Which?, the consumer watchdog, is warning consumers to be wary of fraudulent banking websites after finding a myriad of scam sites.

Its research found more then 2,000 websites imitating UK banks were reported just in 2023 alone.

These copycat websites can play a crucial role in scamming unsuspecting users. Fraudsters can use the fake websites to collect personal banking details like account numbers and sort codes, which they can later use to con those same people into sending them money, often posing as bank staff.

Though banks do attempt to get lookalike websites taken down, the sheer number of registered websites, and sometimes the inadequate response from firms, means that these sites are up long enough to find and exploit victims.

Which? partnered with the DNSRF, a non-profit that performs data-driven policy research on domain names and internet governance, to delve the scale of the pernicious practice.

By consulting industry blocklists – lists of websites that have been reported as hosting illegal content – and cross-referencing these with the names of common bank brands, the team could discover potential copycate domain names.

For instance, by searching for domain names containing HSBC, the researchers could find fraudulent websites that attempting to pose as the bank, such as helphsbc.net

Researchers did this method with a number of banks, including: AIB (Allied Irish Banks), Barclays, Bank of Scotland, The Co-Operative Bank, Danske Bank, First Direct, HSBC, Halifax, Lloyds, Metro Bank, Monzo, Nationwide, NatWest, RBS, Santander, Starling, TSB, Ulster Bank and Virgin Money/Clydesdale.

This is how the partnership discovered more than 2,000 URLS masquerading as UK banks, including Barclays, HSBC, Halifax, Lloyds, Monzo, Nationwide, NatWest, Santander and Starling.

Further, the majority of the sites in the raw data appear to be blatant attempts to lead bank customers astray, sometimes only containing minor mis-spellings that could go unnoticed.

DNSRF also examined another blocklist, run by Scamadviser.com, this time also finding more than 2,000 URLs containing the names of the bank brands. This group included the same brands as the phishing blocklist, with the addition of Clydesdale.

Across both blocklists, the words Santander and Barclays appeared the most.

Which? did provide some concessions to their data – for instance, TSB was excluded from the results as the string of letters was too common.

Further, they could not check if the websites were actually fraudulent as they have already been taken down; equally, their research could have missed many copycat websites which were not already flagged in blocklists.

Recommended reading

• FinTech Scotland and Scottish Friendly Announce Strategic Partnership
• New Payments Innovations Report Highlights Sector’s Failures/Successes
• Fighting Fraud with AI in FinTech and Beyond

The Weakest Link?

In the fight against fraud, it seems like the existence of a plethora of scam websites is a battleground that has been largely left for fraudsters to exploit.

Which? did confirm with several banks mentioned in the study, including Barclays, Lloyds, HSBC, and NatWest, to confirm that they employ monitoring tools to scan for malicious scam sites, and issue takedown requests when they find evidence of tehse sites.

The domain name industry itself, remains largely self-regulated. Users can create domain names, and it is up to consumers to contact a web hosting company to take down one suspected of being fraudulent.

While the UK government is currently consulting on how to seize control of domains being used for criminal purposes, the complexity of the industry, and its many stakeholders, makes regulation difficult.

“It’s an industry where consumers’ voices aren’t strong, even though it’s consumers who are badly hurt by rogue sites,” Emily Taylor, founder of DNSRF said.

NatWest said that their process takes down around fraudulent sites 15,000 sites per month, which has peaked at 37,000.