Cybersecurity office warns of fake card-payment trap on food-delivery site

A familiar food order became a route to payment data. The Federal Office for Cybersecurity has warned that criminals tampered with the payment page of a food delivery service in Switzerland, placing customers at risk while they used a legitimate website. The agency said attackers injected malicious code into the site and replaced the provider’s original Twint option with a fraudulent credit card payment choice.

Customers who selected the fake option saw a pop-up asking for their card details. The information went directly to the attackers. A subsequent error message claimed that credit card payments were still in a testing phase and told customers to use Twint instead. That message may have allowed the compromised checkout to appear routine after the data had already been stolen.

The warning, published on September 1, 2026, highlights a difficult problem for Swiss consumers. A familiar domain, a normal ordering process and a genuine business do not guarantee that every element of a web page remains safe. The compromise occurred inside the trusted service itself, at the point where customers expected to complete payment.

The fake form carried a clue that customers could have noticed. The payment pop-up was written in English, while the rest of the affected page was in German. That language mismatch did not prevent the form from collecting details, but it offered a warning sign for users familiar with the site’s normal Swiss payment flow.

The Federal Office for Cybersecurity classifies the method as skimming. In e-commerce skimming, criminals insert code into a genuine online shop and capture payment information as customers enter it. Phishing follows a different route, sending people to an imitation website designed to look like the real one. The distinction matters because standard advice to check the web address may not expose a skimming attack on a legitimate domain.

Consumers should treat unexpected payment choices, unfamiliar wording and sudden changes in a checkout process as reasons to stop. They should avoid entering card numbers into a newly appearing form and contact the retailer through an independent channel. The source did not identify the affected provider or state how many customers entered their details, so the scale of the incident remains unclear.

An unexplained card charge can be the first sign that a trusted shop was compromised. The Federal Office for Cybersecurity advises customers to consider e-commerce skimming when a suspicious transaction follows an online purchase, even if the purchase took place on a well-known website.

The first response should be to contact the bank or credit card provider and dispute fraudulent transactions immediately. Customers should also notify the affected shop and report the incident to the Federal Office for Cybersecurity. Where money has been lost, the agency recommends filing a report with the relevant cantonal police force. Switzerland’s Suisse ePolice platform can help users find the appropriate police station.

Consumers should preserve useful evidence, including order confirmations, dates, payment alerts, screenshots and correspondence with the retailer or bank. They should monitor statements for further unauthorised transactions and follow their card provider’s instructions on blocking or replacing the card. The agency’s advice focuses on speed because a prompt dispute gives the financial institution and investigators relevant information while the transaction and associated account activity remain traceable.