The scheme involved spoofed domains and sponsored search links that diverted banking customers to fake websites.