The Outlier Lab

Phishing and Credential Harvesting

Lures and impersonated login pages, including real-time relays and voice or SMS pretexts, that capture credentials, codes or sessions to move a customer's funds within minutes.

What it is

Phishing is the social route to Account Takeover (ATO). Unlike Credential Stuffing, it reaches customers who don't reuse passwords, and in its modern form it captures the second factor or the session too. It overlaps with Impersonation Scams. The difference is who presses "send." When the attacker logs in and moves the money, it's ATO. When the customer is talked into moving it, it's an authorized scam. Many cases involve both.

Delivery channels in scope:

  • Email and SMS (smishing) lures claiming suspicious activity, a locked account, a delivery problem or a tax refund.
  • Voice (vishing), where a caller poses as the bank's fraud team, often with a spoofed caller ID.
  • Search and social ads that impersonate a brand's sponsored result.
  • Messaging apps and QR codes that move the victim off monitored channels.

How it works

Modern phishing has two architectures, and they need different controls.

Diagram: Lure (email, SMS, ad, call), Impersonated login page, Harvest-and-replay: credentials stored for later use, Real-time relay: login proxied to the genuine site, Attacker holds a live authenticated session, Later login, MFA challenged separately, Lockout, staging, cash-out within minutes
  1. Harvest-and-replay. A fake page collects credentials (and sometimes a static code) for later use. MFA still defends the account, so the attacker needs a second step (see MFA Bypass and OTP Interception).
  2. Adversary-in-the-middle (AiTM) relay. The fake page sits between the victim and the real site and passes the login through in real time. The victim completes genuine MFA, and the attacker captures the resulting session. Microsoft's April 2026 campaign report describes exactly this pattern: tokens were captured from more than 35,000 users, and the bypass was attributed to MFA methods that aren't phishing-resistant.
  3. Voice-led harvesting. A caller creates urgency ("we see fraud on your account") and collects the password and the one-time code the bank just sent. The FBI's 2025 ATO alert describes callers who then hand off to fake "law enforcement" to extract more.

The step after access is consistent. The FBI notes that in nearly all of these cases the criminals change the password and lock the owner out, then wire funds quickly to accounts they control, often linked to crypto wallets.

Transaction footprint

Phishing-led ATO is the fastest-moving ATO, so plan for decisions that have to land within minutes of login.

StageWhat you see in the dataDecision point
LureLookalike domains, brand-impersonating ads, customer reports of texts or callsTakedown and intel; Customer Education and Scam Warnings
AccessCorrect password and MFA from new infrastructure; sometimes a session reused from a different network moments after the victim's loginPhishing-resistant authentication; session-to-device binding
ControlPassword, email or phone change within minutes of login; new device enrolled; alerts disabledContact Change Cooling-Off Periods, notify old contact
StagingNew payee, bank link or wallet; liquidation of positions; limit changeHolds on new destinations; Bank Account Ownership Verification
Cash-outWire or instant payment to a first-time payee; P2P to mules; crypto purchase; unusual buys of thinly traded stockReal-Time Transaction Risk Scoring; Payee Confirmation and Payment Friction
AftermathCustomer calls locked out; recall requests; Reg E claimsFast recall (see FBI guidance on recall requests and hold harmless letters)

Common variants

VariantWhat's differentWhere it shows up
Harvest-and-replayCredentials only; MFA still has to be defeatedOlder kits; low-MFA platforms
Real-time relay (AiTM)Captures a session after real MFABanks, brokerages, crypto, email providers
Search-ad phishingLure is a paid ad imitating the brandBanking and payroll logins
Vishing with OTP captureLive caller collects codesBanks, P2P, brokerages
SmishingSMS lure; mobile-optimized fake pagesBanks, delivery, toll and tax themes
Consent or device-code phishingTricks the user into authorizing an attacker's app or devicePlatforms with OAuth or device sign-in flows
Phishing-as-a-serviceRented kits with live operator panelsAll; see Fraud-as-a-Service Ecosystem

Where it shows up

Impact

  • The FBI received more than 5,100 complaints of ATO through financial-institution impersonation between January and late November 2025, with over $262 million in losses.
  • In the FBI's 2025 annual report, phishing/spoofing complaints held roughly flat (191,561 vs. 193,407 the year before), while reported losses in that category tripled, from about $70 million to about $215 million.
  • In December 2025 the DOJ seized a backend used to store bank credentials captured through search-ad phishing. It was tied to about $14.6 million in actual and $28 million in attempted losses.
  • Japan's FSA reported that phishing sites impersonating securities firms sharply increased. Its interim January–April 2025 tally put unauthorized trading at about ¥305 billion (sales plus purchases); its current full-year 2025 data counts 9,861 unauthorized trades with about ¥395 billion in sales and ¥347 billion in purchases. The FSA notes these trading totals are not customer losses.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventPasskeys and Phishing-Resistant AuthenticationOrigin-bound credentials don't work on a lookalike domain, which stops relays
PreventDevice Binding and Trusted DevicesA captured session or credential is worth less off the enrolled device
PreventCustomer Education and Scam WarningsIn-app warnings at the moment of risk ("we will never call for your code")
DetectRisk-Based Authentication and Step-UpRe-authenticates at money movement as well as at login
DetectReal-Time Transaction Risk ScoringScores the first payment to a new destination with session context
RespondContact Change Cooling-Off Periods, Withdrawal and Payout ControlsHolds value after a contact change; buys time for recall
RespondFraud Incident Response, takedown programsShortens campaign lifetime

Emerging variants and adversary adaptation

  • Relay as the default. Commodity phishing services have made real-time relay standard for high-value targets, so "we have MFA" is no longer a defense against phishing-led ATO. Only origin-bound authentication (passkeys, FIDO2) and binding sessions to devices close the gap.
  • Regulatory mandates. Japan's FSA amended its supervisory guidelines in October 2025 to require phishing-resistant MFA for internet securities trading, due in principle by the end of June 2026. Explicit mandates like this are rare, and other regulators are likely to use it as a template.
  • AI-localized lures. Researchers linked the jump in phishing against Japanese investors partly to AI-written, culturally fluent lures. Language quality no longer works as a filter. See Generative AI and Deepfake Fraud.
  • Ad and search channels. Paid ads that impersonate banks put the lure where customers intend to log in. Bookmarks and app-only login help. Brand ad monitoring now belongs in the fraud program as well as in marketing.
  • Distribution in the shopping season. Security vendors reported mobile phishing sites growing several times over during the 2025 holiday season, along with hundreds of holiday-themed malicious domains. Treat seasonality as a forecastable risk.
  • What's next. Expect relay phishing aimed at passkey enrollment and recovery flows, at fallback methods, and at support channels, rather than at the passkey itself.

Real-world examples

Sources and further reading