Hacker News

points by pixl97 1 day ago | 0 comments

Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.

[–] ModernTimes 1 day ago

You put the people (Google Adsense) showing the scam adverts in prison.

[–] dismalpedigree 20 hours ago

You make the penalty for being caught have teeth. A slap on the wrist (or nothing in this case) just encourages more abuse. Make a public showing that it wont be tolerated. Something short of public execution, but decades in prison seems reasonable.

[–] LorenPechtel 7 hours ago

They're probably not in the US.

[–] Crunchified 1 day ago

This advice from the article to the affected retailers:

Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.

It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.

[–] StilesCrisis 1 day ago

I don't see what you could do about "people browse the site but don't check out." I'm sure that is normal for any website regardless.

[–] ano-ther 1 day ago

In this case, wouldn’t you see a lot of abandoned carts coming from the reverse proxy sessions?

[–] StilesCrisis 1 day ago

I don't know the scale of cart-abandonment for a website like Jimmy John's, but it has got to be large enough that a few dozen more wouldn't be _too_ surprising.

[–] chezzwizz 16 hours ago

> it has got to be large enough that a few dozen more wouldn't be _too_ surprising.

Shouldn't it be though? What is the precedent here? Isn't anyone concerned about the slow boiling frog any more?

[–] pixl97 16 hours ago

Doing a quick search on it, and if the AI response is anywhere close to true, the vast majority of times a cart is filled it's not checked out. Food has one of the lowest rates, but that's still 30-50% abandonment.

Honestly it's something that happens with my family quite often. I'll start putting stuff in a cart then someone else changes their mind and we switch to another place to order. And it feels like this happens all the time.

[–] trollbridge 1 day ago

Long-term, via credit card attestation to a trusted device (eg Apple Pay) where the consumer verifies the merchant name & addres they're paying.

[–] Ekaros 1 day ago

Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.

[–] warkdarrior 1 day ago

There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.

[–] gwerbin 1 day ago

This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.

[–] tosti 1 day ago

I'm thinking more elaborate CSRF tokens that uses subresource integrity and everything else (cookies, headers, etc). As soon as there's a mismatch, collect details and report.

[–] BeetleB 1 day ago

Don't do delivery from 3rd party services...?

In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.

It seems from comments here that Google is a lot less reliable than the Yellow Pages were.

[–] mayneack 1 day ago

https://www.vice.com/en/article/yelp-is-sneakily-replacing-r...

[–] DANmode 1 day ago

Having the app installed already.

Excuse me while I go throw up, can’t believe I just recommended that.

[–] foxglacier 1 day ago

It's still a fake domain name. Don't trust random websites the same as how you use the web in general. Also, asking for a bank's OTP code is a gigantic no-no, but I don't suppose they really need that to collect the money?