PhishPin / Brands Live Phishing Data / Banks & lenders
Banks & lenders phishing: which brands are copied the most
105 banks & lenders brands are tracked in PhishPin's index. Together they have 6,855 hostnames in phishing feeds and 292 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated banks & lenders
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | Wells Fargo | 17% | 62 · High | 1,165 | 2 |
| 2 | Chase | 6% | 59 · High | 444 | 6 |
| 3 | Santander Bank US | 6% | 58 · High | 429 | 5 |
| 4 | Sparkasse | 6% | 58 · High | 399 | 6 |
| 5 | Bancolombia | 5% | 47 · Elevated | 356 | 0 |
| 6 | Lloyds Bank | 5% | 56 · High | 323 | 5 |
| 7 | DBS Bank | 4% | 49 · Elevated | 294 | 1 |
| 8 | HSBC USA | 4% | 52 · Elevated | 280 | 3 |
| 9 | MUFG | 4% | 45 · Elevated | 279 | 0 |
| 10 | Bradesco | 4% | 56 · High | 262 | 7 |
| 11 | Halifax | 3% | 43 · Elevated | 239 | 0 |
| 12 | Commonwealth Bank (CommBank) | 3% | 42 · Elevated | 203 | 0 |
| 13 | Citibank | 3% | 52 · Elevated | 177 | 6 |
| 14 | ING | 2% | 47 · Elevated | 149 | 3 |
| 15 | Bank of America | 2% | 52 · Elevated | 142 | 9 |
| 16 | Crédit Agricole | 2% | 39 · Elevated | 134 | 0 |
| 17 | BBVA | 1% | 48 · Elevated | 94 | 8 |
| 18 | TSB | 1% | 43 · Elevated | 86 | 3 |
| 19 | Caixa Econômica Federal | 1% | 39 · Elevated | 80 | 1 |
| 20 | USAA | 1% | 49 · Elevated | 74 | 14 |
| 21 | NatWest | 1% | 41 · Elevated | 68 | 3 |
| 22 | Scotiabank | 1% | 40 · Elevated | 68 | 2 |
| 23 | Intesa Sanpaolo | 1% | 41 · Elevated | 67 | 3 |
| 24 | Itaú | 1% | 33 · Moderate | 67 | 0 |
| 25 | Charles Schwab | 1% | 46 · Elevated | 58 | 11 |
| 26 | Société Générale | 1% | 32 · Moderate | 57 | 0 |
| 27 | Nordea | 1% | 43 · Elevated | 47 | 8 |
| 28 | NAB | 1% | 35 · Elevated | 47 | 1 |
| 29 | BNP Paribas | 1% | 38 · Elevated | 46 | 3 |
| 30 | RBC Royal Bank | 1% | 34 · Moderate | 35 | 2 |
| 31 | Capital One | 0% | 36 · Elevated | 34 | 3 |
| 32 | ANZ | 0% | 28 · Moderate | 34 | 0 |
| 33 | American Express | 0% | 39 · Elevated | 33 | 7 |
| 34 | CIMB | 0% | 37 · Elevated | 29 | 5 |
| 35 | CIBC | 0% | 36 · Elevated | 28 | 4 |
| 36 | Commerzbank | 0% | 27 · Moderate | 28 | 0 |
| 37 | Mizuho | 0% | 30 · Moderate | 27 | 1 |
| 38 | UniCredit | 0% | 30 · Moderate | 27 | 1 |
| 39 | CaixaBank | 0% | 26 · Moderate | 27 | 0 |
| 40 | Citizens Bank | 0% | 26 · Moderate | 25 | 0 |
| 41 | Discover | 0% | 39 · Elevated | 22 | 13 |
| 42 | UBS | 0% | 33 · Moderate | 22 | 3 |
| 43 | ABN AMRO | 0% | 25 · Moderate | 21 | 0 |
| 44 | Navy Federal Credit Union | 0% | 25 · Moderate | 21 | 0 |
| 45 | Rabobank | 0% | 25 · Moderate | 21 | 0 |
| 46 | Deutsche Bank | 0% | 28 · Moderate | 19 | 1 |
| 47 | Fifth Third Bank | 0% | 28 · Moderate | 19 | 1 |
| 48 | Huntington Bank | 0% | 28 · Moderate | 19 | 1 |
| 49 | KeyBank | 0% | 29 · Moderate | 18 | 2 |
| 50 | Truist | 0% | 31 · Moderate | 17 | 3 |
| 51 | Desjardins | 0% | 32 · Moderate | 13 | 6 |
| 52 | Westpac | 0% | 21 · Moderate | 13 | 0 |
| 53 | Barclays US | 0% | 20 · Moderate | 12 | 0 |
| 54 | Swedbank | 0% | 20 · Moderate | 12 | 0 |
| 55 | U.S. Bank | 0% | 32 · Moderate | 11 | 8 |
| 56 | HDFC Bank | 0% | 29 · Moderate | 11 | 4 |
| 57 | TD Bank | 0% | 23 · Moderate | 10 | 1 |
| 58 | N26 | 0% | 19 · Moderate | 10 | 0 |
| 59 | PNC Bank | 0% | 26 · Moderate | 9 | 3 |
| 60 | Nubank | 0% | 18 · Moderate | 9 | 0 |
| 61 | BMO | 0% | 29 · Moderate | 8 | 7 |
| 62 | ICICI Bank | 0% | 29 · Moderate | 7 | 8 |
| 63 | Axis Bank | 0% | 15 · Moderate | 6 | 0 |
| 64 | Danske Bank | 0% | 15 · Moderate | 6 | 0 |
| 65 | Bank Central Asia (BCA) | 0% | 24 · Moderate | 5 | 5 |
| 66 | ICBC | 0% | 24 · Moderate | 5 | 5 |
| 67 | Fidelity Investments | 0% | 23 · Moderate | 5 | 4 |
