Item — HN Reader

I’ve updated the original post to remove the restaurant name.

After a little more digging, I’m more confused than ever.

Yelp and other sites list the website I used as the official website, the picture on the website matches the interior of the restaurant, and I don’t see scores of online users claiming their bank accounts were hacked after ordering.

I removed the restaurant name out of caution since the best I can tell, the website I used was the official website.

But I still for the life of me can’t think of any legitimate reason why the verification code on the order form would prompt me to receive a banking 2FA code unless it were a phishing attempt.

Does anyone have any theories on what was going on, and what if anything I should do?

1 comments

I'm constantly surprised by the number of local restaurants (including some who have been around for many many years) who have no website at all, and very little online presence at all. Sites like Google Maps, Uber, etc just auto-add them themselves, or get them to sign up directly, and at most they'll have a Facebook page their kids set up for them or something. There's also dodgy people out there who absolutely do set up fake websites for restaurants to middle-man the orders and take a cut from inflated prices, and the restaurant doesn't even know it's happening (we personally know it happened to a local restaurant when we asked them about it their site and they had no idea what we were talking about, and said they don't do delivery). So basically... I wouldn't be surprised if someone set up a fake restaurant for a bunch of companies, and Google/Uber/etc auto-add that site assuming it's their official site.

Or not. Unless you ask the restaurant personally you probably won't know, but I'd see it as "possible".