InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their bank's SMS verification codes.
tl;dr it’s a relatively sophisticated approach to make it look real. The fake site reverse proxies the real online ordering site so that it looks and behaves exactly like the real one, blocks some scripts like trackers or anything that’d redirect back to the real site, and swaps out the payment form for a fake one.
The payment details entered into the fake form go to a live operator that immediately tries to use the credit card elsewhere online. They get through 3-D Secure (where the bank requires verification of suspicious-looking online transactions) by asking the user to confirm the transaction, e.g. by providing an SMS confirmation code or confirming the transaction in their bank app.
If you didn’t notice the incorrect domain name, I think this would be very hard to notice. It really doesn’t help that companies like Doordash and Uber Eats make online ordering websites for restaurants that don’t have one, as those domains sometimes look kinda sketchy too. People aren’t paying as much attention to domain names any more.
tl;dr it’s a relatively sophisticated approach to make it look real. The fake site reverse proxies the real online ordering site so that it looks and behaves exactly like the real one, blocks some scripts like trackers or anything that’d redirect back to the real site, and swaps out the payment form for a fake one.
The payment details entered into the fake form go to a live operator that immediately tries to use the credit card elsewhere online. They get through 3-D Secure (where the bank requires verification of suspicious-looking online transactions) by asking the user to confirm the transaction, e.g. by providing an SMS confirmation code or confirming the transaction in their bank app.
If you didn’t notice the incorrect domain name, I think this would be very hard to notice. It really doesn’t help that companies like Doordash and Uber Eats make online ordering websites for restaurants that don’t have one, as those domains sometimes look kinda sketchy too. People aren’t paying as much attention to domain names any more.