"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something."

If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.