| 68 | OCBC | 0% | 23 · Moderate | 5 | 4 |
| 69 | Kotak Mahindra Bank | 0% | 25 · Moderate | 4 | 8 |
| 70 | State Bank of India (SBI) | 0% | 22 · Moderate | 4 | 4 |
| 71 | Maybank | 0% | 17 · Moderate | 4 | 1 |
| 72 | Capitec | 0% | 20 · Moderate | 3 | 4 |
| 73 | First Citizens Bank | 0% | 15 · Moderate | 3 | 1 |
| 74 | Emirates NBD | 0% | 11 · Low | 3 | 0 |
| 75 | Standard Bank | 0% | 11 · Low | 3 | 0 |
| 76 | Vanguard | 0% | 21 · Moderate | 2 | 9 |
| 77 | Nelnet | 0% | 16 · Moderate | 2 | 3 |
| 78 | Bank Mandiri | 0% | 13 · Low | 2 | 1 |
| 79 | Macquarie | 0% | 13 · Low | 2 | 1 |
| 80 | BPI | 0% | 18 · Moderate | 1 | 8 |
| 81 | Ally Bank | 0% | 15 · Moderate | 1 | 5 |
| 82 | Synchrony Bank | 0% | 15 · Moderate | 1 | 5 |
| 83 | Banco do Brasil | 0% | 5 · Low | 1 | 0 |
| 84 | Edward Jones | 0% | 5 · Low | 1 | 0 |
| 85 | Morgan Stanley | 0% | 5 · Low | 1 | 0 |
| 86 | FNB South Africa | 0% | 12 · Low | 0 | 8 |
| 87 | SoFi | 0% | 10 · Low | 0 | 5 |
| 88 | Merrill | 0% | 9 · Low | 0 | 4 |
| 89 | E*TRADE | 0% | 8 · Low | 0 | 3 |
| 90 | GTBank | 0% | 8 · Low | 0 | 3 |
| 91 | Al Rajhi Bank | 0% | 6 · Low | 0 | 2 |
| 92 | Bank of Baroda | 0% | 4 · Low | 0 | 1 |
| 93 | First Abu Dhabi Bank | 0% | 4 · Low | 0 | 1 |
| 94 | Monzo | 0% | 4 · Low | 0 | 1 |
| 95 | Sallie Mae | 0% | 4 · Low | 0 | 1 |
| 96 | Varo Bank | 0% | 4 · Low | 0 | 1 |
| 97 | Ameriprise Financial | 0% | 0 · Low | 0 | 0 |
| 98 | Bank of China | 0% | 0 · Low | 0 | 0 |
| 99 | Mr. Cooper | 0% | 0 · Low | 0 | 0 |
| 100 | Navient | 0% | 0 · Low | 0 | 0 |
| 101 | PenFed Credit Union | 0% | 0 · Low | 0 | 0 |
| 102 | Punjab National Bank | 0% | 0 · Low | 0 | 0 |
| 103 | Regions Bank | 0% | 0 · Low | 0 | 0 |
| 104 | Rocket Mortgage | 0% | 0 · Low | 0 | 0 |
| 105 | Starling Bank | 0% | 0 · Low | 0 | 0 |
Common lures against banks & lenders
- A "suspicious sign-in" or "account locked" alert that asks you to verify your login.
- A fake fraud-department text asking you to confirm a transaction you never made.
- A "new statement" or "secure message" email linking to a cloned online-banking page.
- A phone call or SMS that sends you to a page asking for your card number, PIN and one-time code.
Red flags
- The sender domain is not the bank's real domain, or is the real name with extra words (secure, login, verify) added.
- The message creates urgency: your account will be closed, frozen or charged in the next few hours.
- The page asks for a one-time passcode, full card number, PIN or SSN, which a real bank never requests by link.
If you already clicked or entered details
Call the number printed on the back of your card, lock the card, change your online-banking password from a clean device, and ask the bank to review recent activity. If you shared a one-time code, treat the account as compromised.
Is your bank being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which banks & lenders brands are impersonated the most?
Wells Fargo leads with 1,165 hostnames in phishing feeds, followed by Chase (444) as of 2 Nov 2026.
How can I spot phishing that targets banks & lenders?
The sender domain is not the bank's real domain, or is the real name with extra words (secure, login, verify) added. The message creates urgency: your account will be closed, frozen or charged in the next few hours. The page asks for a one-time passcode, full card number, PIN or SSN, which a real bank never requests by link.
What should I do if I fall for a fake bank page?
Call the number printed on the back of your card, lock the card, change your online-banking password from a clean device, and ask the bank to review recent activity. If you shared a one-time code, treat the account as compromised.