Researchers found 820 fake sites copying 35 restaurant brands. They show real menus, then steal card details and bank text codes at checkout.
Researchers at InfoHawk found 820 fake websites posing as major US restaurant chains. The sites look and work like the real ordering pages. Only the payment step is fake, and it collects your card details and the text code your bank sends you.
The 35 copied brands include Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle and Dave's Hot Chicken. Of the 820 sites, 808 end in .delivery. The rest use .com or .shop. The research began with one Jersey Mike's copy and found others that appear to run the same kit, though that is the researchers' belief, not proof.
The fake sites use a trick called a reverse proxy. The scammer's server sits in the middle, pulls each page from the real restaurant site and passes it to you. Menus, prices and your cart are real. The real restaurant was not hacked.
At checkout, the page swaps in a fake payment form. It asks for your card number, expiry date, security code, name and phone number. The researchers believe a person then uses your card elsewhere. When your bank asks for approval, that person tells the fake page to ask for your text code. Typing it in may let the charge go through.
Many fakes sit behind Cloudflare, a company that hides where a site is really hosted. The browser can still show "Connection is secure." That only means the connection is encrypted, not that the site is the real restaurant.
Anyone who orders online from big US chains is a possible target, especially people who reach a restaurant by clicking a search ad. The researchers found at least 47 Google search ads for these fakes between July 7 and October 20, 2026. They came from at least 46 advertiser accounts with unrelated names, such as construction firms, a reptile rescue and a watch company. Most ads ran only one to four days.
People who always type the restaurant's address themselves or use its official app can relax a bit. That route skips the ads where these fakes were promoted.
The alert box above lists the steps. The key habit is to choose how you reach the site yourself instead of trusting how a page looks. If you already entered details on a site you now doubt, contact your bank right away.
The material does not say how many people have lost money or how much was stolen. It also does not say which banks were involved. It names only five of the 35 brands. The researchers say there are likely more fake ads than the ones they found, because they searched only for the domains from their first sweep.
Type the restaurant's address yourself or use its app, and never enter a bank text code unless you are sure you are paying that store.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysMastercard describes AI tools that could buy things for you, and says trust is the hard part: who gets to spend your money, and under what rules.
Read more: Mastercard outlines how AI assistants could shop and pay for you
