Is a lookalike domain copying my bank or payment login?

Banks, card issuers and payment apps are copied because a stolen login leads straight to money. The usual trick is a page on a domain that looks like yours, telling the visitor their account is limited or needs confirming, with a sign-in form underneath. The first step is finding out which lookalikes of your domain already exist and which of them show a live page.

Free, no account needed. A scan takes 15 to 60 seconds. You get a shareable result link.

What our bank and payment scans found

In October 2026 we scanned 12 banks and card issuers (for example Chase, Wells Fargo, Capital One and Revolut) and 7 payment and fintech brands (for example PayPal, Stripe, Wise and Klarna) with the same scanner you can use above. Counted from the stored scan data:

• 7,819 registered lookalike domains across the 19 brands: 5,070 for the banks (a median of 476 per bank) and 2,749 for the payment brands (a median of 313 per brand).
• 6 confirmed fakes among the 488 flagged sites we checked by hand: 1 at a bank and 5 at payment brands, never more than 1 per brand.
• What the fakes showed: 1 "security alert, your account is limited" page with a sign-in form, 1 copied sign-in page with a password box, 1 "confirm your account" page, 1 copied payments dashboard, 1 page using the brand's name and tagline, and 1 publicly posted demonstration page on a domain spelled with look-alike foreign letters.
• 2 of the 6 used look-alike letters from another alphabet, so the address looked right at a glance. The other 4 used the brand name spelled correctly with an extra word, such as "login" or "verify".
• 5 of the 6 fake domains were less than a year old.
• 32% of the bank lookalikes and 39% of the payment lookalikes had a real mail server set up, and about 70% of both were found because they got a new HTTPS certificate in the previous 24 hours.

A low count of confirmed fakes doesn't mean these brands are safe: 327 of the 488 flagged sites couldn't be read when we checked them (blocked, timed out or already gone), so we couldn't confirm or rule them out. Fake bank pages are often short-lived, which is why daily re-checks matter more than a one-time scan. The full breakdown, method and limits are on lookalike domains by industry and our 95-brand research.

Signs a lookalike is after your customers' logins

• Your brand name in the domain with a word like "login", "verify", "secure", "alert" or "online", or a different ending.
• A domain that looks exactly like yours but uses a letter from another alphabet (see the homoglyph domain checker).
• Your page title or site icon on a page you don't run, especially a sign-in page or a "your account is limited" message.
• A recently registered domain or a brand-new HTTPS certificate.
• A working mail server, so it can send "security alert" emails under a name that looks like yours.

Our scan checks these automatically: it compares each live lookalike's title and site icon with your real site, looks up registration age, watches public certificate logs, and checks for a real mail server. It can't log in or test what a form does with what's typed into it, so a site we flag still needs a quick look by a person before you act.

If you find one

1. Save evidence: screenshots of the page and the address.
2. Report it to the domain's registrar and hosting company, and to Google Safe Browsing so browsers start warning visitors.
3. Remind your customers which addresses are really yours, and that you will never ask for their password by email or text.

Step-by-step details are in what to do about a fake domain. New lookalikes appear every day; monitoring re-checks daily, watches new certificates around the clock, and emails you when a new lookalike appears or an existing one gets riskier.

What it does not do

LookalikeGuard is monitoring and early warning. It does not take down domains, send legal notices, or give legal advice. Scores are automated and can be wrong in both directions: a high score is a reason to look, not proof of abuse. Many lookalike domains are parked, owned by unrelated businesses, or registered defensively by the brand itself; you can mark those as yours or dismiss them.