Security researchers have found 820 look-alike restaurant ordering sites that copy real chains’ websites live, then swap in a fake payment form at checkout to take card details and, in some cases, the one-time code a bank sends by text.
InfoHawk, a US fraud-detection startup, published the findings on 5 November 2026 under the name “Scamwich”. The sites impersonate 35 US restaurant brands, including Jersey Mike’s, Jimmy John’s, Firehouse Subs, Chipotle and Dave’s Hot Chicken. Of the 820 domains, 808 use the .delivery ending; the rest end in .com or .shop. Jimmy John’s alone accounted for 404.
InfoHawk says 367 of the domains were still serving a site on 4 November. The report reached the Hacker News front page on 7 November NZDT, where the discussion focused on search advertising and on how restaurants could detect copies of their own sites.
Why these fakes are hard to spot
The trick is a reverse proxy. Put simply, the scam server stands between you and the real restaurant site. Every time you click, it grabs the genuine page, tweaks it and hands it over. So the menu is right, the prices are right, store hours and your cart all behave normally. They’re coming from the restaurant.
What’s different is the payment box. Code slipped in by the proxy swaps the restaurant’s card form for the scammer’s own, and even copies across your order total so nothing looks off. There’s a valid certificate too, meaning the familiar padlock appears. And the restaurant hasn’t been hacked at all, InfoHawk notes; its site is simply being borrowed.
Card details are sent to an operator in real time, the report says. From there InfoHawk thinks a person tries the card somewhere else. If the bank pushes back with a security check, the operator can flip the victim’s screen to “card declined”, a box asking for the text-message code, or a prompt to approve the payment in a banking app. That code, the researchers suspect, is what gets the crook’s purchase through 3-D Secure (the extra check many banks run on online card payments). Afterwards the victim lands on a different chain’s genuine website. No dinner is ever ordered.
How shoppers were reached
Searching Google’s Ads Transparency Center for domains from its first sweep, InfoHawk found at least 47 Google Search text ads that ran between 7 July and 20 October 2026. They came from at least 46 advertiser accounts under 43 unrelated-looking business names. Most ran for one to four days.
InfoHawk says Google’s transparency pages now show the ads and domains it checked as unavailable, which suggests they were taken down. None of the ads it found were running on 3 November, but it warns that the sites may be getting traffic in other ways. Most of the domains sit behind Cloudflare, which hides the servers behind them.
InfoHawk co-founder and chief executive Rob Leathern, who previously led business integrity at Meta and was a vice-president at Google, shared the findings on X. He said Google had already removed the ads his team found, though there may be others on Google and other platforms.
In a follow-up post he argued: “Business verification isn’t enough; we need ad platforms to personally ID verify as well.”
What diners can do
These are American chains, but nothing about the kit is tied to them; it could copy any business that takes online orders. The simplest defence is to skip the sponsored results. Use the restaurant’s app, or type its address in yourself, and glance at the address bar before paying. A mangled brand name, or an ending like .delivery, should make you stop.
Another red flag: a “declined” message followed by a request to type your bank’s text code into the shop’s page. The Better Business Bureau’s guidance on verification codes puts it bluntly — nobody should be asking you for one. Already typed your card into a site you now doubt? Ring your bank on a number you trust and ask about blocking the card.
For restaurants, InfoHawk points out that the proxy fetches every page from the brand’s own servers. Watching for the site loading under someone else’s domain, or for checkouts that never reach the real payment provider, could expose clones early. The report comes from a company that sells this kind of monitoring, and its account of the live operator is partly its own inference; the counts and ad records are its own findings, not independently verified by Sulat News.
Sources
- InfoHawk: Scamwich report (5 Nov 2026)
- InfoHawk team page
- Rob Leathern on X
- Rob Leathern follow-up on X
- Hacker News discussion
- Better Business Bureau: verification code advice
Discover more from Sulat — AI & Tech News
Subscribe to get the latest posts sent to your email.
