23 ms·

Deliveroo users are getting defrauded

280 points by danso 8y ago

martinald 8y ago
I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering? I must be missing something here.
- lultimouomo 8y ago
  Maybe the restaurant is part of the scam, and the food is never prepared? Still it would remain extremely easy to trace the fraudsters.
  - giancarlostoro 8y ago
    I would be shocked if it's that simple and Deliveroo didn't bother looking better into it. If we laymen can figure this out on an online forum in a small amount of time why can't Deliveroo figure it out and report the Restaurants to the police. Worse yet, how is this happening to so many people! I swear we'll hear they got hacked in a few more headlines.
    - EthanV2 8y ago
      It's possible this has already been reported to the police, but we all know they don;t tend to move to fast on things like this, and it's likely Deliveroo doesn't want to risk hurting it's own reputation by shutting out restaurants it suspects are taking part in this scam without enough solid proof that they are definitely in on it
      - giancarlostoro 8y ago
        I mean if they keep using the same exact "restaurant" whose address ends up being an Apartment... It would be really suspect. Not saying this is the case, but it'd be more obvious if it were.
        philpem 8y ago
        If they put the FSA "Scores on the Doors" (and local council) food standards ratings on, the act of looking up the address would tell them something was up. "Address given is not registered as a restaurant or food outlet" (aka: they're not registered with the local council). I've gotten into the habit of checking 'Scores, just because of the sheer number of poor quality food places on Deliveroo, Just Eat and so on.
  - martinald 8y ago
    Makes more sense. But still seems pretty odd and a complex scam (vs say running up fake orders directly with stolen credit cards). If that's not the case you can't resell takeaway food, so no easy way to turn it into cash.
    - lultimouomo 8y ago
      To run fake orders directly you need to steal credit cards info instead of hacking a Deliveroo account, it might be harder.
- conradk 8y ago
  From my experience with Deliveroo, you can pretty much order at any address, wait for the delivery person at the doorstep and retrieve your order without actually living there.
  - entity345 8y ago
    I once asked for delivery to a pub's car park. No problem and the delivery guy did not ask for any ID or anything.
    - coroxout 8y ago
      This is relevant to my interests: I live a few minutes' walk outside the delivery radius for my town, and the nearest identifiable location within the radius is a pub car park. I've heard of people getting deliveries to the middle of the park in summer, or even to a boat waiting beside a road bridge...
      - entity345 8y ago
        That's exactly what happened: I was too far so I set the delivery location to a place they accepted after a few trials and errors.
    - ams6110 8y ago
      A long time ago I used to deliver pizza. We'd never take an order like that, it was an easy way to get robbed (business was pretty much all cash in those days so the drivers always had cash on them). We'd only deliver to an actual numbered street address or apartment.
      - astura 8y ago
        Pubs have numbered street addresses though?
  - martinald 8y ago
    But what you going to do with 3 £100+ takeaway orders back to back? You can hardly resell it!
- pjc50 8y ago
  As with others, I suspect collusion - perhaps not at the restaurant management but definitely among the staff. Order something non-existant, never deliver it, but collect the delivery fee?
- fyfy18 8y ago
  A few years ago I was a 'victim' of identify theft and someone ordered Sky to be installed at my parents address. They thought it was a gift, so gladly let the installation guy go ahead without asking me. I assume they did this to get a bill to be used as proof of address for other things, as I later had bank accounts and phones opened in my name.
- Cthulhu_ 8y ago
  What if the restaurants being ordered at are part of the scam? Steal from a Deliveroo customer, order at restaurant X, the restaurant puts it in their books, then splits the money with the party that broke into the account. As long as there's no proof the two are working together it's a great money laundering scheme.
- iicc 8y ago
  > takeaway food Apparently deliveries can and do include bottled spirits.
- mcintyre1994 8y ago
  You can change delivery address in Deliveroo, maybe they don't make you re-enter payment details like Amazon does when you use a new address? So get into someone's account, use their saved payment to deliver to an arbitrary address and they won't know.
entity345 8y ago
Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card. That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud. As for Deliveroo's support team... Not very good in my experience, but that's common. Their competitors are no better.
- dkersten 8y ago
  That was my first thought too. Yes, I'd contact Deliveroo, but also my bank. If I didn't get a refund (some people waited months?), I'd sue them in a small claims court if the amount is low enough for small claims and if its not, I'd at least talk to a legal adviser. Waiting on Deliveroo for months after being defrauded thousands of pounds is crazy.
  - stuff4ben 8y ago
    Apparently you have waaay more time than I do to sue people in small claims court. Charge back via calling up my CC company is much easier and quicker.
    - dkersten 8y ago
      At least where I am, a small claims claim is a matter of filling out a form and paying the fee. I may be contacted for more information, but don't need to otherwise do anything unless I'm unsatisfied with the outcome, in which case the appeals process goes through a proper court. Besides, I said that I'd only do this if I didn't get a refund through Deliveroo/bank/CC chargeback. I certainly wouldn't start with small claims court.
      - ThrustVectoring 8y ago
        A demand letter is often enough and is a good step before small claims. “Fix my problem in ten days or get sued in small claims court", sent via certified mail to their designated agent for legal service in your jurisdiction, can often solve your problem.
K0nserv 8y ago
I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. On the topic of this story it seems like a case of credential stuffing so it's not a breach in Deliveroo's systems. Do the requirements as a "Data Controller" still apply in such as case? Regardless Deliveroo seems to be handling this poorly. 0: https://twitter.com/K0nserv/status/1087753850088554496 https://twitter.com/K0nserv/status/1087753850088554496
- the_duke 8y ago
  You should report it to the relevant UK agency tasked with GDPR enforcement.
- scrollaway 8y ago
  > I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. I don't believe Deliveroo is obligated to tell you who they send such information to. They are however obligated to tell you that they gather such information and, should they share it with a third party, ensure that said third party is GDPR compliant and sign a data processing agreement with them. Deliveroo doesn't mention Braze directly by name in their privacy policy (https://deliveroo.co.uk/privacy https://deliveroo.co.uk/privacy), but they do let you know that they disclose "information they collect" to, among others, "Marketing and advertising partners". They also mention in the same privacy policy that they "also collect technical information about your use of our services through a mobile device, for example, carrier, location data and performance data". Braze themselves does appear committed to GDPR. That isn't especially surprising, it's a huge selling point for marketing companies towards enterprise customers. https://www.braze.com/product/data-agility-management/regulations-and-compliance/gdpr/ https://www.braze.com/product/data-agility-management/regula... IANAL but I don't believe Deliveroo is in breach of GDPR. The best you can probably do is make a case that they do not have a reasonable justification to collect such highly-accurate location data for that particular use case, and should tone it down to, say, 5km instead of 1m accuracy. If you email dpo@deliveroo.com with such a request, there's a decent chance you could get the change done.
EthanV2 8y ago
By the sounds of it this is a simple credential reuse attack (it's even states as such in the article) so I really don't see where these accusations of a "data breach", and "encryption, which appears not to have been in place” come from. If these fraudulent transactions are the result of credential reuse I really don't see the GDPR violation here.
- maaaats 8y ago
  Yeah, not to defend Deliveroo (that's still abhorrent customer service), but I fail to see how they can back up the allegations of the various breaches. How do they know encryption was not in place?
- mgoetzke 8y ago
  Don't see it either. Nobody said there was an actual breach. Of course a change of delivery address/email/phone or when combined with unusual orders (large amounts) should be flagged and cause 2FA or some other mechanism to request confirmation to the account holder of record.
- mcintyre1994 8y ago
  It sounds like this could be trivially fixed by requiring re-entering payment details if you order to a new address, like Amazon and others do.
