If you want it to be possessive, it's just I-T-S.
But if it's supposed to be a contraction, then it's I-T-apostrophe-S.
Scallywag.

If you normally access your bank's website by way of https, you wouldn't get redirected because the hijacked website's certificate wouldn't be valid. Other than that, you're just describing phishing.