While the fraudulent advertisements appeared to send users to the websites of legitimate banks, victims were in fact redirected to fake bank websites controlled by the criminals. When victims entered their login credentials to access their bank accounts, the criminals harvested those credentials through a malicious software program embedded in the fake website. The criminals then used those bank credentials on the corresponding legitimate bank websites to access victims' bank accounts and drain their funds.