tyfon 8y ago
I'm a bit confused, probably since I don't have Apple pay. Does it not use credit cards? It should then be very easy to dispute the charge with the bank.
- K0nserv 8y ago
  I use Apple Pay with both my debit cards. This is in the UK.
  - djmobley 8y ago
    I wouldn’t use my debit card for any purchases. More protections and less hassle using a credit card.
    - quietbritishjim 8y ago
      The big issue for me is that I have a joint bank account with my partner, so using my debit card for that automatically splits the bill. I suppose we could each get a second credit card that we use only for joint transactions and pay those off from the shared account, but that means that the joint balance is now effectively split over three accounts, and at any time each of us can only see the balance on two of them (not the other's credit card). So it's definitely not "less hassle" in that respect.
      - rpeden 8y ago
        I think every credit card I've had has given me the option of adding a second card for a spouse to use. Maybe something like that? Then just make sure you both have access to the online account so you can both view the balance at any time. There's a small amount of extra friction in that you'll have to coordinate a bit to ensure the card is always paid off equitably, but it probably wouldn't be too big a hassle.
        djmobley 8y ago
        No extra friction if you set up a direct debit to pay in full every month from the shared bank account.
whyleyc 8y ago
This is poor form from Deliveroo - their fraud detection seems particularly lacking, and fobbing customers off for months at a time is not good enough. However the article is unnecessarily sensationalist in banding around GDPR data breaches. Much of the article intimates there has been a Deliveroo data breach, whereas in fact the most likely explanation is attackers reusing passwords leaked from other breaches. This is acknowledged towards the end of the article but quickly glossed over. If consumers are reusing exposed passwords this makes life tricky for Deliveroo. Maybe they should be using Troy Hunt's "Pwned passwords" to protect new user signups: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
- edd 8y ago
  From this Deliveroo engineering blog post: https://deliveroo.engineering/2017/09/05/improving-password-security.html https://deliveroo.engineering/2017/09/05/improving-password-... "Therefore, from today, we will be informing our customers when we determine that the password which they use for Deliveroo is publicly known in some way. We will contact the impacted customers to request that they change their password, and advise that they also change that password at other sites where it is also used."
  - whyleyc 8y ago
    Thanks for posting this - I hadn't realised they were already doing it. I'm not sure how else they could be combatting password reuse attacks, short of forcing every user to reset their password. It sounds like their engineering time might be better spent on fraud detection algorithms.
- laurent123456 8y ago
  Also the hackers managed to change the user's email, which Deliveroo could have easily prevented by sending an email first to the original email address. It's hard to prevent people from using bad passwords, but there are a few easy things they can do to prevent hackers from completely taking over accounts.
malka 8y ago
this website makes it a point to make it as annoying as possible to disable all tracking. No option to disable all. full article for whose whom want to read it but not be tracked: Deliveroo users are getting defrauded – and it could be fined millions for it Scammers are using the delivery service to clear out bank accounts, and the company’s response may be in breach of GDPR regulations. By Sarah Manavis Follow @@sarahmanavis Getty Images On Friday morning, I woke up late, rushed to the tube, tapped in with Apple Pay, only to discover a few minutes later that my payment had been declined because I had insufficient funds. Figuring, “Well, it’s January”, I went to check my bank balance. But rather than seeing an overspend or a direct debit I’d forgotten about, I saw three enormous charges from the food delivery service Deliveroo from the night before. They weren’t mine. I immediately called Deliveroo to say that it wasn’t, in fact, me who ordered £100 worth of food in the space of ten minutes in three separate orders; and told them that the fraudsters had changed my email address, so I couldn’t even get into my account to look at where it was sent. I was told that they would investigate, and I would be sent an email asking for more information immediately. I was not. After an hour, I rang again, to find that actually the email had been sent to the new email address – the one the fraudsters plugged in – so that they had presumably been alerted to the investigation. I complained, got the email re-sent to me, and was then met by radio silence for the rest of the day. When I eventually rang again, the company said it couldn’t actually tell me whether or not I would get my money back, adding that I might not hear from them for nearly a week before they let me know either way. By 5pm, I was getting fed up, so I did what any journalist with a modest Twitter following would do, and tweeted. What I thought would happen was that my case would be bumped on the list, and maybe I’d get my money back sooner (or, indeed, at all). What actually happened was that my replies, DMs and email were all immediately flooded with people who had been a victim of the same fraud, saying, yes, this had happened to them too and no, Deliveroo had never refunded them. Of the roughly 40 people I spoke to, not a single one had been refunded by the delivery service; those who did get their money back had got it from their bank. The people tweeting the account claimed to have experienced fraud ranging from the low hundreds of pounds, like my case, to, in some cases, thousands. One person tweeted me to say that a friend of his was fraudulently charged £3,500 on his account. “Deliveroo offered him a £40 credit as a gesture.” More shockingly, nearly half of these people told me that their cases were still technically “under investigation” by Deliveroo, some for over two months. Most of those who had been waiting for more than a week to hear about their case told me Deliveroo had simply stopped responding to their calls. This problem is not actually new. In 2016, the Telegraph ran an expose of rampant fraud on the food-delivery service, and reported on customers’ shock at Deliveroo’s poor handling of the situation. The same day, a BBC Watchdog programme did a feature on Deliveroo fraud, in which Deliveroo claimed that “instances of fraud on our system are rare”. But dating back several years, Deliveroo’s customer service Twitter account, @DeliverooHelp, has responded to claims of fraud nearly every day – often, in recent months, multiple times a day. They may represent only a small percentage of Deliveroo’s wider customer base, but it’s not at all obvious this is “rare”. However, help for customers – and fines for the delivery service – could be coming from Brussels. Laura Irvine, a regulatory lawyer and Partner at Davidson Chalmers, tells me that Deliveroo may have breached the GDPR regulations introduced last year on multiple counts. The General Data Protection Regulation (GDPR), which became European law on 25 May 2018, made sweeping changes to data protection rules across the EU: now, companies are more liable for protecting the data they hold on customers than ever before. Irvine tells me that Deliveroo appears to have breached these regulations three times over. The sixth principle of Article 5, for example, requires companies to have “appropriate security in place to keep your financial and other personal data secure”, she notes. The firm also appears to have breached Article 32, “which provides more detail about what is expected in terms of data security – namely encryption, which appears not to have been in place”. Lastly, there’s Article 34, which requires the “data controller” – that’s Deliveroo – to tell “anyone who may be affected by a data breach about it without undue delay. This applies when the breach is likely to result in a high risk of an impact on the individual. Getting your bank account emptied would, I suggest, meet that threshold.” So what fines could Deliveroo face, if it were to be found guilty of these data breaches? “It could be millions of pounds,” Irvine says. She emphasised that this is a big “could” – the millions of pounds they could be fined would be the upper end of the spectrum. But it is entirely possible, especially given the criticism the Information Commissioner’s Office (ICO) has faced for the small size of its fines in the past. “They were criticised for the small fine imposed on Facebook – £500,000 which was the maximum under the old law,” she tells me. “So I think they will want to use their powers. And they need to keep up with the other regulators,” she adds, noting that Google recently faced a €50m fine in France for breaching GDPR. That said, there are some things that could spare Deliveroo from this fate: if, say, Deliveroo had told the ICO about the data breach within 72 hours, the threshold for fines would be lowered. But, Irvine says, the high volume of incidents and the reported response from Deliveroo suggest they aren’t informing the ICO of their data protection problems. “They may blame other parties, but at the end of the day if you give them your data then they remain responsible – in most cases,” she says. “I am not sure how the bank would stop this.” I put all this to Deliveroo. A spokesperson told me: “Deliveroo takes online security very seriously. Sadly fraudsters rely on the fact that people reuse the same passwords on multiple online services to try and gain entry to different accounts across the web.” Ultimately, though, fines are not the only problems that data leaks of this sort pose to firms like Deliveroo. “Soon people will stop using companies based on how responsible they are with data,” she says. “Particularly financial data – but even your address being out there can be uncomfortable or dangerous for some people.” If she’s right, then this, for Deliveroo, could be just the beginning. Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky.
