How does Unphish help with the Scams Prevention Framework?

The draft codes include taking steps to stop your brand being used in impersonation scams, such as monitoring for it and seeking its removal. Unphish monitors for fakes, takes them down and keeps evidence for every action. Check your specific obligations with your legal team.

Book a demo ☰

Banking and financial services

Scams that trade on your customers' trust.

Cloned login pages, fake fraud teams, copied banking apps and fake investment profiles all trade on a financial brand's name. Unphish finds them across the web, social media, app stores and messaging, and gets them taken down.

Book a demo Request a takedown

Impersonation watchExample feed

TimeThreatWhereStatus

08:47Cloned login pagesolsticepay-secure.topWebsiteRemoved
09:15Fake fraud team@SolsticePay_HelpXRemoved
09:58Investing club profileSolstice Pay Investing ClubFacebookRemoved
10:22Fake support number1800 xxx 207 in a PDFPDFReported
11:06Copied banking appSolstice Pay 5.2 APKAPK siteRemoved
11:40Customer logins for salePrivate channelTelegramChecking

100%taken down

Of the threats we pursued for financial services clients, January to June 2026.

The customer journey

Where scammers meet your customers.

Scams turn up at every step of a customer's relationship with you. Pick a stage to see what they look like and where they lead.

SponsoredSolstice Pay Term Deposits | 6.2% p.a. Guaranteedsolstice-pay-deposits.comCompare rates and open an account today. Call 1800 xxx 207 to lock in your rate.

Search and sign up

Fake ads, rate comparisons and lookalike sites.

Scammers buy search ads and build lookalike sites that promise better rates than anyone else. Customers “open an account”, hand over ID and transfer money that goes straight to the scammer.

Term deposit and savings rates that are too good to be true
Comparison sites that use your name and logo
Phone numbers that aren’t yours

Scams →Brand abuse →

Text messageSolstice Pay: unusual sign-in from a new device. If this wasn’t you, verify your account at solsticepay-secure.top

Logging in

Security alert texts and cloned login pages.

Fake security alerts push customers to copies of your login page. Once they enter their details and one-time code, the scammer is in their account.

99%of the phishing sites we pursued across all our clients were taken down.

Phishing →Smishing →

Solstice Pay 5.2 APKapk-mirror-store.netBanking, cards and transfers. Faster login. No app store needed.

Banking app

Copied banking apps on download sites.

Copies of banking and investing apps turn up on third-party stores and APK sites, sometimes linked from texts. They capture logins or give scammers remote access to the phone.

Your app on unofficial download sites
“Update your app” links in texts
Apps asking for remote access or screen sharing

Fake apps →Remote access scams →

Sam@SolsticePay my card’s been blocked and I can’t get through to anyone

Solstice Pay Support@SolsticePay_HelpHi Sam, we can fix this now. Call our fraud team on 1800 xxx 207 and keep your app open.

Getting help

Fake support accounts and phone numbers.

Fake “support” accounts reply to customers who complain online, and fake numbers are planted where people search for help. The call ends with a request to move money to a “safe account”.

New accounts replying to complaints
Support numbers in PDFs, forums and listings
Requests to move money or share codes

Social media →Vishing →

Facebook postSolstice Pay Investing ClubFree share trading course with our senior analyst. Limited spots. Message us to join the private WhatsApp group.

Investing

Fake investment profiles and trading clubs.

Fake profiles copy investment and wealth brands, or the people who front them, to offer trading courses and tips. Victims are moved to WhatsApp or Telegram and talked into fake investments.

77%of the threats we pursued for financial services clients were fake social media profiles.

Executive impersonation →Investment scams →

Private channelFresh LogsSOLSTICE PAY | customer logins + staff VPN access. Sample below.

Behind the scenes

Leaked data and stolen logins.

Customer details and staff logins are sold on breach forums and private channels, then used to make scam calls and messages more convincing.

Your name on leak and breach posts
Customer logins or card details for sale
Staff or contractor access for sale

Dark and deep web →Phishing →

How it works

Up and running in three steps.

solsticepay.com@SolsticePaySolstice Pay appSolstice InvestLetter of authority ✓

Step 1

Tell us what’s yours

Share your brand names, official domains, social accounts and app listings, plus a letter of authority so we can act on your behalf.

Web and domains
Social media
App stores
Messaging

Step 2

We watch around the clock

We monitor the web, social media, app stores and messaging channels for fakes. Tell us about new products or campaigns and we’ll watch more closely.

solsticepay-secure.topCloned login page

Successfully suspendedEvidence and outcome in your portal

Step 3

We take them down

Every find is checked, then reported to the platform, host or registrar with evidence. You see each case and its outcome in the Unphish portal.

By the numbers

What we see for financial services brands.

