Fraudsters are cloning bank support pages and talking members into installing remote-access software. Once they’re on the member’s own device, the fraud looks like the member.

The phone rings. The caller says they’re from the bank’s fraud team. There’s suspicious activity on the account, and they need to verify a few things. To make it official, they walk the member to a support page that looks exactly like the real one, read out a verification code, and ask the member to click a button.

That button installs remote-access software. From that moment, the fraudster is sitting at the member’s computer.

BankInfoSecurity reported on Oct. 20 that fraudsters have been running fake versions of banks’ customer support sites since at least March, cloning brands including Barclays, HSBC, Lloyds, Revolut and Santander. The goal: get victims to install legitimate remote-support tools that attackers then use for remote access and account theft.

A help desk built to rob you

The campaign was documented by British threat intelligence firm Lab539. In its Oct. 19 write-up, researcher John Fitzpatrick calls it “a phone-led fraud operation targeting banking customers” and links at least 383 registered domains to the campaign or its supporting infrastructure.

The impersonated brands go well beyond a handful of household names: Allica Bank, Revolut, Barclays, Lloyds, Wise, Santander, NatWest Bankline, HSBC, ANZ and NAB, among others. Both consumers and businesses were targeted.

The design is what makes it work. The cloned pages offer buttons like “Verify Call,” “Live Chat,” “Generate Case ID,” “Security Check” and “Fraud Report.” Clicking one asks for a verification code that the caller supplies. That step makes the process feel like a real bank workflow. Then the download arrives, and the victim is talked through running it.

“Live Chat” delivers the genuine AnyDesk installer. The other options lead to ScreenConnect installations that, per Lab539, give the attacker access that doesn’t depend on the phone call continuing. Some of the files were even signed with valid code-signing certificates, since revoked. As Lab539 put it: “Validly signed software is not the same thing as safe software.”

This isn’t a one-off

Remote-access tools are becoming a standard part of the fraud playbook. Through the first nine months of 2026, Fortra recorded 475% more phishing attacks incorporating remote monitoring and management tools than in all of 2025, according to Fortra’s research as summarized by Campus Technology. Those campaigns targeted North American financial institutions, with particular interest in commercial banking accounts, and AnyDesk was the most common tool.

Earlier this year, the urlscan.io threat research team mapped the same pattern across “live support” scam pages impersonating Chase, Bank of America, US Bank, American Express, PayPal and others: a cold call, a single-purpose support page, a legitimate remote-access download, and then coaching the victim to log in to their bank or approve MFA prompts and payments.

Why your controls may not see it

Here’s the part that should worry every fraud team. When the transfer happens, it comes from the member’s own device, on the member’s own network, often with the member logged in and approving the prompts.

urlscan.io’s researchers spelled out the consequence: because transactions run through the genuine account holder’s account, device and location, “behavioral fraud detection systems often fail to trigger alerts,” and “fraudulent transactions often appear indistinguishable from normal user behavior.”

Device fingerprinting says yes. Location says yes. MFA says yes, because the member approved it. Every gate built around “is this the right person on the right device?” gets the answer it expects. The only thing left that can reveal the fraud is the money itself: where it’s going, how much, how fast, and whether it fits this member’s pattern.

Real-time detection isn’t the same as real-time protection

These attacks unfold during a live phone call. The fraudster is on the line, steering the member, and moving money while the member still believes they’re talking to their bank. The window between the first suspicious transaction and an empty account can be minutes.

An alert that lands in a queue for an analyst to review in the morning doesn’t stop that. It documents it.

The old model: Detect → Alert → Wait for a human.

The model this attack demands: Detect → Assess → Act.

Where RembrandtAi® fits

RembrandtAi® is built for the moment the transaction happens, not the morning after. It ingests events across every channel (card, ACH, remote deposit, online banking, ATM) and scores each one in real time with multi-stage AI, including neural networks, statistical analysis and machine learning scoring. When risk crosses the thresholds your team sets, it acts directly in your banking core: member alerts, card restrictions, transaction blocks, account freezes and access suspension, 24/7/365, with no human in the loop required.

That matters when the login, the device and the MFA approval all check out. RembrandtAi® doesn’t stop judging at the front door. It weighs what’s actually happening in the account, transaction by transaction, so a transfer that breaks from the member’s pattern can be stopped while the fraudster is still on the phone.

Your people stay in charge. They set the thresholds, work the exceptions and call the member back. RembrandtAi® makes sure the money doesn’t leave while they’re getting to it.

The approach has a track record. Launch Credit Union adopted RembrandtAi® at the end of 2020 and saw a 97% reduction in fraudulent transactions, saving $1.8 million in 2021, American Banker reported. As CFO Kevin LeBeau put it: “If you’re uploading three hours later, that money is already gone.”

The takeaway

Fraudsters have stopped trying to break in. They call, they sound like your fraud team, and they get the member to open the door. Once they’re on the member’s own device, the fraud looks like the member.

The defense can’t depend on spotting the intruder at login. It has to catch the money as it moves, and stop it in real time.

AI must move at the speed of payments.

See how RembrandtAi® acts in real time, in your core. Request a demo.

Sources

1. Mathew J. Schwartz, “Fraudsters Clone Bank Support Pages, Urge Victims to Call,” BankInfoSecurity, Oct. 20, 2026. https://www.bankinfosecurity.com/fraudsters-clone-bank-support-pages-urge-victims-to-call-a-33149
2. John Fitzpatrick, “[AnyDesk TAG] AnyDesk and ScreenConnect in a campaign targeting banking customers,” Lab539 AiTM Feed, Oct. 19, 2026. https://www.aitmfeed.com/blog/blog-1/anydesk-tag-anydesk-and-screenconnect-in-a-campaign-targeting-banking-customers-22
3. Fortra, “Phishing attacks are leveraging RMM tools more than ever,” Fortra blog, October 2026. https://www.fortra.com/blog/increase-credential-phishing-remote-management-tools
4. Chris Paoli, “Phishing Attacks Increasingly Exploit Remote Management Tools and AI E-mail Assistants, Reports Find,” Campus Technology, Oct. 13, 2026. https://campustechnology.com/articles/2026/10/13/phishing-attacks-increasingly-exploit-remote-management-tools-and-ai-email-assistants.aspx
5. urlscan.io Threat Research Team, “Remote Access Scams: Structural Analysis of ‘Live Support’ Campaigns,” urlscan.io, Mar. 25, 2026. https://urlscan.io/blog/2026/03/25/LiveSupportScams/
6. “Florida credit union overhauls its fraud prevention with big assist from AI,” American Banker, May 6, 2022. https://www.americanbanker.com/news/ai-revolutionized-how-this-credit-union-prevents-fraud