Copycat banking websites on the rise - how to spot one

If you think that something’s off about an online banking website or that it looks a bit sketchy, chances are you may be right. With people switching to online banking as more branches close, fraudsters stealing from banking apps and copycat websites are doing the rounds more often. 

Latest Which? research reveals that over 2,000 banking copycat websites pretended to be real banks to steal valuable money from consumers in 2023. The research was done in collaboration with research firm DNS Research Federation, which compiled a list of websites that have been reported with fraudulent content. 

The banks that were most commonly targeted by fraudsters were Barclays and Santander. Other banks that were targeted for these attacks were HSBC, Halifax, Lloyds, Monzo, Nationwide, NatWest and Starling. 

Subscribe to MoneyWeek

Subscribe to MoneyWeek today and get your first six magazine issues absolutely FREE

Get 6 issues free

Sign up to Money Morning

Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter

Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter

Sign up

While banks were being targeted by scammers to steal people’s hard-earned cash, about 2% of consumers think they have fallen for such scams, while 3% remain unsure, according to Which?. 

While a majority of people can identify copycat websites with typos and fake web addresses, there are concerns with AI growing, the number of spelling errors could reduce, which means more people could fall for breach of financial security. 

Rocio Concha, director of policy and advocacy at Which? Said that this was “hugely concerning” to “leave millions of consumers exposed to fraudulent content online”. She added that “consumers who are just trying to bank online should not have to shoulder the responsibility of reporting scam sites and chasing domain registrars to take them down”.

We look at how to spot copycat website scams and what high-street banks are doing to protect your money.  

How to spot banking copycat websites  

We have already seen a rise in Amazon, WhatsApp, romance, crypto and even holiday scams with Easter approaching. But banking copycat websites are finding different ways to scam you out of your money. 

However, there are many ways you can identify a copycat website scam, such as using a domain lookup service or checking for grammatical errors. We have done a roundup of what you can do to avoid falling victim.

Browse the website carefully  

When looking through a banking website that you think might be fake, you should take a couple of minutes to double-check everything. Visit the homepage, the About Us section, the Contact Us section and the Terms and Conditions. Watch out for anything that might give a scam away, or phrases and logos that seem out of place. 

For example, a contact page should always have multiple ways to reach out to the bank, such as email addresses, phone numbers or a form to fill out. Be wary of these and try reaching out to the bank through a trusted number to check whether it is genuine or not. However, if you don’t see any of these, then chances are it may be a copycat website. 

Watch out for spelling errors  

Many scammers use AI to generate text for a fake website or copy and paste information from the original banking website. But how do you differentiate between fake and real? 

One way to do this is by proofreading everything. Does the website have any spelling mistakes? Are they missing words or punctuation? It’s all in the tiny details. However, if the webpage is too large to proofread, you can run it through spell-check sites such as Grammarly for some peace of mind.

Double-check the domain 

Though a copycat website may try to use a domain name similar to the original name of a well-known banking website, there are ways to tell if it's a scam. For example, a website domain which includes words like ‘offers’ or ‘discount’ might be something to avoid. Or, it might say http instead of https, signalling that it isn’t a secure website. 

According to Chase Bank, you should also check whether there’s more than one domain in the web address. The official website clearly states: “You might see something you recognize, like "chase.com." However, there shouldn't be more than one ".com," ".org," ".net," etc. For example, a Chase website wouldn't be “chase.com/bank/account.chase.org." The last domain in the address (chase.org) is incorrect.”

How to report a copycat website

If you think a website is suspicious and is imitating an official banking website, you can report it to The National Cyber Security Centre. Keep in mind that you may have to record the details of the website such as relevant screenshots and URLs in order to report it. Make sure to also contact the bank and let them know about the copycat website.  

What to do if you’ve been scammed  

If you become a victim of a scam or suspect you’re being targeted, you can report it to Action Fraud or call them on 0300 123 2040, available from Monday to Friday between 8am and 8pm.

Let your bank know immediately through the Stop Scams UK website or by dialling 159. You can call them directly, or in case of risk or threat, be sure to dial 999.