5 ms·

Domino's Pizza in the UK recommend changing password and checking bank statement

36 points by philbo 10y ago

wlkr 10y ago
A while ago I was at my house with friends and was looking to order takeaway. Collectively we didn't have enough cash on hand to pay on delivery so we looked at various apps, JustEat, Domino's and the like. Domino's were written off instantly when we discovered we couldn't use a third party service like PayPal. If major tech companies can't manage their security properly I have little faith in Fast Food outlets investing in getting it right. I know they don't think they have been breached, and this may well be the case, but do they really need to be storing sensitive data at all? Edit: turns out you can use PayPal (see below), ignore me I'm wrong!
- Tomdarkness 10y ago
  You've been able to pay for Dominos in the UK via PayPal for years now.
  - jackvalentine 10y ago
    Ditto Australia.
  - wlkr 10y ago
    Hmm, thanks! I'm not sure why we couldn't figure that out. I can't remember if we were using the app or the website, I just know we were using mobiles.
    - kryptonic 10y ago
      Hm, I can't remember exactly what the condition is, but I know there is a situation in which they won't except PayPal because it's happened to me before. I think that might be if your order is under £10, or if you're collecting or something like that.
- Natsu 10y ago
  That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a less secure password and therefore make me mistrust how they store data in general.
  - jrockway 10y ago
    Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.
    - pbhjpbhj 10y ago
      Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money. They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone. tl;dr that probably hides a big financial risk [for the poor].
    - Natsu 10y ago
      Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.
- wyager 10y ago
  Maybe this is just a regional thing, but why in the world are you trying to pay for takeout with PayPal? If I'm with friends, one of us pays with a credit card or cash and the rest of us give them cash or square cash/venmo/bitcoin/whatever is mutually agreeable. Half the point of a credit card is that transactions are repudiable for like 6 months, so if some careless food joint gets your credit card info stolen, it's not a huge inconvenience. You just call your bank, reverse the transaction, and get a new card in the mail in a day or two. The real solution, of course, is to have push-based rather than pull-based digital payment systems, but consumer finance moves slowly.
  - mulmen 10y ago
    This happens to me at least once a year but I still consider it a huge inconvenience. Two days is an eternity, especially to be without my primary card. I don't wait that long for socks from Amazon. One day is generally my expectation at this point and for a lot of things it's same day. I'd really like to see banks/card companies step up their game in getting new cards out to people.
    - lucaspiller 10y ago
      Talking about the time it takes to get something, passports in the U.K. are ridiculous. I had mine stolen a few years ago while abroad, and had to get a replacement from my embassy. They gave me a one-time-use 'emergency passport', which looks basically the same as a normal passport except it's smaller and I guess doesn't have biometric features - inside it looks the same. It took them a total of 1 hour to make it. When I came home I needed a new one as I was supposed to be moving abroad a couple of weeks later. The earliest appointment (which is supposedly faster than doing it by post) they could give me was after 1 month, and after that I still had to wait a week for it to arrive. My wife is from Lithuania (EU country) and when we got married she went to the passport office (just walk in and wait) and got a new passport the next day.
  - wlkr 10y ago
    None of us (students) had credit cards and we frequently used PayPal to cover the scenarios you mentioned. As a group it just became easy to all use the one app for requesting/sending smaller amounts of money. You can do it through a phone number which makes it quite simple even if it's not the best way.
- rudedogg 10y ago
  I think just like a year or two ago PayPal wouldn't let me use a good generated password due to it being too long. Edit: Just checked and the limit is still 20 characters :\
johnnyg 10y ago
NPR's Marketplace did an interview with Domino's CEO a few years back and surprisingly, one of the things he said was top on his list was digital security. Smart man. Also, a company that is detecting breaching of this kind has its eyes open. Not only aren't they breached, but they are out there explaining how it happened to a tiny portion of their customer base and warning others who are using poor password management practices. A hat tip to you Dominos Pizza. Here's the interview: https://www.marketplace.org/2015/09/24/business/corner-office-marketplace/dominos-patrick-doyle-making-perfect-pepperoni https://www.marketplace.org/2015/09/24/business/corner-offic...
- vinay427 10y ago
  There are a variety of projects that students from my university as well as other companies especially on Michigan collaborate with Domino's on. One of my favorites is the new Domino's specialized delivery car [1], and a pizza pick-up cart with accompanying mobile apps that will hopefully make it to production sometime in the future. [1]: http://www.dominosdxp.com http://www.dominosdxp.com
  - cmdrfred 10y ago
    Reminds me of Snow Crash.
- squeaky-clean 10y ago
  If what they say in the memo is true, and by the domain name (an email marketing service, and not their official site?), it seems like an individual email, and not a general public message. Maybe they're just running customer's emails through a service like haveibeenpwned, and emailing the ones that return results. Apparently several major UK services have had account leaks recently, and I bet Domino's is an easy target for fraud. I don't know anything about the company/CEO's policy, but I worked as a driver for them beginning around ~2011, and I'd have to say, they really had their s--t together on the tech front. For example, the "Pizza Tracker" is entirely real and accurate (which always amazes my friends), it's actually just a side effect of the system they have to track inventory and paying employees (an employee has to enter their ID at each station and select and order. So maybe Henry isn't actually the person doing the "quality check", but he's the person who punched in his ID and approved it). I worked at a few less experienced delivery places afterwards and the experience was just awful comparatively.
deleted 10y ago
[deleted]
morganvachon 10y ago
It wasn't just the UK. Two days ago my wife's Domino's account and her stored credit card were compromised. Someone in Texas ordered pizza on her dime (we live in Atlanta). At first she thought it was just her card and the thief had tested it with a Domino's order, but she also got an email from Domino's about the order itself. She immediately filed a claim and canceled the card, and she contacted Domino's about it. Their response was along the lines of "We're not going to do anything about a $40 order, but thanks for reporting it, and good luck with your credit card." It was infuriating to say the least. Thankfully her card issuer (Amazon Visa card via Chase bank) reversed the charge without a problem.
- chipperyman573 10y ago
  It's weird that they didn't offer a refund, the next logical step for any consumer would be to file a chargeback, which Domino's has to pay for (in addition to the money she was refunded through the chargeback)
  - morganvachon 10y ago
    It's my understanding from her conversation with the credit card company that it's not being processed as a chargeback, but as a payment reversal. No extra fees to Domino's, they are just out a bit of food at one of their (likely franchisee) restaurants.
    - willstrafach 10y ago
      That's not how it works. Payment reversal is only possible via chargeback or by the vendor themselves refunding the charge, so Domino's will absolutely get a fee.
      - morganvachon 10y ago
        Then either we misunderstood the credit card company, or they misinformed us. Either way, it was handled promptly and nearly painlessly, something I didn't expect given my past experience with someone gaining access to my credit card information. Times have changed.
TazeTSchnitzel 10y ago
One of the nice things about takeaway food delivery is you don't always need to give a service your payment details, if they accept cash on delivery. Domino's don't even need an account.

