How a fake food-delivery payment page stole Swiss customers’ card details

A familiar food order became a card-theft trap on September 1, 2026. Switzerland’s Federal Office for Cybersecurity warned that criminals had altered the payment page of a food-delivery service, allowing them to collect customers’ credit-card details while the site itself remained genuine.

The attack matters because customers did not necessarily visit an obviously fake website. They reached a legitimate provider, selected a payment option and followed a familiar checkout process. The malicious code had been inserted into the provider’s website and changed what customers saw at the point of payment.

The agency described the method as e-commerce skimming. Unlike a conventional phishing scam, the attackers did not need to lure every victim to a separate imitation site. They compromised part of the real shopping experience and used it to capture payment data.

The warning does not identify the affected food-delivery provider in the supplied information, and it gives no figure for the number of exposed customers. Anyone who used the affected checkout should review recent and pending card transactions, including small authorisation charges that might precede larger fraudulent payments.

The attackers replaced Twint with a counterfeit credit-card option. According to the Federal Office for Cybersecurity, malicious code injected into the website removed or displaced the provider’s original Twint payment method and presented customers with a fake option labelled for credit-card payments.

Selecting that option opened a pop-up window requesting card information. The details entered there were transmitted directly to the fraudsters. The page then tried to cover its tracks with an error message saying that credit-card payments were still in a test phase and directing customers back to Twint.

One detail should have raised suspicion: the pop-up’s text was in English, while the rest of the food-delivery page was in German. Language inconsistencies can indicate that a payment component has come from an unauthorised source, particularly when a Swiss service normally presents its checkout in one language.

Customers should pause when a familiar payment flow suddenly changes. A new card option, an unexpected pop-up, a request to re-enter information or a message about a payment being tested all warrant a fresh check through the company’s official support channels. Do not use contact details supplied inside a suspicious window.

Skimming happens inside a genuine website, which makes it difficult for ordinary shoppers to detect. Phishing usually sends a victim to a fake website designed to imitate a bank, retailer or public service. In this case, the payment page of a real food-delivery provider had been manipulated.

That distinction changes what customers should look for. The padlock symbol and correct web address may still appear because the underlying site is authentic. A customer can therefore complete the order on a legitimate domain and still hand card data to criminals through a compromised checkout element.

The Federal Office for Cybersecurity says it can be “very difficult, if not impossible” for people without specialist knowledge to identify this type of manipulation. That places a substantial responsibility on operators, not only on consumers. Food-delivery platforms and online shops need to monitor checkout behaviour, keep software and plugins updated, apply security patches and protect administrative accounts with strong, unique passwords and two-factor authentication.

Operators should also restrict third-party scripts through a Content Security Policy. Such a policy can control which sources are allowed to run JavaScript and where data may be sent. Automated checkout tests and monitoring can help detect an unexpected payment flow before more customers encounter it.