deleted 8y ago
[deleted]
aboutruby 8y ago
> Deliveroo has blamed the breach on cybercriminals getting hold of login details “stolen from another service unrelated to our company in a major data breach”. > This is despite the company not asking customers to enter a Card Verification Value 2 (CVV2) code when making orders, a card security system designed to ensure that someone ordering something online has physical possession of the card used to pay for it. More info on an article from November 2016: https://nakedsecurity.sophos.com/2016/11/25/fraudsters-eat-for-free-as-deliveroo-accounts-hit-by-mystery-breach/ https://nakedsecurity.sophos.com/2016/11/25/fraudsters-eat-f... BBC's Watchdog documentary: https://www.bbc.co.uk/programmes/articles/3ZMjkWFfDZQ8zFYQJLWFKQM/deliveroo https://www.bbc.co.uk/programmes/articles/3ZMjkWFfDZQ8zFYQJL... (with response from Deliveroo)
kitbrennan 8y ago
I'm not surprised by this response from Deliveroo. Their focus lately has definitely moved away from customer satisfaction. I discovered recently that drivers are allowed - without penalty - to reject an order when they reach the pickup location if they see the receipt and decide it is too far to travel [1]. As a customer you just see your food go: `Assigning Driver -> Driver En Route to Pickup -> Driver Arrived at Pickup Location -> Assigning Driver`, for two hours on repeat. Eventually your cold food arrives 2 hours later, and you are offered £5 credit for your ruined meal. I live in Central London (Old Street), and have had this happen repeatedly with restaurants that are not far from me. [1] = https://www.reddit.com/r/deliveroos/comments/82w97o/riders_only_taking_close_orders/ https://www.reddit.com/r/deliveroos/comments/82w97o/riders_o...
- skh 8y ago
  I think I’m old fashioned but I just don’t understand the appeal of these food delivery services. My friend’s son uses Postmates to order fast food and it seems absurd to me. I must be missing something about theses services given their popularity. Do you mind explaining why you use them?
  - pbalau 8y ago
    I think you are just trying to be that guy. I go to this website, pick what I want, pay and some time later what I ordered gets delivered to my door. What's there to get?
    - ams6110 8y ago
      Fast food is pretty bad when it's fresh. It's awful after it's been in transit for 20-30 minutes or more. The idea of spending $10 or more to get a lukewarm burger and mushy limp french fries has no appeal to me.
      - astura 8y ago
        I think people are ordering from more upscale restaurants, not McDonalds. Food temperature is a personal preference, some people are really picky about food being hot/fresh, some aren't. I prefer the taste of room temperature food over hot food so "sitting around for 20 minutes" would be a feature for me.
fredley 8y ago
I thought this was going to be about ordering food from one restaurant, only to have it prepared in another 'sublicensed' kitchen, sometimes a shipping container: https://www.theguardian.com/business/2017/oct/28/deliveroo-dark-kitchens-pop-up-feeding-the-city-london https://www.theguardian.com/business/2017/oct/28/deliveroo-d...
- himlion 8y ago
  Is this actually shady? When doing takeaway you are not really paying for the ambiance of the restaurant anyway and IF the quality is the same I wouldn't necessarily have a problem with it.
  - Deestan 8y ago
    > IF the quality is the same That's the thing. It isn't. Every franchise, big or small, has wildly different quality of ingredients and preparation (and even send the correct damn drink and remember the dip) among outlets, and if I order from that one, I want that one to prepare my food.
    - rubyboss 8y ago
      Deliveroo Editions sites are clearly marked on the app with a banner across the main photo of the restaurant. You aren't led to believe the food is coming from somewhere it isn't.
      - fredley 8y ago
        > banner across the main photo of the restaurant > You aren't led to believe the food is coming from somewhere it isn't. I think we have different definitions of what being 'led to believe' is.
    - stronglikedan 8y ago
      Even down to the cook (not even "chef"). I go to a specific restaurant on a weekly basis, where I know the names of the cooks. I order different dishes depending solely on who's working that day, since I know which get prepared best by who.
vivan 8y ago
It sounds very much like this journalist is trying to make a mountain out of a mole hill. The real story is that Deliveroo does not handle fraud properly. This is a much lesser crime than what they are being accused of. The author wants to make it seem like Deliveroo has had a data leak and are trying to hide the fact. There is no evidence of this, but if it did turn out to be true then the author would be able to claim that they broke the story.
- jwdunne 8y ago
  If I recall, there's no distinction between an en masse data leak and someone being able to access your personal info without authority under GDPR. Both are a data breech. It seems like many people have been affected by this too so clearly Deliveroo doesn't have the mechanisms in place to protect user information. The fact unauthorized people can spend your money through Deliveroo is even worse. Deliveroo are responsible for the data you give them. If they fuck up and allow unauthorized people access to that data, they're in breech of the GDPR. If they haven't informed ICO (and equivalent in any country within GDPR rules) within 72 hours of each breech, they're in even deeper shit. First, they have to be clear about the scale of the breech and what exactly has gone wrong. They've got to be able to demonstrate the steps they've taken to mitigate the issue and prevent it happening in future. If people are complaining on a regular basis for months, they've not done that.
  - vivan 8y ago
    Do you have a source for that? If that is the case then pretty much every major website is in breach. Credential stuffing is rampant and very easy to do these days. It's not the website's fault that the user gave out their password. However, I do agree that Deliveroo needs to do more to protect users against this. 2-factor authentication, email confirmation from a new IP, re-entry of card details when ordering to a new address are all simple ways to handle this. Deliveroo has not prioritised this because their main priority is growth.
    - snowwolf 8y ago
      In the UK, the ICO guidelines are "A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." The key part being "unauthorised disclosure of, or access to, personal data." So does credential stuffing qualify - In my opinion yes, as it is unauthorised access to personal data. They then go on to say "When a personal data breach has occurred, you need to establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then you must notify the ICO;" And again, the ability to place orders and deliver them to a new address charging the existing credit card I think qualifies as a severe and likely risk. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Edited to add: In the absence of any legal precedent I’d challenge you to find any lawyer who’d confidently say that credential stuffing definitely doesn’t meet the criteria.
anonknowsaguy 8y ago
Fun fact about Deliveroo. A lot of your drivers aren't the registered driver. It's really common practice for a citizen or someone with a work visa to register and then rent their phone to someone desperate with no work visa. So your driver is often making almost nothing while someone else sits on their ass and collects cash for doing nothing and then Deliveroo again sits on their ass providing poor service collecting even more cash.
- rubyboss 8y ago
  So are you saying there are bands of Deliveroo riders in England who are here on 6-month tourist visas? Or are you saying they are in the country illegaly?
  - anonknowsaguy 8y ago
    I've only seen this happen to people on student visas that permit little or no working hours.
    - ams6110 8y ago
      Students will do all kinds of "harmless" under the table stuff to get/save a little extra spending money. That's different to me than an person desperate for money to pay rent or buy food.
      - anonknowsaguy 8y ago