Threats we pursued for financial services clients, plus our results across all clients, January to June 2026.

100%

of the threats we pursued for financial services clients were taken down

77%

were fake social media profiles using the brand’s name

99%

of the phishing sites we pursued across all our clients were taken down

99%

of the impersonation accounts we pursued on Facebook, X and Instagram were removed

Where we found them

Social mediaFake brand and investing profiles77%
Phishing and lookalike sitesLogins, deposits, rates14%
Apps and phone numbersCopied apps, fake support lines9%

For financial brands, most fakes start on social media, where fake profiles copy the brand to offer tips, courses or support.

Where fake profiles showed up

Facebook88%
Instagram12%

Share of the social media threats we pursued for financial services clients. Most offered investment tips, trading courses or support.

The bigger picture in Australia

$837.7m

lost to investment scams in 2025, the biggest loss of any scam type

$97.6m

lost to phishing scams in 2025

$69.9m

lost to remote access scams in 2025

Source: ACCC, Targeting Scams report on 2025, released March 2026.

Unphish figures: cases for financial services clients, and for all clients where stated, January to June 2026. Takedown rate excludes cases closed for other reasons, such as at the client’s request. Figures are rounded.

Scams Prevention Framework

Scam protection is becoming law for Australian banks.

The Scams Prevention Framework makes stopping scams an enforceable obligation for banks, telcos and digital platforms. Most obligations start on 31 March 2027. The draft codes include taking steps to stop your brand being used in impersonation scams, such as monitoring for it and seeking its removal.

23 May 2026Banks, telcos and digital platforms designated
1 Sep 2026Banks must be AFCA members
31 Mar 2027Most obligations commence
End of 2027Scam intelligence reporting expected

Codes and rules are still being finalised. This is general information, not legal advice.

Where Unphish helps

PreventFind and remove fakes using your brand before customers reach them.
DetectSpot new lookalike sites, profiles, apps and numbers as they appear.
DisruptTake down the sites, accounts and numbers behind a scam.
ReportKeep evidence and case records for every takedown.
RespondYour complaints and dispute process.
GovernanceYour policies, sign-off and oversight.

Your Unphish portal

Every fake, and where it’s up to.

Fake sites, accounts and apps land in one threat feed. Approve a takedown in a click, then follow each case until it’s gone.

Threat FeedSolstice Pay · last 30 days

Example data

Pipeline health

With you
In enforcement
Verifying
Resolved

P1
solsticepay-secure.topCloned login page · Web
Awaiting review
P1
x.com/SolsticePay_HelpFake fraud team · X
In enforcement
P2
facebook.com/solsticepay.investing.clubFake investing profile · Facebook
Suspended
P3
apk-mirror-store.net/solstice-payCopied banking app · APK site
Verifying

Confidence

Illustration with example data. Solstice Pay is a fictional brand.

Case study

How we cleared fake profiles from investment brands.

Case study

Investment and wealth brands

Industry: Investing, wealth and banking
Period: March to June 2026
Covered: Facebook, Instagram, websites and app stores

Client names withheld to protect confidentiality.

01 · Before

The challenge

Fake Facebook and Instagram profiles were copying investment and wealth brands to offer share trading courses and investment tips, while lookalike sites copied bank logins and deposit offers.

02 · After

What we did

We found the profiles, checked each one against the real accounts, and reported them to the platforms with evidence. We also took down the lookalike sites and a copied app.

100%of the threats we pursued were taken down

77%were fake social media profiles

88%of those were on Facebook

Our results across all clients, threat by threat

Phishing sites99%

of the phishing sites we pursued were taken down.

Cloned login and payment pages
Security alert and refund lures

Phishing → Impersonation accounts99%

of the impersonation accounts we pursued on Facebook, X and Instagram were removed.

Fake support and fraud teams
Fake brand and investing profiles

Social media → Scam websites98%

of the scam websites we pursued went offline.

Fake rate and deposit offers
Fake rewards and payment pages

Scams → Fake apps92%

of the fake apps and app download sites we pursued were taken down.

Copied apps on third-party stores
Fake download pages

Mobile applications → Executive impersonation100%

of the executive impersonations we pursued were taken down.

Fake leader and adviser profiles
Fake investment endorsements

Executive impersonation → Compromised websites100%

of the compromised website cases we pursued were disrupted.

Phishing pages hidden on hacked sites
Removed with the owner and host

Compromised websites →

Results across all Unphish clients, January to June 2026. Figures are rounded.

Who it’s for

Built for the teams who protect your customers.

Every team sees different fakes. We find and remove them all.

Fraud and financial crime

Phishing, remote access and safe account scams start with a fake of you.

We remove

Cloned login pages
Fake fraud team accounts
Customer logins for sale

Customer care and contact centre

Fake support accounts and numbers reach customers first.

