PhishPin / Brands Live Phishing Data / Payments, fintech & credit
Payments, fintech & credit phishing: which brands are copied the most
50 payments, fintech & credit brands are tracked in PhishPin's index. Together they have 1,919 hostnames in phishing feeds and 118 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated payments, fintech & credit
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | PayPal | 47% | 68 · High | 902 | 12 |
| 2 | Robinhood | 25% | 63 · High | 487 | 11 |
| 3 | Interac | 12% | 52 · Elevated | 233 | 4 |
| 4 | Cash App | 2% | 43 · Elevated | 43 | 10 |
| 5 | Mercado Pago | 2% | 35 · Elevated | 36 | 2 |
| 6 | TWINT | 1% | 30 · Moderate | 26 | 1 |
| 7 | Zelle | 1% | 42 · Elevated | 24 | 18 |
| 8 | MobilePay | 1% | 28 · Moderate | 21 | 1 |
| 9 | Wise (TransferWise) | 1% | 24 · Moderate | 19 | 0 |
| 10 | Western Union | 1% | 23 · Moderate | 18 | 0 |
| 11 | Vipps | 1% | 22 · Moderate | 15 | 0 |
| 12 | Mastercard | 1% | 28 · Moderate | 12 | 3 |
| 13 | Square | 1% | 20 · Moderate | 12 | 0 |
| 14 | PayU | 1% | 26 · Moderate | 11 | 2 |
| 15 | Stripe | 1% | 27 · Moderate | 10 | 3 |
| 16 | Klarna | 0% | 29 · Moderate | 6 | 10 |
| 17 | QuickBooks | 0% | 25 · Moderate | 6 | 5 |
| 18 | Xoom | 0% | 21 · Moderate | 6 | 2 |
| 19 | Chime | 0% | 14 · Low | 5 | 0 |
| 20 | eToro | 0% | 17 · Moderate | 4 | 1 |
| 21 | Revolut | 0% | 17 · Moderate | 3 | 2 |
| 22 | Experian | 0% | 15 · Moderate | 3 | 1 |
| 23 | Plaid | 0% | 15 · Moderate | 3 | 1 |
| 24 | BHIM UPI (NPCI) | 0% | 15 · Moderate | 2 | 2 |
| 25 | Neteller | 0% | 13 · Low | 2 | 1 |
| 26 | Affirm | 0% | 9 · Low | 2 | 0 |
| 27 | GCash | 0% | 9 · Low | 2 | 0 |
| 28 | Alipay | 0% | 15 · Moderate | 1 | 5 |
| 29 | PhonePe | 0% | 12 · Low | 1 | 2 |
| 30 | Skrill | 0% | 12 · Low | 1 | 2 |
| 31 | SumUp | 0% | 9 · Low | 1 | 1 |
| 32 | Flutterwave | 0% | 5 · Low | 1 | 0 |
| 33 | Paytm | 0% | 5 · Low | 1 | 0 |
| 34 | Paystack | 0% | 9 · Low | 0 | 4 |
| 35 | paysafecard | 0% | 9 · Low | 0 | 4 |
| 36 | Remitly | 0% | 6 · Low | 0 | 2 |
| 37 | TransUnion | 0% | 6 · Low | 0 | 2 |
| 38 | Bizum | 0% | 4 · Low | 0 | 1 |
| 39 | Equifax | 0% | 4 · Low | 0 | 1 |
| 40 | MobiKwik | 0% | 4 · Low | 0 | 1 |
| 41 | Razorpay | 0% | 4 · Low | 0 | 1 |
| 42 | Adyen | 0% | 0 · Low | 0 | 0 |
| 43 | Afterpay | 0% | 0 · Low | 0 | 0 |
| 44 | Credit Karma | 0% | 0 · Low | 0 | 0 |
| 45 | M-Pesa | 0% | 0 · Low | 0 | 0 |
| 46 | MoneyGram | 0% | 0 · Low | 0 | 0 |
| 47 | Payoneer | 0% | 0 · Low | 0 | 0 |
| 48 | TurboTax | 0% | 0 · Low | 0 | 0 |
| 49 | Venmo | 0% | 0 · Low | 0 | 0 |
| 50 | WorldRemit | 0% | 0 · Low | 0 | 0 |
Common lures against payments, fintech & credit
- A "payment received" or "payment on hold" email with a button to log in and release the funds.
- A fake invoice or receipt for an item you never bought, with a phone number to "dispute" it.
- A security alert saying your account has been limited until you confirm your identity.
- A request-money notification that links to a cloned login page.
Red flags
- Receipts for things you did not buy, or amounts that are unusually large, are the bait.
- The link does not go to the official domain, even if the visible text looks right.
- You are asked to pay, "verify" or move money to a "safe account".
If you already clicked or entered details
Log in by typing the official address yourself (never from the message), check recent activity, remove unknown linked cards or devices, change the password, and turn on app-based two-factor authentication. Contact the provider through its official site.
Is your payments company being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which payments, fintech & credit brands are impersonated the most?
PayPal leads with 902 hostnames in phishing feeds, followed by Robinhood (487) as of 1 Nov 2026.
How can I spot phishing that targets payments, fintech & credit?
Receipts for things you did not buy, or amounts that are unusually large, are the bait. The link does not go to the official domain, even if the visible text looks right. You are asked to pay, "verify" or move money to a "safe account".
What should I do if I fall for a fake payments company page?
Log in by typing the official address yourself (never from the message), check recent activity, remove unknown linked cards or devices, change the password, and turn on app-based two-factor authentication. Contact the provider through its official site.