        That's certainly true and they are illegally working. But maybe your image of a student might be a bit narrow? There's a large industry in Europe of language schools. You pay the school/country a few thousand euros/pounds and in return you get a student visa + basic language course. Not all, but many students are coming from pretty bad places in the hope of somehow landing a work visa(Italy and Portugal will grant citizenship if you can prove ancestry for example). The friends of my wife that told me about their lives/this practice, none of them where working for "spending money".
CaptainZapp 8y ago
“Deliveroo takes online security very seriously. Sadly fraudsters rely on the fact that people reuse the same passwords on multiple online services to try and gain entry to different accounts across the web.” Yeah! Blame it on your customers! Way to go! Sigh! Another gig economy service I'm damn sure never to use.
- jwdunne 8y ago
  That's not even an excuse. There are solutions out there that mitigate the fact people reuse the same passwords.
  - philpem 8y ago
    I'd love to see a more specific version of Troy Hunt's "have I been pwned" API which explicitly blocked user/password combinations which had been leaked. The catch is, you'd have to store the pairs together which then makes you a target, so in practice the best you can really do is what's on offer already -- check that the password hasn't been leaked (and maybe if the email address has a high HIBP leak count). That solution would seem to force people into password managers and random high-entropy passwords or passphrases...
  - randerson 8y ago
    Example solutions that wouldn't result in a massive customer drop-off though? The average person isn't going to set up 2FA or remember a randomly generated password just for a food delivery website.
- OliverJones 8y ago
  "...takes online security very seriously..." That is a statement that means its exact opposite. If you get breached, don't let that phrase creep into your announcement. Just say "We were breached. We're sorry. We're cleaning up the mess." or whatever.
ensiferum 8y ago
Disrupt disrupt disrupt. Avoid any liability for any damages or frauds, employ gig workers, grow 10x, be a unicorn make the investors wealthier than before and outsource the negative externalities to society.
thisisit 8y ago
I am wonder if good fraud detection is one of things routinely ignored by unicorns trying to get explosive growth. First, we had ridersharing companies where drivers could start rides without their customers. Then were digital wallets getting hacked left, right and center (in India).
loktarogar 8y ago
Of all the job interviews i've done, Deliveroo stands out as the only company that gave me a trick interview test - said specifically not to write a feature, and when I didn't, they rejected me on that ground. Not surprising their whole business is like this.
- StellarTabi 8y ago
  I wonder what this says about their company culture or enforcement of ethics.
- datenhorst 8y ago
  Why would they do that anyway?
  - loktarogar 8y ago
    As they explained it, they wanted people who "went above and beyond"
    - kaybe 8y ago
      To the point of ignoring clear directions? Ok..
    - swish_bob 8y ago
      Bullet dodged ...
sergioisidoro 8y ago
This kind of articles and journalism makes me a bit uneasy. This article only exists because the Journalist was affected. If anyone would contact the this paper saying company X has fraudsters leveraging their service (which is not uncommon), this article would never have been written. That aside, I've been on the other side, resolving cases like this. Sometimes cases are complex, take months to figure out while involving multiple stakeholders (police, banks, payment processors, etc), and you have no idea who to trust on the other side of a phone line (it can be a victim, it can be the fraudster).
- Doctor_Fegg 8y ago
  This kind of reflex journalism hate makes me uneasy. > If anyone would contact the this paper saying company X has fraudsters leveraging their service (which is not uncommon), this article would never have been written. You don't know that. The New Statesman is an excellent magazine and has run plenty of investigations in its time.
  - sergioisidoro 8y ago
    It's not journalist hate, and I'm not attacking The New Statesman, I'm criticising this article. If the article would be about the growing problem of online fraud (which is growing quite steadily), and not only about Delivaroo, I would be happy. Yes, I do know that, because as I said I've been on the other side and the number of articles covering individual companies being targeted by fraudsters is low compared with the number of cases. Regardless of the motives that sparked the article, it still brings attention to the topic, which is positive.
johnnycab 8y ago
Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky. The author's experience is not uncommon and seems sensationalised to create a Twitter storm and garnering sympathy, which is uncharacteristic for a journo, who writes about 'tech and digital culture'. It would have been more apt to go into triage mode i.e. stop the bleed of finances and dispute transactions immediately, before entering into communications with the delivery firm. After a resolution, choose to go turbo and further explore the implications of GDPR, then write about your experience in detail. The article does not leave the reader any more informed or equipped to deal with such a fraud. It does not even pretend to offer any piecemeal advice e.g. don't use/re-use easily guessed passwords, use 2FA, use credit cards or virtual/disposable cards, contact your bank/issuer first, don't bother contacting low-level support via social media, explore data protection laws after a resolution etc.
OptionX 8y ago
I find it funny how the new "I know I guy" is the "I tweeted to my many followers" when it comes to dealing with problems.
aembleton 8y ago
Another good reason to use a fintech bank account such as Monzo [1] or a credit card such as Tandem [2] or a virtual card that can forward transactions onto any other card such as Curve [3]. All of these services can give you a push notification every time a transaction is made on your account so that you are immediately made aware and are able to cancel them. You can block the card from within the app immediately. 1. http://join.monzo.com/r/vrlkxvo http://join.monzo.com/r/vrlkxvo (Using this link gives us both £5) 2. https://www.tandem.co.uk/credit-card/ https://www.tandem.co.uk/credit-card/ 3. https://www.imaginecurve.com/ https://www.imaginecurve.com/ (Sign up with WAI91 and we both get £5)
- wil421 8y ago
  Amex has the same thing and their customer protections are generally better than the Fintech companies. Although Amex is not so common in the U.K. Do any UK credit card companies offer consumer and fraud protection above the norm? Amex would immediately side with me if I showed them the Deliveroo communication. Another Citi VISA I had offered 18 months warranties on laptops and other electronics if I used the card.
  - aembleton 8y ago
    The only one I've needed to claim against was Curve. I lost my wallet and my card was used in a McDonalds. I knew immediately and froze the card. Curve then refunded me a week later, when I contacted them. Thanks for letting me know about Amex doing this. Might provide better customer service and many places do accept it.
  - C1sc0cat 8y ago
    A lot of places in the UK especially low cost places wont accept amex because of the charges. I saw my mangers amex get declined when they tried to pay for a team meal (15 people) a few years ago
    - wil421 8y ago
      Yes at least the U.K. isn’t as obsessed with cash as Germany is. I had trouble until on of my Europoeran colleagues told me about Amex Vicinity. You can see places around you and it can make it easier to use corporate Amex cards.[1] [1]https://www430.americanexpress.com/mrec/mersearch/index?intcLang=en_US&dom_country=US https://www430.americanexpress.com/mrec/mersearch/index?intc...
JackFr 8y ago
Calling the police seems like an important thing the author didn't seem to do. This is not a nuisance, it's a crime. I am less interested in fining Deliveroo, rather I would like to see them forced to cooperate with law enforcement to prosecute thieves.
simias 8y ago
Maybe I'm missing the point but how did the fraud take place to begin with? Somebody fished the author's Deliveroo account and used it to buy a lot of food? If so what would be the right way for Deliveroo to solve the issue? I mean if they just swallow the cost and reimburse her with no questions asked it seems easy to abuse, I could just order a lot of food then later complain that my account has been breached. Then again that's pretty much what Amazon does in these situations in my experience but not everybody has Amazon's deep pockets... That's not to say that their current response (or lack thereof) isn't bad, it's more that I'm not sure what would be a good response in this situation. I'm also not sure how Deliveroo could be considered liable if the breach is on the user's side (phished password) rather than a server-side vulnerability. If I offer an online service and one user gets their password stolen, would I be liable for that? If so, what should I do if somebody claims that their account was stolen? What if they're actually lying to get access to a legit account?
- vivan 8y ago
  Standard security practices: not allow delivery to a new address without reconfirming credit card details, sending email confirmation upon login from a new location/device, and in the more extreme cases, 2 factor auth.
