▲ 5 points

Tell HN: Fake restaurant online order form bank phishing attempt

by maxutility·4y ago·2 comments·view on hn ↗

I nearly fell victim to a very sophisticated phishing attempt while traveling in Montreal. While trying to order from an Indian restaurant named [Redacted], I found a website with a very slick online ordering form. After entering my dinner choices, credit card info, phone number, and email, I was shown a dialog that indicated the last step I would need to follow for my order to go through would be to enter an SMS verification code.

Nothing up to this point seemed in the least bit phishy; in fact, the website was so professionally designed (including English and French language options, and pictures of the food) that it made me even more confident about the upcoming meal.

The code arrived with a ding on my phone, but when I went to enter it I noticed that it was actually a Bank of America 2 factor authentication code. If I had entered it I’m almost certain my banking credentials would have been compromised. And to top it off, I bet that I’d still need to order dinner.

2 comments

I’ve updated the original post to remove the restaurant name.

After a little more digging, I’m more confused than ever.

Yelp and other sites list the website I used as the official website, the picture on the website matches the interior of the restaurant, and I don’t see scores of online users claiming their bank accounts were hacked after ordering.

I removed the restaurant name out of caution since the best I can tell, the website I used was the official website.

But I still for the life of me can’t think of any legitimate reason why the verification code on the order form would prompt me to receive a banking 2FA code unless it were a phishing attempt.

Does anyone have any theories on what was going on, and what if anything I should do?

I'm constantly surprised by the number of local restaurants (including some who have been around for many many years) who have no website at all, and very little online presence at all. Sites like Google Maps, Uber, etc just auto-add them themselves, or get them to sign up directly, and at most they'll have a Facebook page their kids set up for them or something. There's also dodgy people out there who absolutely do set up fake websites for restaurants to middle-man the orders and take a cut from inflated prices, and the restaurant doesn't even know it's happening (we personally know it happened to a local restaurant when we asked them about it their site and they had no idea what we were talking about, and said they don't do delivery). So basically... I wouldn't be surprised if someone set up a fake restaurant for a bunch of companies, and Google/Uber/etc auto-add that site assuming it's their official site.

Or not. Unless you ask the restaurant personally you probably won't know, but I'd see it as "possible".