Swiss warned of data theft at food delivery services

Federal agency warns of data theft at food delivery services Keystone-SDA

Credit card details instead of dinner: fraudsters have tampered with the payment page of a food delivery service. The Federal Office for Cybersecurity is warning against this scam, known as skimming, and offers advice on how to protect against it.

How do the fraudsters operate?

The attackers identified by the Federal Office for Cybersecurity injected malicious code into the legitimate website of the affected provider. This code replaced the original payment method, Twint, with a fake option for “credit card payments”. If customers selected this option, a pop-up window would open for them to enter their card details. According to the Federal Office for Cybersecurity, it was striking that the text was in English, even though the rest of the page was in German.

The details entered were transmitted directly to the fraudsters. To avoid arousing suspicion, an error message then appeared. This stated that the credit card payment was still in a test phase and that customers should use Twint instead.

How is this different from phishing?

In this method, known as skimming, data is stolen from a genuine website. This is in contrast to phishing, which involves the use of fake websites.

How can I protect my website?

According to the Federal Office for Cybersecurity, without specialist knowledge it is “very difficult, if not impossible” to spot such manipulation. It is therefore all the more important that website and online shop operators fulfil their responsibility to protect customers and guarantee a secure shopping experience.

All security patches should be applied regularly. All system components should also always be kept up to date, writes the Federal Office for Cybersecurity. The functionality of the checkout process for payments should be checked periodically for irregularities. Where possible, automated tests or monitoring tools should be set up for this purpose.

Operators should also use strong, unique passwords for all administrative accounts. Two-factor authentication is also recommended.

To prevent third-party scripts from loading data onto their own website, operators should also set up a restrictive Content Security Policy (CSP). This allows them to define exactly which sources the browser is permitted to execute JavaScript from and where data may be transferred to.

What should I do if, as a customer, I become a victim of skimming?

According to the Federal Office for Cybersecurity, if customers notice an unexplained credit card charge following an online purchase, they should consider the possibility that the website has been the victim of e-commerce skimming – even if it is a well-known and trustworthy shop.

Fraudulent transactions should also be disputed immediately with the bank or credit card provider in order to reclaim the money. Such an incident should also be reported to the Federal Office for Cybersecurity – as well as to the shop operator themselves. In the event of financial loss, the Federal Office for Cybersecurity recommends reporting the matter to the relevant cantonal police force. The appropriate police station can easily be found via the Suisse ePolice platform.

+ How we produce news in English
Translated from German, reviewed by an English Department journalist.