  - simias 8y ago
    That makes a lot of sense now that you point it out. Thank you.
sschueller 8y ago
After Brexit (March 29, 2019) is the GDPR still valid?
- detaro 8y ago
  I believe the current plan is to keep laws as they are until parliament gets around to replacing them, so I'd expect the equivalent of GDPR (without the EU-coordination bits) to apply for at least a while.
- s_dev 8y ago
  Presuming the UK actually exits. They can still withdraw A50 -- or possibly extend it but the EU has cast doubt on this. Even if it does exit -- EU will have incredible influence over the UK and can effectively enforce GDPR on most companies over a certain size as those companies will have to create entities and corporate structers in the EU for varying reasons -- mostly tax minimisation for exporting. Little sole traders with no amibition of expanding outside the UK will probably have the benefit of not having it enforceable on them. Again this presumes the UK chooses not to implement it's own data protection laws.
deleted 8y ago
[deleted]
HenryBemis 8y ago
Fun fact regarding newstatesman.com I am a user of NoScript, AdBlockPlus (still using 2.9.1), with its "Element Hiding Helper for Adblock Plus". My NoScript had already blocked 24 domains, which I guess I have added in the years before. I proceeded to block another 6-7. When the site reloaded, and was perfecly visible, the count was "Untrusted (13)". Which means the original 6-7 that I 'just' blocked were loading at least another 12. And then companies are wondering why Noscript, uBlock, etc. are so popular and complain about when we care about our privacy!
resca79 8y ago
I did one order in Milan with deliveroo, from that day I receive kind of emails and phone calls from different call centers.
neya 8y ago
There is one more aspect of fraud the journalist has missed - chargeback fraud. Chargeback fraud is where companies try to lengthen the timeline of resolution of a fraudulent incident such as this one so that it exceeds your bank's official timeline for being eligible for getting your money back. Usually it's about 45-60 days and varies from bank to bank. To me, as someone who worked in this industry before, this simply seems like a ploy by Deliveroo to escape absorbing the chargeback cost. Because, that is exactly what would happen if you called your credit card's bank/company and ask them to initiate a charge back for the fraudulent transactions instead of begging Deliveroo - the money will first be refunded to you almost immediately (varies from bank to bank) and then an investigation will be opened against the merchant in question (in this case, Deliveroo) and when you prove your credit card company valid proof that you're innocent by sharing logs, screenshots, etc. the dispute would be settled and the bank will side with you, the customer and thus this will lead to a loss on the merchant to bear the fraudulent transacted amount. It seems, Deliveroo may be doing EXACTLY this to avoid letting the customer becoming eligible for a refund later through their banks by pushing them past the chargeback window. This is actually criminal in some countries, and grounds for a class action suit, which I hope someone sues them for if they are found guilty of this. The other reason for the elongated resolution timelines is because Deliveroo actually benefits from these transactions - think about it, they earn for each transaction and in some markets, if I'm not wrong, the larger the transaction, the more they earn. So, why would they do something fast that affects their revenues negatively. Anyway, my personal experience with Deliveroo also has never been positive and don't recommend them at all.
rzwitserloot 8y ago
It sounds like the GDPR is more or less unrelated and those fines are not forthcoming. If deliveroo's own analysis is correct (and that is admittedly an 'if', but if you come out and say 'we hash our passwords, and you can quote me', let's assume they aren't complete morons in thinking that nobody on their staff would ever leak it if they didn't), then the problem is not that there has been a security breach over at deliveroo. The problem is merely that [1] Their handling of a breach of account info that they weren't the cause of is very bad, both not investigating / blocking the recipients of the food orders (clearly 'whitewashing' fronts), or even trying to take it seriously, and [2] doing a bad job at enabling (or even motivating) their users to have good account security. Anywhere from scanning such credentials lists out in the wild and autoblocking any user/pass combo that is also a valid deliveroo login, to offering TOTP. Both are, to be clear, very bad. Deliveroo deserves all the scorn they are getting. But neither of these issues is something you can be fined for, at least, not via GDPR.
netik 8y ago
All of this discussion about the company here (which isn’t responding in a correct and honest way) and not much discussion on the root cause of this problem. The journalist and the 40+ People were victims of a credential stuffing attack which means they used the same password on multiple sites. Had they used a password manager to roll a new password per site and had deliveroo had proper rate limiting, this attack would have been mostly mitigated. There’s not much excuse for this behavior.
randyrand 8y ago
Pretty bad pronoun use in the headline.
femto113 8y ago
Credential stuffing attacks aren't a valid excuse IMO, and should not make this sort of fraud possible. Amazon for example instituted a very simple and effective policy years ago: if you want to deliver something to a new address using an existing payment method you need to reenter the payment details. This means even if someone guesses your username and password and you have a valid CC on file they still can't send a package to some arbitrary new address. It's conceivable that the fraud is on the merchant side, with a restaurant faking a large order to an existing address, but in that case Deliveroo still has responsibility for allowing bad merchants into the system.
- zackify 8y ago
  I actually found the other day, if I edit an existing address, it doesn’t make me re-enter payment details. But adding a new one does. Not sure if this was due to a trusted device or if it always does it though.
vivan 8y ago
Interestingly the same author had a very different opinion when the same was happening to someone else. https://www.newstatesman.com/science-tech/internet/2018/09/gdpr-easier-access-data-hackers-access-online-security-spotify https://www.newstatesman.com/science-tech/internet/2018/09/g... > Although what Spotify has done, or failed to do, by handing over data to whoever is logged in on an account, could be considered irresponsible, it is in no way illegal – and, in all likelihood, is generally the norm.
MagicPropmaker 8y ago
> (Later – a lot later – a Deliveroo spokesman would tell me it was likely I had been the victim of a “credential stuffing” attack, in which hackers obtain lists of usernames and passwords and try them out on other platforms.) So this Tech Journalist uses the same password on every site?
- DoctorOetker 8y ago
  the real issue IMHO is the "credential stuffing attack" makes no sense: hungry people getting their hands on leaked password dumps? a bunch of black hat hackers running a Delivery clone, getting clean money from customers, but really getting an innocent Delivery user get charged, and having the order be sent to the address of the customer? none of this makes sense! It seems to me like the corruption or fraud is within Deliveroo.
adlkjnndnnd 8y ago
Zero proof seems to be given in the article that it is Deliveroo's fault. While they probably should be more helpful, spreading the accusations based on guesswork seems to be yet another example of shoddy modern journalism.
Jewell14 8y ago
My husband and I had two state tax liens in New York that were listed as Joint Responsibility. We both did a lot of to get this off our credit but all effort doesn't yield result. so we decided it was best to go online in search of a reliable Credit agency who understands the credit system to come to our rescue and just after a deep search i came across Cyber Hack and emailed him at cyberhack005@gmail .com. I told him about withdrawing our tax liens from my credit report and he explain to me the whole process to help me solve this. After some days we both got an agreement tax liens were completely gone after running his hack and my credit scores being raised to golden scores I. He sent me verification of good work he had done on my credit he sent and I checked my credit report to confirmed and it's exactly what he sent me I found on 3 credit bureaus.. I couldn't have imagined my life so good so fast
DoctorOetker 8y ago
I don't understand? hungry people are buying leaked credentials? black-hat hackers are selling meals through a competing service to customers who then open the door for a Deliveroo guy? None of this is making sense! Either the fraud is within Deliveroo (dig deeper!), or locating the served customer will result in the discovery of some kind of weird low-usage "stolen credential delivery of Deliveroo foods" service (dig deeper!) This is not properly fleshed out IMHO... but yeah lets market and compare credit and debit cards and point systems and pffff

