When Criminals Copy Your Customer Journey

The imitation is a process, not just a page

A customer receives a message asking them to update account information. The website looks familiar, the wording sounds appropriate and each screen follows logically from the last. Another verification step may make the process feel more secure. Yet the entire interaction can belong to someone else.

Abnormal AI’s Uncovering ZeroTokens research documents this approach in campaigns impersonating financial institutions. One example used a routine tax-document verification request for an Australian brokerage. Copied branding, regulatory details, privacy wording and links to genuine help pages made the imitation resemble an ordinary service interaction.

The report describes more than 1.2 million messages observed across 2,814 of the publisher’s customers between 21 April and 25 September 2026, with 25 banking and brokerage brands impersonated in observed activity. These are message observations within the publisher’s dataset, not counts of confirmed victims or successful account compromises, nor a measure of the campaign’s total global reach.

The business lesson is about how trust is formed: a believable request leads to a familiar page, and the next step reinforces the impression that the customer is dealing with the institution.

A person could decide what happened next

That impression was supported by an interaction the operator could adapt. The captured platform allowed a person to view information submitted to the fraudulent site and choose the next screen. They could request another attempt, present a verification-code prompt or ask for further identity information.

A responsive process can therefore strengthen the deception. A customer may interpret another check as evidence of care, while it gives the operator another opportunity to solicit information.

The findings do not establish what happened afterwards. The researchers did not identify an automated connection to genuine institutions, session-token theft or a mechanism for moving money in the captured platform. Subsequent use of collected information at real institutions and resulting financial losses were not directly confirmed. The evidence supports a fraudulent collection process, rather than a claim that the impersonated institutions’ systems were breached.

Give customers a way to verify the real request

If appearance and responsiveness can be copied, customers need a check that does not depend on either. Start with your genuine service: can someone independently confirm an account-review request through your official app, a known website or a published contact route?

Where possible, make the same request available after customers sign in through that trusted route. Be consistent about where document updates and identity checks take place. Legitimate messages that routinely send people to unfamiliar websites can make a fraudulent request harder to distinguish.

Explain what customers should expect from security checks, including when staff will never ask them to disclose a code or approve an unexpected login. Authentication should also reduce reliance on customers spotting a convincing imitation. FIDO Alliance’s passkey guidance explains how authentication bound to the genuine service resists phishing, while highlighting the importance of fallback and account-recovery methods. A stronger login option does not close a weaker alternative that remains available.

These measures strengthen the genuine journey. They also need to be informed by what criminals are currently doing outside it.

Build a current picture of threats against your brand

An institution should not have to rely solely on customer complaints to learn how its identity is being misused. Brand monitoring can provide an early-warning radar by looking for copied service pages and fraudulent communications as well as suspicious domains. Monitoring only misspellings of the brand name leaves gaps: an unrelated address can still host a convincing imitation.

A finding becomes useful when it is validated. Establish what the site displays, what it asks people to submit and how it is being promoted. A registered domain and an active page collecting credentials are different findings. Preserve the full address, relevant screenshots and the original message so the evidence can support action.

Disruption may involve a hosting provider, domain registrar or message platform. ICANN’s abuse-reporting guide stresses clear evidence and reporting to the appropriate party first. Its escalation process applies to contracted registrars and registries for generic domains. Target the abusive site or account, rather than treating the shared provider as malicious.

Turn that evidence into timely customer advice

The same evidence should shape communications while the threat is developing. Where detection comes early enough, warnings may reach customers before the fraudulent request does. Monitoring cannot guarantee that timing, but it creates an opportunity to prepare customers rather than only help them after disclosure.

Make the advice specific to the approach being used. A general warning about phishing may not interrupt a believable account-review process. A notice explaining how to check that particular request gives the customer a practical next step.

Use that wording only where the app genuinely provides those functions; otherwise name the trusted routes your service offers. Put the notice where customers already look for confirmation, brief support staff and update the advice as the imitation changes. Avoid including a clickable link to the fraudulent site.

Keep claims proportionate to the evidence. A copied portal supports a warning about impersonation. It does not, on its own, establish compromised accounts or financial losses.

Keep the response going after the first action

Some customers may already have engaged. Establish what they disclosed or approved, then connect them to the appropriate security and fraud response. A password reset alone may not address exposed identity documents, payment details or an unexpected app approval. Customer support needs a clear escalation route and advice matched to the information involved.

The external threat may also return. The ZeroTokens report describes operators rebuilding their control infrastructure within roughly 20 hours of a registry hold. That does not show that every fraudulent site returned at once, but it demonstrates why one intervention should not be treated as the end of an operation.

The useful outcome is a continuing connection between what the organisation detects and how it protects customers: validate the imitation, inform customers, seek disruption and adjust as new evidence emerges.

CyberSolace’s digital brand protection monitoring can form part of that approach. To discuss how current threats against your brand can inform customer protection, get in touch.