This totally is on Google & Co for allowing those scam ads. They can filter those out. They are simply chosing not to.
Damn, that’s a high-quality variation of a man-in-the-middle attack, and going after the big name companies shows how confident they are they won’t get caught. Cloudflare and Google need to be doing more to prevent this.
This was interesting. I’ve never considered that a scam site could proxy the real one.
It’s been possible for a very long time, but with companies standardizing in areas they really shouldn’t and the scammers being the biggest users of AI, it’s easier to pull off than it used to be.
tl;dr it’s a relatively sophisticated approach to make it look real. The fake site reverse proxies the real online ordering site so that it looks and behaves exactly like the real one, blocks some scripts like trackers or anything that’d redirect back to the real site, and swaps out the payment form for a fake one.
The payment details entered into the fake form go to a live operator that immediately tries to use the credit card elsewhere online. They get through 3-D Secure (where the bank requires verification of suspicious-looking online transactions) by asking the user to confirm the transaction, e.g. by providing an SMS confirmation code or confirming the transaction in their bank app.
If you didn’t notice the incorrect domain name, I think this would be very hard to notice. It really doesn’t help that companies like Doordash and Uber Eats make online ordering websites for restaurants that don’t have one, as those domains sometimes look kinda sketchy too. People aren’t paying as much attention to domain names any more.