280 points by danso 8y ago

I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering? I must be missing something here.

lultimouomo 8y ago
Maybe the restaurant is part of the scam, and the food is never prepared? Still it would remain extremely easy to trace the fraudsters.
- giancarlostoro 8y ago
  I would be shocked if it's that simple and Deliveroo didn't bother looking better into it. If we laymen can figure this out on an online forum in a small amount of time why can't Deliveroo figure it out and report the Restaurants to the police. Worse yet, how is this happening to so many people! I swear we'll hear they got hacked in a few more headlines.
  - EthanV2 8y ago
    It's possible this has already been reported to the police, but we all know they don;t tend to move to fast on things like this, and it's likely Deliveroo doesn't want to risk hurting it's own reputation by shutting out restaurants it suspects are taking part in this scam without enough solid proof that they are definitely in on it
    - giancarlostoro 8y ago
      I mean if they keep using the same exact "restaurant" whose address ends up being an Apartment... It would be really suspect. Not saying this is the case, but it'd be more obvious if it were.
      - philpem 8y ago
        If they put the FSA "Scores on the Doors" (and local council) food standards ratings on, the act of looking up the address would tell them something was up. "Address given is not registered as a restaurant or food outlet" (aka: they're not registered with the local council). I've gotten into the habit of checking 'Scores, just because of the sheer number of poor quality food places on Deliveroo, Just Eat and so on.
- martinald 8y ago
  Makes more sense. But still seems pretty odd and a complex scam (vs say running up fake orders directly with stolen credit cards). If that's not the case you can't resell takeaway food, so no easy way to turn it into cash.
  - lultimouomo 8y ago
    To run fake orders directly you need to steal credit cards info instead of hacking a Deliveroo account, it might be harder.
conradk 8y ago
From my experience with Deliveroo, you can pretty much order at any address, wait for the delivery person at the doorstep and retrieve your order without actually living there.
- entity345 8y ago
  I once asked for delivery to a pub's car park. No problem and the delivery guy did not ask for any ID or anything.
  - coroxout 8y ago
    This is relevant to my interests: I live a few minutes' walk outside the delivery radius for my town, and the nearest identifiable location within the radius is a pub car park. I've heard of people getting deliveries to the middle of the park in summer, or even to a boat waiting beside a road bridge...
    - entity345 8y ago
      That's exactly what happened: I was too far so I set the delivery location to a place they accepted after a few trials and errors.
  - ams6110 8y ago
    A long time ago I used to deliver pizza. We'd never take an order like that, it was an easy way to get robbed (business was pretty much all cash in those days so the drivers always had cash on them). We'd only deliver to an actual numbered street address or apartment.
    - astura 8y ago
      Pubs have numbered street addresses though?
- martinald 8y ago
  But what you going to do with 3 £100+ takeaway orders back to back? You can hardly resell it!
pjc50 8y ago
As with others, I suspect collusion - perhaps not at the restaurant management but definitely among the staff. Order something non-existant, never deliver it, but collect the delivery fee?
fyfy18 8y ago
A few years ago I was a 'victim' of identify theft and someone ordered Sky to be installed at my parents address. They thought it was a gift, so gladly let the installation guy go ahead without asking me. I assume they did this to get a bill to be used as proof of address for other things, as I later had bank accounts and phones opened in my name.
Cthulhu_ 8y ago
What if the restaurants being ordered at are part of the scam? Steal from a Deliveroo customer, order at restaurant X, the restaurant puts it in their books, then splits the money with the party that broke into the account. As long as there's no proof the two are working together it's a great money laundering scheme.
iicc 8y ago
> takeaway food Apparently deliveries can and do include bottled spirits.
mcintyre1994 8y ago
You can change delivery address in Deliveroo, maybe they don't make you re-enter payment details like Amazon does when you use a new address? So get into someone's account, use their saved payment to deliver to an arbitrary address and they won't know.

entity345 8y ago

Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card. That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud. As for Deliveroo's support team... Not very good in my experience, but that's common. Their competitors are no better.

dkersten 8y ago
That was my first thought too. Yes, I'd contact Deliveroo, but also my bank. If I didn't get a refund (some people waited months?), I'd sue them in a small claims court if the amount is low enough for small claims and if its not, I'd at least talk to a legal adviser. Waiting on Deliveroo for months after being defrauded thousands of pounds is crazy.
- stuff4ben 8y ago
  Apparently you have waaay more time than I do to sue people in small claims court. Charge back via calling up my CC company is much easier and quicker.
  - dkersten 8y ago
    At least where I am, a small claims claim is a matter of filling out a form and paying the fee. I may be contacted for more information, but don't need to otherwise do anything unless I'm unsatisfied with the outcome, in which case the appeals process goes through a proper court. Besides, I said that I'd only do this if I didn't get a refund through Deliveroo/bank/CC chargeback. I certainly wouldn't start with small claims court.
    - ThrustVectoring 8y ago
      A demand letter is often enough and is a good step before small claims. “Fix my problem in ten days or get sued in small claims court", sent via certified mail to their designated agent for legal service in your jurisdiction, can often solve your problem.

K0nserv 8y ago

I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. On the topic of this story it seems like a case of credential stuffing so it's not a breach in Deliveroo's systems. Do the requirements as a "Data Controller" still apply in such as case? Regardless Deliveroo seems to be handling this poorly. 0: https://twitter.com/K0nserv/status/1087753850088554496 https://twitter.com/K0nserv/status/1087753850088554496

the_duke 8y ago
You should report it to the relevant UK agency tasked with GDPR enforcement.
scrollaway 8y ago
> I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. I don't believe Deliveroo is obligated to tell you who they send such information to. They are however obligated to tell you that they gather such information and, should they share it with a third party, ensure that said third party is GDPR compliant and sign a data processing agreement with them. Deliveroo doesn't mention Braze directly by name in their privacy policy (https://deliveroo.co.uk/privacy https://deliveroo.co.uk/privacy), but they do let you know that they disclose "information they collect" to, among others, "Marketing and advertising partners". They also mention in the same privacy policy that they "also collect technical information about your use of our services through a mobile device, for example, carrier, location data and performance data". Braze themselves does appear committed to GDPR. That isn't especially surprising, it's a huge selling point for marketing companies towards enterprise customers. https://www.braze.com/product/data-agility-management/regulations-and-compliance/gdpr/ https://www.braze.com/product/data-agility-management/regula... IANAL but I don't believe Deliveroo is in breach of GDPR. The best you can probably do is make a case that they do not have a reasonable justification to collect such highly-accurate location data for that particular use case, and should tone it down to, say, 5km instead of 1m accuracy. If you email dpo@deliveroo.com with such a request, there's a decent chance you could get the change done.

EthanV2 8y ago

By the sounds of it this is a simple credential reuse attack (it's even states as such in the article) so I really don't see where these accusations of a "data breach", and "encryption, which appears not to have been in place” come from. If these fraudulent transactions are the result of credential reuse I really don't see the GDPR violation here.

maaaats 8y ago
Yeah, not to defend Deliveroo (that's still abhorrent customer service), but I fail to see how they can back up the allegations of the various breaches. How do they know encryption was not in place?
mgoetzke 8y ago
Don't see it either. Nobody said there was an actual breach. Of course a change of delivery address/email/phone or when combined with unusual orders (large amounts) should be flagged and cause 2FA or some other mechanism to request confirmation to the account holder of record.
mcintyre1994 8y ago
It sounds like this could be trivially fixed by requiring re-entering payment details if you order to a new address, like Amazon and others do.

tyfon 8y ago

I'm a bit confused, probably since I don't have Apple pay. Does it not use credit cards? It should then be very easy to dispute the charge with the bank.

