Restaurant Delivery Payment-Skimming Campaign

(infohawk.com)

39 points | by fiej 2 hours ago

8 comments

  • ModernTimes 1 hour ago
    None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).

    https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...

    • bvcp 20 minutes ago
      i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”
  • pixl97 1 hour ago
    Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.
    • ModernTimes 1 hour ago
      You put the people (Google Adsense) showing the scam adverts in prison.
    • Crunchified 47 minutes ago
      This advice from the article to the affected retailers:

      Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.

      It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.

      • StilesCrisis 27 minutes ago
        I don't see what you could do about "people browse the site but don't check out." I'm sure that is normal for any website regardless.
    • trollbridge 1 hour ago
      Long-term, via credit card attestation to a trusted device (eg Apple Pay) where the consumer verifies the merchant name & addres they're paying.
      • Ekaros 3 minutes ago
        Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.
      • warkdarrior 56 minutes ago
        There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.
        • gwerbin 1 minute ago
          This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.
    • DANmode 7 minutes ago
      Having the app installed already.

      Excuse me while I go throw up, can’t believe I just recommended that.

  • _def 1 hour ago
    damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.
  • mrguyorama 1 hour ago
    Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.

    Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?

    This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.

    Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.

    My sister got scammed by this exact mechanism just last week.

  • emacdona 29 minutes ago
    OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?

    Either:

    - They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...

    - They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"

    Either choice makes me think less of them.

    [edit: added extra newlines so bullets showed up correctly]

  • 0x4e 1 hour ago
    I bet they are running Google and Meta ads to generate traffic to these malicious domains.
    • StilesCrisis 25 minutes ago
      You should read the article and see!
  • yh11 1 hour ago
    google ads really doesnt give a single shit if u give them money
  • aniq_ui 0 minutes ago
    [flagged]