Search
Register
01
Leave a Comment
Comments are moderated and will appear after review.
TEK EXPLAINED // OPEN CASEFILE NO. 0426-PH
◆ CASE FILE: PHISHING
How a phishing scam actually works.
A fake GTBank text. A cloned Access Bank login page. One tap, and your account is gone. We opened the file and broke down every stage of the trick, so you can recognize it before it works on you.
SPOOFED SENDER
CLONED PAGE
FORGED URL
CREDENTIAL LOSS
open the file
EXHIBIT ASTAGE 01
◆ THE BAIT
It starts with manufactured panic.
Scammers don't guess. They engineer urgency. A message timed right, worded right, with no room left to think before you react.
FORGED
GTBank Alert, SMS
Dear Customer, your account will be LIMITED in 24hrs due to unusual activity. Verify your details now to avoid suspension: gtbank-secure-verify.com
A-1
Fear & urgency
"Account will be blocked," "unauthorized login detected": built to make you act before you verify.
A-2
Spoofed sender ID
The message can land inside your real bank's existing thread, since sender-ID spoofing fools the grouping on your phone.
A-3
Mass or targeted
Sent to thousands at once, or aimed at one person using details pulled from a previous data breach.
EXHIBIT BSTAGE 02
◆ THE FORGED URL
One character is all it takes.
The link only needs to survive a glance. That's the whole design goal: not a perfect match, just a convincing one.
✓ the real domain
🔒gtbank.com
✕ the spoofed clone
⚠️gtbank-secure-verify.com
✕ another common trick
⚠️accessbank.com-ng.info
How it's built: a cheap look-alike domain gets registered, sometimes with a free SSL certificate so it still shows a padlock, then hosted on a server that gets swapped out fast once it's reported.
EXHIBIT CSTAGE 03
◆ THE CLONE PAGE
A copy of trust itself.
The fake login page is often lifted straight from the real bank's site: same logo, same layout, same colors. Only where the form sends your data is different.
✓ real bank site
GTBank
submits to gtbank.com
✕ cloned page
GTBank
submits to attacker's server
C-1
Source code theft
Anyone can "view source" on a real bank page and save the HTML/CSS; the visual layer is never the hard part.
C-2
Form action swap
Only one line of code changes: where the login form sends your username and PIN when you press submit.
EXHIBIT DSTAGE 04
◆ THE HARVEST
From tap to stolen account.
00:00
You tap the link in the SMS
spoofed domain00:02
Cloned login page loads
identical UI00:14
You enter username, PIN, OTP
form captured00:15
Details sent straight to the attacker
real-time log00:16
You're quietly redirected to the real bank site
no alarm raised
The quiet redirect is the final trick. You land on the genuine site looking normal, so you assume nothing went wrong. By then, the attacker is already logging in elsewhere with your details.
FIELD GUIDECASE CLOSED
◆ PROTECT YOURSELF
Spot it before you tap.
Never tap links in unsolicited bank SMS or WhatsApp messages. Open your banking app directly or type the URL yourself.
Check the domain character by character before entering anything: "gtbank-secure-verify.com" is not gtbank.com.
Real banks never ask for your full PIN or OTP through a link. Treat any page that does as compromised.
If you ever enter details on a suspicious page, change your PIN and call your bank immediately; speed matters more than embarrassment.
Want to learn how tech really works?
Visit the Academy →
Join the Discussion