36 points by philbo 10y ago

wlkr 10y ago

A while ago I was at my house with friends and was looking to order takeaway. Collectively we didn't have enough cash on hand to pay on delivery so we looked at various apps, JustEat, Domino's and the like. Domino's were written off instantly when we discovered we couldn't use a third party service like PayPal. If major tech companies can't manage their security properly I have little faith in Fast Food outlets investing in getting it right. I know they don't think they have been breached, and this may well be the case, but do they really need to be storing sensitive data at all? Edit: turns out you can use PayPal (see below), ignore me I'm wrong!

Tomdarkness 10y ago
You've been able to pay for Dominos in the UK via PayPal for years now.
- jackvalentine 10y ago
  Ditto Australia.
- wlkr 10y ago
  Hmm, thanks! I'm not sure why we couldn't figure that out. I can't remember if we were using the app or the website, I just know we were using mobiles.
  - kryptonic 10y ago
    Hm, I can't remember exactly what the condition is, but I know there is a situation in which they won't except PayPal because it's happened to me before. I think that might be if your order is under £10, or if you're collecting or something like that.
Natsu 10y ago
That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a less secure password and therefore make me mistrust how they store data in general.
- jrockway 10y ago
  Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.
  - pbhjpbhj 10y ago
    Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money. They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone. tl;dr that probably hides a big financial risk [for the poor].
  - Natsu 10y ago
    Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.
wyager 10y ago
Maybe this is just a regional thing, but why in the world are you trying to pay for takeout with PayPal? If I'm with friends, one of us pays with a credit card or cash and the rest of us give them cash or square cash/venmo/bitcoin/whatever is mutually agreeable. Half the point of a credit card is that transactions are repudiable for like 6 months, so if some careless food joint gets your credit card info stolen, it's not a huge inconvenience. You just call your bank, reverse the transaction, and get a new card in the mail in a day or two. The real solution, of course, is to have push-based rather than pull-based digital payment systems, but consumer finance moves slowly.
- mulmen 10y ago
  This happens to me at least once a year but I still consider it a huge inconvenience. Two days is an eternity, especially to be without my primary card. I don't wait that long for socks from Amazon. One day is generally my expectation at this point and for a lot of things it's same day. I'd really like to see banks/card companies step up their game in getting new cards out to people.
  - lucaspiller 10y ago
    Talking about the time it takes to get something, passports in the U.K. are ridiculous. I had mine stolen a few years ago while abroad, and had to get a replacement from my embassy. They gave me a one-time-use 'emergency passport', which looks basically the same as a normal passport except it's smaller and I guess doesn't have biometric features - inside it looks the same. It took them a total of 1 hour to make it. When I came home I needed a new one as I was supposed to be moving abroad a couple of weeks later. The earliest appointment (which is supposedly faster than doing it by post) they could give me was after 1 month, and after that I still had to wait a week for it to arrive. My wife is from Lithuania (EU country) and when we got married she went to the passport office (just walk in and wait) and got a new passport the next day.
- wlkr 10y ago
  None of us (students) had credit cards and we frequently used PayPal to cover the scenarios you mentioned. As a group it just became easy to all use the one app for requesting/sending smaller amounts of money. You can do it through a phone number which makes it quite simple even if it's not the best way.
rudedogg 10y ago
I think just like a year or two ago PayPal wouldn't let me use a good generated password due to it being too long. Edit: Just checked and the limit is still 20 characters :\

