Restaurant Customers Are Ordering From Criminals – Not the Brands They Chose

The Customer Ordered. The Restaurant Never Got the Order.

A customer searches for a restaurant brand, finds its menu, places their usual order and pays. The location that should have fulfilled the order never receives it.

There’s no ticket in the kitchen and no payment in the chain’s ordering system. But the customer is waiting for food and believes they paid the restaurant.

For a national quick-service or fast-casual chain, that missing order is a brand problem that can reach far beyond one location. An impersonating ordering site can intercept customers searching for the brand across multiple markets.

Boomerang Revenue Recovery from Source Defense is designed to redirect those customers to the brand’s real ordering page. It also shows the traffic reaching impersonating sites and gives teams the details of what happened.

Criminals are targeting major restaurant brands

In November 2026, InfoHawk researchers reported finding 820 websites impersonating the ordering pages of 35 U.S. restaurant brands, including national sandwich, chicken and fast-casual chains. Nearly all used lookalike domain names ending in .delivery.

Researchers traced at least 47 Google Search ads promoting the sites between July and October 2026. A customer searching for a chain by name could click an ad and land on an impersonating ordering page.

The ads had stopped running by early November, but 367 of the sites remained online on November 4.

The stolen sale is only the first loss

The brand loses a sale it worked to win. The customer knew what they wanted, searched for the restaurant and tried to order. The sale never reached the chain’s ordering system.

Customers’ payment information is at risk. The fraudulent checkout collects their details under the restaurant’s name. When the food never arrives, location staff and customer support teams may face complaints and refund requests for transactions they cannot find.

One stolen order can cost a brand more than a regular. A customer who believes a restaurant brand took their money may stop ordering, warn friends away and leave a review that drives others away. For a chain with hundreds or thousands of locations, the same impersonating site can reach customers across multiple markets. The complaints land at individual locations, but the damage to trust follows the brand.

Impersonation doesn’t require a platform breach

A chain’s ordering platform can be secure and its checkout can work exactly as intended. These impersonating sites don’t need to breach either one.

In the campaign researchers described, the impersonating sites fetched content from restaurant brands’ real websites. Customers could see current menus and prices while encountering a fraudulent payment step.

The details customers recognize from the brand can make the fraudulent page harder to spot.

Bringing customers back. Measuring the recovery.

Boomerang Revenue Recovery is designed to bring customers back to a brand’s real ordering page, show how much traffic reached impersonating sites and provide evidence of what happened.

Finding and taking down those sites is only part of the response. Restaurant chains also need a way to recover the customers they diverted and understand the business impact.

Giving diverted customers another chance to order

These customers searched for the restaurant brand and tried to order. Boomerang is designed to redirect them from an impersonating site to the legitimate ordering page, giving them a path to place their order with the chain while the fraudulent site is still online.

The chain gets another opportunity to earn the sale, without waiting for a hosting provider or domain registrar to complete a takedown review.

Tracking diverted traffic and recovered sales

A list of fraudulent domains tells a restaurant chain little about the business it may be losing. Boomerang reporting shows traffic reaching impersonating sites, attempted redirects and confirmed arrivals at the legitimate ordering page. Attributed orders and revenue show how much of that returning traffic becomes business.

That gives the chain a view of both the traffic diverted from its brand and the results of bringing customers back.

Take the next step toward recovering lost orders

Book a meeting with Source Defense to discuss priority early access →