Divorce: pizza ad with a huge discount

[root]

Fake food delivery service

On Facebook, I was offered to order pizza using the promo code SIDIMDOMA with a 50% discount. At first glance, everything is in order: the link from the advertisement leads to a site with pizzas, the promotional code is logical for covid times. Pizza is selected on the site, the promo code is applied.

But it's still a scam:

The easiest way to make sure of this is to enter a promotional code on a real pizzeria website. It won't work. But scammers can be detected even if there is no way to check the promotional code on the real site. Here are the main things to watch out for:

1. The advertisement has a slightly different name for the site and Facebook group of the pizzeria.
2. The group itself and the site were created recently.
3. There are few reactions to the ad, there are negative ones.
4. The site easily accepts incorrect data - except for card data.
5. The payment code never matches.

Let's go through all the signs in more detail.

Signs of fake advertising​

The page title does not match the brand . The image is advertising a pizza from the Papa John's pizza chain, and the advertisement was placed by the Pizza Papa page. The real page would have the same name as the pizzeria.

I also came across ads for pages called Papa Jhons - misspelled - and "Pizza Jones"

Weird website address. Under the image, "Facebook" indicates the address of the site to which the advertising link leads. The address is registered in an unusual .club zone, and the site name itself - Papaspecial - only resembles the name of a pizzeria, but does not contain the full brand name. For comparison, the real site of this pizzeria chain ends with the usual .ru and looks like this: papajohns.ru.

While I was writing this text, I came across a similar ad on Facebook. The advertising text and image in the post were different, but the link opened the same site, albeit at a different address. Sooner or later, such ads are blocked, and scammers create a new page and open a new site with a different address.

Similar ad, but with different text and website address

Another version of advertising from the same scammers. Website address is new

Few reactions to the post , there are negative ones. A real promotion with such a discount will quickly collect a lot of likes and happy comments. Although they can be left from fake accounts.

Empty community page. If you open the page on behalf of which the ad is placed, you can see that it is almost empty, and the cover is not set neatly: the text does not fit in the title area. There are only three posts in the community feed: a profile photo, a cover, and a post with a promotion. The page appeared only a few days ago, no one subscribed to it. Often there are grammatical errors on such pages.

Wrong name of the pizzeria, sloppy profile cover

The page has no subscribers, there are only a couple of messages in the feed: cover update and promotion announcement

Below is the date the page was created - just a few days ago

​

Website for a pizzeria​

If you click on an advertising link, the site also has a lot of warning signals.

Just one page. The website of the "pizzeria" is one-page. There are no links to the list of stores, delivery map and contacts. You can not create a personal account or enter it. There is only a network phone at the top of the site. It is real - this lulls the vigilance of the site visitor.

The links at the bottom don't work. They were placed to make the site look more like the site of a real pizzeria. But you can’t go through them - the visitor always remains on the main page, where the card data is entered.

The site consists of one page

All links to other sections of the site and to mobile applications do not work

inconsistencies in the text. Scammers don't have much time before a site is blocked, so they rarely care about the details. For example, at the end of the page they promise free delivery from 600 R, and at night - from 1500 R. But the banner at the top promises free delivery from 499 R with no time limits.

Order form. Fraudsters only need to create the appearance of a real order form, they do not need the entered data. In the field of address and contacts, you can enter any data, even incorrect ones. Or don't include them at all.

The site easily agreed to accept an order for the wrong phone number and email

​

Order payment​

The fraudster also inherited in the process of paying for the order.

Payment on the page with pizzas. Most sites do not accept payment themselves, but through intermediaries - payment services. The client places an order, and the site redirects him to a special service page for entering the card number. This page, according to security rules, should be located on the website of the processing center, and scammers offer to enter the card number on the same website.

Sometimes sites receive special accreditation - and processing centers allow them to request card details without going to another page. A real pizzeria has received such accreditation. Perhaps that is why the scammers chose this pizza chain.

These cards are checked: only they are needed by scammers. Based on the entered number, the site calculates the checksum: if it is incorrect, then there is an error somewhere. The site of scammers will not accept such a card number.

The input field here looks like on the real site. But payment rarely happens on the same page and on the same site where products are selected and an order is placed.


No bank information. When confirming the payment, there is no logo and name of the bank or other payment service that conducts the transaction. Logos are easy to fake, but if they don’t exist at all, it’s an excuse to stop and not enter anything.

Confirmation of payment on the same site. After clicking on the "Pay" button, a page opens that looks like checking 3-D Secure - a one-time SMS code to confirm payment. Visually, it looks like a bank page. In fact, the page address shows that you are on the same site. Fraudsters were too lazy to register a separate address that resembles the name of a bank.

Most likely, at this moment, your card number is entered on the page of this processing center. The bank will send you an SMS with a confirmation code for this operation. If you enter the code on a fake page, the scammers will receive it and be able to confirm the real debit from your card.

If you entered the card number on such a site, you need to block it as soon as possible in the mobile application or through the bank's call center.

Confirmation of payment occurs on the same site where the sale of goods "shop".
No logo or bank name

When you enter any code, the site will say that it is incorrect, and scammers will send a second request every time,
to charge your card the same amount again

Instruments​

There are also a couple of slightly less obvious ways to check a scammer's site.

Domain check via Whois. Each domain - site address - has an owner and date of registration. This information can be obtained through a special Whois service: enter the domain name - the address of the main page of the site without www and http - and the service displays technical information.

For foreign domains, the date of creation is specified as Creation Date. The domain from our example appeared a couple of days ago. The site of a real pizzeria obviously appeared earlier.

Whois domain name verification service at Reg-ru registrar.
According to these data, the site of the "pizzeria" was created two days ago - on August 18, 2020. The real company's website is obviously older

Certificate of safety. To send data securely, sites attach certificates of authenticity. Protected sites can be distinguished by the padlock icon in the address bar of the browser. If there is no such icon on the page for entering the card number or it is crossed out, these are definitely scammers.

In our example, scammers installed such a certificate. But this does not mean that the site is real. Carefully look at the site address in the browser line. Fraudsters can install such a certificate on the timkoff.ru site — a similar letter m is used instead of the letter n — but this will not make the site real.

Sometimes scammers save money and install free certificates. These certificates are valid for several months. Certificates on this site are issued for 1 or 2 years. If you click on the padlock icon, you can see the validity period of the certificate.

This is how the site's security certificate information window looks like.
If the certificate is issued only for a few months, this is most likely a scam site

Not just pizza ads​

The listed signs help to recognize scammers when paying with a card on an unfamiliar site. Separately, each of them can talk about a random error - for example, when setting up a site. But if there are several signs at once, they are most likely trying to deceive you.

Georgy Shabashev, Tinkoff—Journal

 

[НСК-СБ]

It has long been written that scammers advertise their sites on Facebook, but supposedly they are the Facebook team, or how Meta is working on it now, but something is not visible, judging by this article.
I recently posted an article on the same subject here. The market for fakes has skyrocketed on Instagram and Facebook