Scamwich Fake Restaurant Ordering Sites

820 fake ordering sites for 35 restaurant chains showed the restaurant’s own menu, then took the card and the bank’s text code. The customers did nothing wrong. Google ran the ads from July to October.

Someone wants lunch from Jimmy John’s. They type the name into Google instead of typing the web address, and at the top of the results sits a listing that looks like the restaurant’s own. The headline says something like Order Sandwiches for Pick Up, with a line about delivery, catering or a location near you. One click, and an ordering page opens with the sandwiches and the opening hours, and the prices match the restaurant’s.

They match because the fake site borrows them. Each time you click, it quietly asks the restaurant’s website for that same page, gets it back, puts its own web address where the restaurant’s was, and shows it to you. You are looking at the restaurant’s own page, passed through somebody else’s server. That setup is called a reverse proxy.

The scam runs on it.

So when the restaurant changes a price at noon, the fake site shows the new price at noon too. Even the restaurant’s own bot check keeps running on the page, because the fake site fixes its links so it still works. The researchers who found the network, at a company called InfoHawk, named it Scamwich and say the restaurant itself never had to be hacked.

Only one part of the page gets swapped. At checkout, the box where you type your card normally comes from the company that handles the restaurant’s payments. The fake site puts its own box there instead. A little script keeps an eye on the page, and if the original box comes back, it swaps that box out again.

A second script looks at the Place order button twice a second and copies the total. So the fake box shows the exact amount in your cart, down to the cent.

The address bar does not help you either. The sites sit behind Cloudflare, a service that hides where a website actually runs and gives it the file your browser checks before it calls a connection secure. That file is called a certificate, and these sites had valid ones. In the example the researchers show, the certificate came from Google Trust Services.

So the browser tells you the connection is secure. That only means outsiders cannot read what travels between you and the site. The site itself belonged to the scammers.

The fake box asks for the card number, the expiry date, the three digits on the back, your name and your phone number. The moment you press pay, those details go to the scammer, along with the name of the fake site.

The details arrive right away, over a connection between your browser and their server that stays open while you are on the page. The tool behind that is called socket.io. Someone on the other side can see your card as soon as you send it.

What happens next is what the researchers think this kit, the fake pages and scripts behind each site, was made for. A person sits behind a control panel and uses your card somewhere else.

Many banks ask for one more check when you pay online: a code by text message, or a tap to approve in your banking app. That way a card number alone is not enough. The check is called 3-D Secure. Here, it works against you.

Because when your bank sends that code, the scammer pushes a new page onto your screen. One page says the card was declined and asks for another. One asks for the code that came in on your phone. One asks you to approve the payment in your banking app. One says the code was wrong and asks you to type it again.

You type the code to pay for your lunch. According to the researchers, that code is what lets the scammer’s own purchase through the bank’s check. That is their reading of the kit; the report does not show a payment going through.

When the scammer is done, the page drops a small file in your browser, a cookie named valid with the value 77777, set to last until 2038. In the copy the researchers took apart, it then sends you on to the website of another chain, Jimmy John’s, through a link service called href.li that hides where you came from.

No order ever reaches the restaurant. You wait for food that is not coming, and according to the researchers your card has paid for whatever the scammer bought.

The researchers counted 820 of these fake web addresses across two rounds of searching, copies of 35 restaurant chains. 808 of them end in .delivery. That is the last part of a web address, like .com, and this one is official, added to the internet’s address system in 2014 and run by a company called Identity Digital. For a site where you order food, it sounds exactly right. The rest end in .com or .shop.

Jimmy John’s alone had 404 fake domains. Firehouse Subs had 121, with names like flrehousesubs.delivery, an l where the i should be. Jersey Mike’s had 80, among them mlckessejersstey.delivery and jerseymikes-delivery.com. Dave’s Hot Chicken had 67.

Waffle House got w0ffleh0use.delivery, with zeros for the a and the o. Chipotle, Popeyes, Panera Bread, Five Guys, Little Caesars, Tim Hortons and Wawa are on the list as well, some with a single copy, some with a handful. The earliest copy in the research turned up on March 3, 2026.

Almost all of them, 761 of the 820, sit behind that same service that hides their servers. Of the first 255 the researchers found, 251 were bought from the same shop for web addresses, Dynadot. A shop like that is called a registrar.

