Phishing Site Takes Brand Impersonation to a Whole New Level Pretending to be FINRA



phishing brand impersonationMost scammers simply grab a company logo, or perhaps a logon page to make it appear like the website used as part of a scam is legitimate. But how about an entire website?

The United States’ Financial Industry Regulatory Authority, better known as FINRA, is a not-for-profit organization authorized by the U.S. government to regulate U.S. Stock Market brokers trading in equities, corporate bonds, securities futures, and options. FINRA recently warned members of a spoofed website that appears to mimic the regulator’s actual website. While not a complete duplicate, the spoofed site (which uses a similar domain name to finra.org, adding an extra “n” to the domain) does appear to contain a working set of subpages designed to make it look legitimate, as shown below.

FINRA phishing screenshot

Can you tell which one of the above sites is the real FINRA? Exactly.

While no phishing campaigns tied to this site have been identified, the site does have a broker registration process that indicates a fee of $2500 USD and does collect personal information that could be used against anyone registering. From what we can tell, there’s nothing overtly malicious about this site, but its’ existence is suspicious at best.

The key to a good scam is found in its establishing of legitimacy. Whether it’s impersonating a customer, your CEO, a known brand, or an employee, if a scam can get the victim to believe the impersonated identity of the scammer, the scammer wins. In this case, anyone accidentally typing in the domain name of the spoofed site may become a victim – not of a scam that can be tied to this domain, but one down the road committed by a scammer that bought the registration details from this domain.

Employees need to be vigilant – not just for the more obvious scams like an invoice that’s an excel spreadsheet (which no one in business would ever send), but also the not-so-obvious ones like duplicate websites. Security Awareness Training educates them on the why and how to maintain security-mindedness even while doing their job.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Subscribe To Our Blog


New call-to-action




Get the latest about social engineering

Subscribe to CyberheistNews