, convincing phone conversations and remote-access software that can give criminals control of your computer. Here’s exactly how identity criminals are cloning bank support pages.

Let's get into it. Imagine receiving an email about a suspicious charge, an invoice or a potential issue with your bank. They look legitimate, so naturally, you follow the instructions and call the phone number provided. Someone answers; they sound professional and claim that they're from your bank to help.

They may even direct you to what looks like your bank's official support website. Everything looks real. But there's a catch: you're not actually talking to a representative from your bank. You're talking to a fraudster operating a fake call center.

According to an article by Bank Info Security , a report from British threat intelligence firm Lab539 shows that this campaign has reportedly been active since at least March, with more than 380 registered domains connected to the fake support websites and related infrastructure. Some of the financial institutions being impersonated include Barclays, HSBC, Lloyds, Revolut and Santander. And these fraudsters aren't creating poorly designed websites with misspelled words and suspicious-looking logos; they are creating convincing copies of legitimate bank support pages, designed to make victims feel like they're interacting with their actual bank. How does the scam work?

Researchers believe criminals are using a technique called telephone-oriented attack delivery, or TOAD. Instead of calling victims directly, they trick people into calling the identity criminals themselves. For example, someone might receive an email about a fake invoice with a phone number to contact customer support. Once the victim calls, they're then directed to a cloned bank support website.

Lab539 found that these fake websites include buttons like "Live Chat," "Verify Call" and "Fraud Report" that aren't found on the legitimate bank websites. Clicking them and following the instructions from the person on the phone can trigger downloads of software that gives criminals remote access to the victim's computer. By combining realistic bank websites, convincing phone conversations, and familiar software, criminals are making it harder for victims to recognize when they're being scammed. For example, clicking "Live Chat" can download AnyDesk, a legitimate program that is normally used for remote computer support.

Victims are then instructed to open it and allow the person on the phone to connect to their computer. Researchers also found a file called "FraudReport.zip" that installs another remote-access program called ScreenConnect. Here's what makes this tricky: AnyDesk and ScreenConnect are legitimate programs that many of us have used before. Identity criminals are simply using familiar software to make their requests seem trustworthy and convince victims to give them access to their devices.

The big takeaway here is that a familiar bank logo, a professional-sounding representative or a website that looks real doesn't necessarily mean you're dealing with your actual bank. Sometimes, the software itself is legitimate. It's the person telling you to install it who isn't. Knowing how fraudsters clone bank support pages is the first step to avoiding a fake bank scam.

Here’s some good news. On Oct. 9, researchers had two of the criminals’ digital “trust badges” canceled, so they can’t be used again. But the harmful files themselves are still out there and can still be downloaded and opened, so the attack could still happen again.

Contact the ITRC If you want to learn more about protecting your personal information, or if you think you have been a victim of a fake bank scam, you can get free, one-on-one help from an expert ITRC advisor. Call or text the ITRC at 888.400.5530 , or chat with us live on our website at idtheftcenter.org . Thanks again to SentiLink for their continued support of the ITRC and this podcast . Please hit the like button for this episode, and subscribe wherever you listen to podcasts.

We'll be back next week with another episode of the Weekly Breach Breakdown. I'm Tatiana Cuadras. Until then, thanks for listening.