johnnyg 10y ago

NPR's Marketplace did an interview with Domino's CEO a few years back and surprisingly, one of the things he said was top on his list was digital security. Smart man. Also, a company that is detecting breaching of this kind has its eyes open. Not only aren't they breached, but they are out there explaining how it happened to a tiny portion of their customer base and warning others who are using poor password management practices. A hat tip to you Dominos Pizza. Here's the interview: https://www.marketplace.org/2015/09/24/business/corner-office-marketplace/dominos-patrick-doyle-making-perfect-pepperoni https://www.marketplace.org/2015/09/24/business/corner-offic...

vinay427 10y ago
There are a variety of projects that students from my university as well as other companies especially on Michigan collaborate with Domino's on. One of my favorites is the new Domino's specialized delivery car [1], and a pizza pick-up cart with accompanying mobile apps that will hopefully make it to production sometime in the future. [1]: http://www.dominosdxp.com http://www.dominosdxp.com
- cmdrfred 10y ago
  Reminds me of Snow Crash.
squeaky-clean 10y ago
If what they say in the memo is true, and by the domain name (an email marketing service, and not their official site?), it seems like an individual email, and not a general public message. Maybe they're just running customer's emails through a service like haveibeenpwned, and emailing the ones that return results. Apparently several major UK services have had account leaks recently, and I bet Domino's is an easy target for fraud. I don't know anything about the company/CEO's policy, but I worked as a driver for them beginning around ~2011, and I'd have to say, they really had their s--t together on the tech front. For example, the "Pizza Tracker" is entirely real and accurate (which always amazes my friends), it's actually just a side effect of the system they have to track inventory and paying employees (an employee has to enter their ID at each station and select and order. So maybe Henry isn't actually the person doing the "quality check", but he's the person who punched in his ID and approved it). I worked at a few less experienced delivery places afterwards and the experience was just awful comparatively.

deleted 10y ago

[deleted]

morganvachon 10y ago

It wasn't just the UK. Two days ago my wife's Domino's account and her stored credit card were compromised. Someone in Texas ordered pizza on her dime (we live in Atlanta). At first she thought it was just her card and the thief had tested it with a Domino's order, but she also got an email from Domino's about the order itself. She immediately filed a claim and canceled the card, and she contacted Domino's about it. Their response was along the lines of "We're not going to do anything about a $40 order, but thanks for reporting it, and good luck with your credit card." It was infuriating to say the least. Thankfully her card issuer (Amazon Visa card via Chase bank) reversed the charge without a problem.

chipperyman573 10y ago
It's weird that they didn't offer a refund, the next logical step for any consumer would be to file a chargeback, which Domino's has to pay for (in addition to the money she was refunded through the chargeback)
- morganvachon 10y ago
  It's my understanding from her conversation with the credit card company that it's not being processed as a chargeback, but as a payment reversal. No extra fees to Domino's, they are just out a bit of food at one of their (likely franchisee) restaurants.
  - willstrafach 10y ago
    That's not how it works. Payment reversal is only possible via chargeback or by the vendor themselves refunding the charge, so Domino's will absolutely get a fee.
    - morganvachon 10y ago
      Then either we misunderstood the credit card company, or they misinformed us. Either way, it was handled promptly and nearly painlessly, something I didn't expect given my past experience with someone gaining access to my credit card information. Times have changed.

TazeTSchnitzel 10y ago

One of the nice things about takeaway food delivery is you don't always need to give a service your payment details, if they accept cash on delivery. Domino's don't even need an account.