We remove

Fake support accounts
Fake phone numbers
Fake help pages

Digital and app

Copies of your app and site catch customers trying to log in.

We remove

Copied banking apps
Fake download pages
Lookalike domains

Marketing and brand

Your name, logo and people used to sell fake offers.

We remove

Fake rate and deposit ads
Fake investing profiles
Logo misuse

Risk, legal and compliance

Brand impersonation controls and evidence, ready for the Scams Prevention Framework.

We remove

Impersonation sites
Fake executive profiles
Unauthorised brand use

Explore by threat

Every threat financial brands face, explained.

PhishingCloned login, payment and refund pages ScamsFake rates, investments and safe accounts Social mediaFake support, fraud team and investing profiles Smishing and vishingSecurity alert texts and fake bank calls Brand abuseYour name on fake comparison and loan sites Mobile applicationsCopied banking apps on download sites VIP and executive impersonationFake executives and adviser profiles Dark and deep webCustomer data and staff logins for sale PiracyCopied apps, documents and statements

See all threats →

For your customers

Help customers spot a fake bank.

Two short notes you can adapt for your website, app, statements or support replies. One shows customers how to tell you apart from the fakes. The other tells them what to do if they’ve been caught.

The copied version leaves blanks for your bank name and official details.

Solstice PaySecurity notice

How to spot a fake Solstice Pay

We’ll never ask you to move money to a “safe account” or share a one-time code.
Only log in at solsticepay.com or in the Solstice Pay app from the official app stores.
We won’t ask for remote access to your phone or computer.
Our team doesn’t offer trading courses or investment tips in private chats.
If in doubt, hang up and call the number on the back of your card.

Seen something suspicious? Report it at solsticepay.com/report

Example

Solstice PayCustomer care

Think you’ve been scammed?

Call us straight away on the number on the back of your card.
Stop replying and don’t click any more links.
Change your password and remove any remote access apps.
Contact IDCARE if you shared ID details.
Report it to Scamwatch so others can be warned.

The sooner you tell us, the more we can do to help.

Example

FAQ

Banking and financial services questions, answered.

Why do scammers impersonate banks?

Customers trust their bank, and a convincing fake leads straight to their money. Security alerts, refunds and better rates are easy hooks, and one cloned login page or fake fraud team call can empty an account.

What are the most common scams using financial brands?

The most common are cloned login pages, fake security alert texts, fake support accounts and phone numbers, copied banking apps, and fake investment profiles offering trading courses or tips.

Do you work with financial services other than banks?

Yes. Lenders, wealth and super funds, investment and trading platforms, insurers and payment providers face the same fake sites, apps and profiles, and we monitor and take them down the same way.

How does Unphish help with UK scam rules?

Banks now refund victims of APP fraud, and the Online Safety Act puts duties on platforms to tackle fraud. Unphish helps you detect, disrupt and document the impersonation behind these scams, with evidence kept for every action. Check your specific obligations with your legal team.

How long does it take to take down a fake bank site or profile?

It depends on the platform, the host and the evidence. Social media profiles and phishing sites are often removed quickly, while sites on offshore hosts can need escalating.

Can you find fake banking apps and support numbers?

Yes. We monitor official and third-party app stores and APK download sites, plus the PDFs, forums and listings where fake support numbers are planted, and get them removed.

What do you need from us to get started?

Your brand names, official domains, social accounts and app listings, plus a letter of authority so we can act on your behalf. We handle the monitoring, evidence and takedowns from there.

Other industries

See how scams hit other sectors.

Every industry gets targeted in its own way. Explore the threats we find and take down in each.

Airline and Transport

Fake booking sites, points scams and support accounts.

Crypto

Fake exchanges, wallet drainers and giveaways.

Retail and E-Commerce

Fake shops, sales and delivery texts.

Public Sector and Government

Fake government services and payment demands.

Lottery and Gambling

Fake betting sites, bonuses and VIP managers.

Fintech

Copied apps and fake payment requests.

Non-Profit Organisations

Fake appeals and donation pages.

Film and Entertainment

Fake tickets, streams and giveaways.

Solutions for financial services

SolutionPhishing ProtectionCloned login and payment pages → SolutionSocial Media ProtectionFake support and investing profiles → SolutionDomain ProtectionLookalike bank domains → SolutionMobile App ProtectionCopied banking and investing apps →

See all solutions →

Try it

Real or fake?

Five messages a Solstice Pay customer might see. The bank only uses solsticepay.com, its official app and its verified social accounts. Which would you trust?

The quickest check: a real bank will never ask you to move money, share a one-time code or give remote access. If in doubt, call the number on your card.

Report a fake →

See what's using your bank's name.

Book a demo and we'll show you the fake sites, accounts and apps targeting your customers, then take them down.

Book a demo Request a takedown