One server had a live card panel on it, the place where the card details arrive. A second group of 68 domains is tied to a server on Amazon’s cloud, and some of those sites run straight from it, in Frankfurt, with a slightly different script. The researchers found nothing that shows the same people run both.

In cybersecurity, attribution is one of the hardest problems. A kit can be shared or sold. A server address tells you where a machine is rented, not who rents it. What we know for sure is how these sites work.

On November 4, 367 of the 820 domains still served a site.

To bring people to them, the scammers bought Google search ads. The researchers found at least 47 of them between July 7 and October 20, 2026. And they only looked up ads for the sites from their first search, so there were probably more.

The ads ran under 46 separate advertiser accounts with 43 different business names, and those names look unrelated to the chains: construction firms, a watch company, a reptile rescue. How the scammers got hold of those accounts, the researchers do not say. Most ads ran for one to four days, usually starting a few days after the domain was registered. The longest ran for 56 days, the next for 39.

Google publishes a report each year about the bad ads it stops. The one for 2025 came out on April 16, 2026. The company says it blocked or removed more than 8.3 billion ads and shut down 24.9 million accounts. Its systems caught over 99 percent of the ads that broke its rules before they were ever shown, the report says, and 602 million ads had to do with scams. It also says it checks who its advertisers are.

These 47 got through. Some stayed up for weeks.

An advertiser can pay Google to show an ad when someone searches for another company’s name. That search word is called a keyword, and Google’s trademark policy does not restrict using someone else’s brand there. Many of the ads also put the brand name in the headline itself, followed by words like Menu Items or Catering Menu.

The 20 Jimmy John’s ads did not. Their headlines said Sandwich Shop or Order Sandwiches for Delivery, so a trademark complaint from the chain would have found no brand name in the ad to point at.

Google has a second rule that needs no complaint at all. Its policy against misleading ads bans pretending to be another brand or business, in the ad or on the website behind it. It treats that as one of its most serious violations and can suspend the account without warning. These ads sent people to sites that pretended to be the restaurant. They still ran, most of them for a few days only.

The man whose company found all of this knows the ad business from the inside. Rob Leathern, its CEO and co-founder, was VP of Privacy and Security Product at Google and led Business Integrity at Meta, according to its own team page. The company sells tools to detect exactly this kind of clone, and the report ends with an offer to check whether someone is copying your brand.

The trick itself is older than this campaign. On February 24, 2023, the writer Cory Doctorow described searching for a Thai restaurant he liked in Burbank, Kiin Thai. He clicked a sponsored result for a site called kiinthaila.com, built on Wix, while the restaurant’s own website was the third link down. The copy added 15 percent to the prices, passed the order on to the restaurant and billed him twice.

The restaurant called him to cancel and told him to contact his card company to get the charge reversed. That version still produced an order. The 2026 version produces none, shows the restaurant’s live menu instead of a copied one, and goes after your bank code too.

Two months before that post, on December 21, 2022, the FBI had already warned about this. It wrote that criminals were buying search ads with web addresses that look like a known business. Those ads showed up at the very top of the results and looked almost the same as the normal ones. Its advice back then: check the address before you click an ad, type the address of a business yourself instead of searching for it, and use an ad blocker.

The chains in this campaign are American. A fake site that pulls the pages from the original and only swaps the payment box would work the same way for a pizza place in Rotterdam or a delivery service in Berlin.

By November 3, none of the ads the researchers found were still running, and Google’s own page for looking up ads now shows Can’t find ad for them.

Restaurants have one way to spot this early. The fake site has to ask the restaurant’s own server for each page. So a chain that watches for its pages showing up under a strange web address, or for checkouts that never reach its payment company, can catch these sites fast.

What you can do before you pay for food online:

• → Type the restaurant’s address yourself, use a bookmark, or order through its own app
• → Look at the domain in the address bar. A secure connection only tells you it is encrypted
• → A brand name followed by .delivery, -delivery.com or -us.com was the pattern in this campaign
• → Read the full text from your bank before you type a code anywhere. If the shop or the amount does not match your order, stop
• → Pay with a credit card where you can, so you can dispute the charge
• → Use an ad blocker, one of the tips from that 2022 warning
• → If you typed your card into a site like this, call your bank, block the card, and in the US report it at ic3.gov

Want to see what a server in the middle can read? Run Burp Suite in your own lab and watch your browser’s traffic pass through. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

InfoHawk Scamwich report | Google Ads Misrepresentation policy | FBI IC3 PSA December 2022