Yet another Hacker News

Restaurant Delivery Payment-Skimming Campaign

40 points fiej 2 hours ago 18 comments

_def 1 hour ago | parent

damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.

ModernTimes 1 hour ago | parent

None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).

https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...

bvcp 27 minutes ago | parent

i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”

pixl97 1 hour ago | parent

Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.

trollbridge 1 hour ago | parent

Long-term, via credit card attestation to a trusted device (eg Apple Pay) where the consumer verifies the merchant name & addres they're paying.

warkdarrior 1 hour ago | parent

There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.

gwerbin 8 minutes ago | parent

This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.

Ekaros 10 minutes ago | parent

Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.

ModernTimes 1 hour ago | parent

You put the people (Google Adsense) showing the scam adverts in prison.

Crunchified 55 minutes ago | parent

This advice from the article to the affected retailers:

Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.

It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.

StilesCrisis 34 minutes ago | parent

I don't see what you could do about "people browse the site but don't check out." I'm sure that is normal for any website regardless.

DANmode 14 minutes ago | parent

Having the app installed already.

Excuse me while I go throw up, can’t believe I just recommended that.

0x4e 1 hour ago | parent

I bet they are running Google and Meta ads to generate traffic to these malicious domains.

StilesCrisis 32 minutes ago | parent

You should read the article and see!

yh11 1 hour ago | parent

google ads really doesnt give a single shit if u give them money

mrguyorama 1 hour ago | parent

Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.

Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?

This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.

Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.

My sister got scammed by this exact mechanism just last week.

emacdona 36 minutes ago | parent

OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?

Either:

- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...

- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"

Either choice makes me think less of them.

[edit: added extra newlines so bullets showed up correctly]

handoflixue 2 minutes ago | parent

If you'd bothered to read the banner, it answers your question: "Zero cookies, zero trackers, zero pixels."

Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies