Phishing Site Takes Brand Impersonation to a Whole New Level Pretending to be FINRA

Most scammers simply grab a company logo, or perhaps a logon page to make it appear like the website used as part of a scam is legitimate. But how about an entire website?

The United States’ Financial Industry Regulatory Authority, better known as FINRA, is a not-for-profit organization authorized by the U.S. government to regulate U.S. Stock Market brokers trading in equities, corporate bonds, securities futures, and options. FINRA recently warned members of a spoofed website that appears to mimic the regulator’s actual website. While not a complete duplicate, the spoofed site (which uses a similar domain name to finra.org, adding an extra “n” to the domain) does appear to contain a working set of subpages designed to make it look legitimate, as shown below.

Can you tell which one of the above sites is the real FINRA? Exactly.

While no phishing campaigns tied to this site have been identified, the site does have a broker registration process that indicates a fee of $2500 USD and does collect personal information that could be used against anyone registering. From what we can tell, there’s nothing overtly malicious about this site, but its’ existence is suspicious at best.

The key to a good scam is found in its establishing of legitimacy. Whether it’s impersonating a customer, your CEO, a known brand, or an employee, if a scam can get the victim to believe the impersonated identity of the scammer, the scammer wins. In this case, anyone accidentally typing in the domain name of the spoofed site may become a victim – not of a scam that can be tied to this domain, but one down the road committed by a scammer that bought the registration details from this domain.

Employees need to be vigilant – not just for the more obvious scams like an invoice that’s an excel spreadsheet (which no one in business would ever send), but also the not-so-obvious ones like duplicate websites. Security Awareness Training educates them on the why and how to maintain security-mindedness even while doing their job.