K0nserv 8y ago
I use Apple Pay with both my debit cards. This is in the UK.
- djmobley 8y ago
  I wouldn’t use my debit card for any purchases. More protections and less hassle using a credit card.
  - quietbritishjim 8y ago
    The big issue for me is that I have a joint bank account with my partner, so using my debit card for that automatically splits the bill. I suppose we could each get a second credit card that we use only for joint transactions and pay those off from the shared account, but that means that the joint balance is now effectively split over three accounts, and at any time each of us can only see the balance on two of them (not the other's credit card). So it's definitely not "less hassle" in that respect.
    - rpeden 8y ago
      I think every credit card I've had has given me the option of adding a second card for a spouse to use. Maybe something like that? Then just make sure you both have access to the online account so you can both view the balance at any time. There's a small amount of extra friction in that you'll have to coordinate a bit to ensure the card is always paid off equitably, but it probably wouldn't be too big a hassle.
      - djmobley 8y ago
        No extra friction if you set up a direct debit to pay in full every month from the shared bank account.

whyleyc 8y ago

This is poor form from Deliveroo - their fraud detection seems particularly lacking, and fobbing customers off for months at a time is not good enough. However the article is unnecessarily sensationalist in banding around GDPR data breaches. Much of the article intimates there has been a Deliveroo data breach, whereas in fact the most likely explanation is attackers reusing passwords leaked from other breaches. This is acknowledged towards the end of the article but quickly glossed over. If consumers are reusing exposed passwords this makes life tricky for Deliveroo. Maybe they should be using Troy Hunt's "Pwned passwords" to protect new user signups: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

edd 8y ago
From this Deliveroo engineering blog post: https://deliveroo.engineering/2017/09/05/improving-password-security.html https://deliveroo.engineering/2017/09/05/improving-password-... "Therefore, from today, we will be informing our customers when we determine that the password which they use for Deliveroo is publicly known in some way. We will contact the impacted customers to request that they change their password, and advise that they also change that password at other sites where it is also used."
- whyleyc 8y ago
  Thanks for posting this - I hadn't realised they were already doing it. I'm not sure how else they could be combatting password reuse attacks, short of forcing every user to reset their password. It sounds like their engineering time might be better spent on fraud detection algorithms.
laurent123456 8y ago
Also the hackers managed to change the user's email, which Deliveroo could have easily prevented by sending an email first to the original email address. It's hard to prevent people from using bad passwords, but there are a few easy things they can do to prevent hackers from completely taking over accounts.

malka 8y ago

this website makes it a point to make it as annoying as possible to disable all tracking. No option to disable all. full article for whose whom want to read it but not be tracked: Deliveroo users are getting defrauded – and it could be fined millions for it Scammers are using the delivery service to clear out bank accounts, and the company’s response may be in breach of GDPR regulations. By Sarah Manavis Follow @@sarahmanavis Getty Images On Friday morning, I woke up late, rushed to the tube, tapped in with Apple Pay, only to discover a few minutes later that my payment had been declined because I had insufficient funds. Figuring, “Well, it’s January”, I went to check my bank balance. But rather than seeing an overspend or a direct debit I’d forgotten about, I saw three enormous charges from the food delivery service Deliveroo from the night before. They weren’t mine. I immediately called Deliveroo to say that it wasn’t, in fact, me who ordered £100 worth of food in the space of ten minutes in three separate orders; and told them that the fraudsters had changed my email address, so I couldn’t even get into my account to look at where it was sent. I was told that they would investigate, and I would be sent an email asking for more information immediately. I was not. After an hour, I rang again, to find that actually the email had been sent to the new email address – the one the fraudsters plugged in – so that they had presumably been alerted to the investigation. I complained, got the email re-sent to me, and was then met by radio silence for the rest of the day. When I eventually rang again, the company said it couldn’t actually tell me whether or not I would get my money back, adding that I might not hear from them for nearly a week before they let me know either way. By 5pm, I was getting fed up, so I did what any journalist with a modest Twitter following would do, and tweeted. What I thought would happen was that my case would be bumped on the list, and maybe I’d get my money back sooner (or, indeed, at all). What actually happened was that my replies, DMs and email were all immediately flooded with people who had been a victim of the same fraud, saying, yes, this had happened to them too and no, Deliveroo had never refunded them. Of the roughly 40 people I spoke to, not a single one had been refunded by the delivery service; those who did get their money back had got it from their bank. The people tweeting the account claimed to have experienced fraud ranging from the low hundreds of pounds, like my case, to, in some cases, thousands. One person tweeted me to say that a friend of his was fraudulently charged £3,500 on his account. “Deliveroo offered him a £40 credit as a gesture.” More shockingly, nearly half of these people told me that their cases were still technically “under investigation” by Deliveroo, some for over two months. Most of those who had been waiting for more than a week to hear about their case told me Deliveroo had simply stopped responding to their calls. This problem is not actually new. In 2016, the Telegraph ran an expose of rampant fraud on the food-delivery service, and reported on customers’ shock at Deliveroo’s poor handling of the situation. The same day, a BBC Watchdog programme did a feature on Deliveroo fraud, in which Deliveroo claimed that “instances of fraud on our system are rare”. But dating back several years, Deliveroo’s customer service Twitter account, @DeliverooHelp, has responded to claims of fraud nearly every day – often, in recent months, multiple times a day. They may represent only a small percentage of Deliveroo’s wider customer base, but it’s not at all obvious this is “rare”. However, help for customers – and fines for the delivery service – could be coming from Brussels. Laura Irvine, a regulatory lawyer and Partner at Davidson Chalmers, tells me that Deliveroo may have breached the GDPR regulations introduced last year on multiple counts. The General Data Protection Regulation (GDPR), which became European law on 25 May 2018, made sweeping changes to data protection rules across the EU: now, companies are more liable for protecting the data they hold on customers than ever before. Irvine tells me that Deliveroo appears to have breached these regulations three times over. The sixth principle of Article 5, for example, requires companies to have “appropriate security in place to keep your financial and other personal data secure”, she notes. The firm also appears to have breached Article 32, “which provides more detail about what is expected in terms of data security – namely encryption, which appears not to have been in place”. Lastly, there’s Article 34, which requires the “data controller” – that’s Deliveroo – to tell “anyone who may be affected by a data breach about it without undue delay. This applies when the breach is likely to result in a high risk of an impact on the individual. Getting your bank account emptied would, I suggest, meet that threshold.” So what fines could Deliveroo face, if it were to be found guilty of these data breaches? “It could be millions of pounds,” Irvine says. She emphasised that this is a big “could” – the millions of pounds they could be fined would be the upper end of the spectrum. But it is entirely possible, especially given the criticism the Information Commissioner’s Office (ICO) has faced for the small size of its fines in the past. “They were criticised for the small fine imposed on Facebook – £500,000 which was the maximum under the old law,” she tells me. “So I think they will want to use their powers. And they need to keep up with the other regulators,” she adds, noting that Google recently faced a €50m fine in France for breaching GDPR. That said, there are some things that could spare Deliveroo from this fate: if, say, Deliveroo had told the ICO about the data breach within 72 hours, the threshold for fines would be lowered. But, Irvine says, the high volume of incidents and the reported response from Deliveroo suggest they aren’t informing the ICO of their data protection problems. “They may blame other parties, but at the end of the day if you give them your data then they remain responsible – in most cases,” she says. “I am not sure how the bank would stop this.” I put all this to Deliveroo. A spokesperson told me: “Deliveroo takes online security very seriously. Sadly fraudsters rely on the fact that people reuse the same passwords on multiple online services to try and gain entry to different accounts across the web.” Ultimately, though, fines are not the only problems that data leaks of this sort pose to firms like Deliveroo. “Soon people will stop using companies based on how responsible they are with data,” she says. “Particularly financial data – but even your address being out there can be uncomfortable or dangerous for some people.” If she’s right, then this, for Deliveroo, could be just the beginning. Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky.

