Scammers cloned 820 restaurant sites to steal card numbers and bank codes
Restaurant Delivery Payment-Skimming Campaign
InfoHawk researchers uncovered a coordinated payment-skimming operation that reverse-proxies legitimate restaurant ordering pages, swapping in fake checkout forms that harvest credit card details and SMS verification codes. Across two passes they found 820 domains impersonating 35 brands, mostly typosquats on the .delivery TLD. The legitimate sites were never hacked, making the clones nearly indistinguishable to customers at the moment they pay.
Capturing a credit card number is valuable to criminals; obtaining a one-time verification code could also help them authorize fraudulent transactions, depending on how the victim's bank uses that code.