deleted 8y ago

[deleted]

aboutruby 8y ago

> Deliveroo has blamed the breach on cybercriminals getting hold of login details “stolen from another service unrelated to our company in a major data breach”. > This is despite the company not asking customers to enter a Card Verification Value 2 (CVV2) code when making orders, a card security system designed to ensure that someone ordering something online has physical possession of the card used to pay for it. More info on an article from November 2016: https://nakedsecurity.sophos.com/2016/11/25/fraudsters-eat-for-free-as-deliveroo-accounts-hit-by-mystery-breach/ https://nakedsecurity.sophos.com/2016/11/25/fraudsters-eat-f... BBC's Watchdog documentary: https://www.bbc.co.uk/programmes/articles/3ZMjkWFfDZQ8zFYQJLWFKQM/deliveroo https://www.bbc.co.uk/programmes/articles/3ZMjkWFfDZQ8zFYQJL... (with response from Deliveroo)

kitbrennan 8y ago

I'm not surprised by this response from Deliveroo. Their focus lately has definitely moved away from customer satisfaction. I discovered recently that drivers are allowed - without penalty - to reject an order when they reach the pickup location if they see the receipt and decide it is too far to travel [1]. As a customer you just see your food go: `Assigning Driver -> Driver En Route to Pickup -> Driver Arrived at Pickup Location -> Assigning Driver`, for two hours on repeat. Eventually your cold food arrives 2 hours later, and you are offered £5 credit for your ruined meal. I live in Central London (Old Street), and have had this happen repeatedly with restaurants that are not far from me. [1] = https://www.reddit.com/r/deliveroos/comments/82w97o/riders_only_taking_close_orders/ https://www.reddit.com/r/deliveroos/comments/82w97o/riders_o...

skh 8y ago
I think I’m old fashioned but I just don’t understand the appeal of these food delivery services. My friend’s son uses Postmates to order fast food and it seems absurd to me. I must be missing something about theses services given their popularity. Do you mind explaining why you use them?
- pbalau 8y ago
  I think you are just trying to be that guy. I go to this website, pick what I want, pay and some time later what I ordered gets delivered to my door. What's there to get?
  - ams6110 8y ago
    Fast food is pretty bad when it's fresh. It's awful after it's been in transit for 20-30 minutes or more. The idea of spending $10 or more to get a lukewarm burger and mushy limp french fries has no appeal to me.
    - astura 8y ago
      I think people are ordering from more upscale restaurants, not McDonalds. Food temperature is a personal preference, some people are really picky about food being hot/fresh, some aren't. I prefer the taste of room temperature food over hot food so "sitting around for 20 minutes" would be a feature for me.

fredley 8y ago

I thought this was going to be about ordering food from one restaurant, only to have it prepared in another 'sublicensed' kitchen, sometimes a shipping container: https://www.theguardian.com/business/2017/oct/28/deliveroo-dark-kitchens-pop-up-feeding-the-city-london https://www.theguardian.com/business/2017/oct/28/deliveroo-d...

himlion 8y ago
Is this actually shady? When doing takeaway you are not really paying for the ambiance of the restaurant anyway and IF the quality is the same I wouldn't necessarily have a problem with it.
- Deestan 8y ago
  > IF the quality is the same That's the thing. It isn't. Every franchise, big or small, has wildly different quality of ingredients and preparation (and even send the correct damn drink and remember the dip) among outlets, and if I order from that one, I want that one to prepare my food.
  - rubyboss 8y ago
    Deliveroo Editions sites are clearly marked on the app with a banner across the main photo of the restaurant. You aren't led to believe the food is coming from somewhere it isn't.
    - fredley 8y ago
      > banner across the main photo of the restaurant > You aren't led to believe the food is coming from somewhere it isn't. I think we have different definitions of what being 'led to believe' is.
  - stronglikedan 8y ago
    Even down to the cook (not even "chef"). I go to a specific restaurant on a weekly basis, where I know the names of the cooks. I order different dishes depending solely on who's working that day, since I know which get prepared best by who.

vivan 8y ago

It sounds very much like this journalist is trying to make a mountain out of a mole hill. The real story is that Deliveroo does not handle fraud properly. This is a much lesser crime than what they are being accused of. The author wants to make it seem like Deliveroo has had a data leak and are trying to hide the fact. There is no evidence of this, but if it did turn out to be true then the author would be able to claim that they broke the story.

jwdunne 8y ago
If I recall, there's no distinction between an en masse data leak and someone being able to access your personal info without authority under GDPR. Both are a data breech. It seems like many people have been affected by this too so clearly Deliveroo doesn't have the mechanisms in place to protect user information. The fact unauthorized people can spend your money through Deliveroo is even worse. Deliveroo are responsible for the data you give them. If they fuck up and allow unauthorized people access to that data, they're in breech of the GDPR. If they haven't informed ICO (and equivalent in any country within GDPR rules) within 72 hours of each breech, they're in even deeper shit. First, they have to be clear about the scale of the breech and what exactly has gone wrong. They've got to be able to demonstrate the steps they've taken to mitigate the issue and prevent it happening in future. If people are complaining on a regular basis for months, they've not done that.
- vivan 8y ago
  Do you have a source for that? If that is the case then pretty much every major website is in breach. Credential stuffing is rampant and very easy to do these days. It's not the website's fault that the user gave out their password. However, I do agree that Deliveroo needs to do more to protect users against this. 2-factor authentication, email confirmation from a new IP, re-entry of card details when ordering to a new address are all simple ways to handle this. Deliveroo has not prioritised this because their main priority is growth.
  - snowwolf 8y ago
    In the UK, the ICO guidelines are "A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." The key part being "unauthorised disclosure of, or access to, personal data." So does credential stuffing qualify - In my opinion yes, as it is unauthorised access to personal data. They then go on to say "When a personal data breach has occurred, you need to establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then you must notify the ICO;" And again, the ability to place orders and deliver them to a new address charging the existing credit card I think qualifies as a severe and likely risk. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Edited to add: In the absence of any legal precedent I’d challenge you to find any lawyer who’d confidently say that credential stuffing definitely doesn’t meet the criteria.

anonknowsaguy 8y ago

Fun fact about Deliveroo. A lot of your drivers aren't the registered driver. It's really common practice for a citizen or someone with a work visa to register and then rent their phone to someone desperate with no work visa. So your driver is often making almost nothing while someone else sits on their ass and collects cash for doing nothing and then Deliveroo again sits on their ass providing poor service collecting even more cash.

rubyboss 8y ago
So are you saying there are bands of Deliveroo riders in England who are here on 6-month tourist visas? Or are you saying they are in the country illegaly?
- anonknowsaguy 8y ago
  I've only seen this happen to people on student visas that permit little or no working hours.
  - ams6110 8y ago
    Students will do all kinds of "harmless" under the table stuff to get/save a little extra spending money. That's different to me than an person desperate for money to pay rent or buy food.
    - anonknowsaguy 8y ago
      That's certainly true and they are illegally working. But maybe your image of a student might be a bit narrow? There's a large industry in Europe of language schools. You pay the school/country a few thousand euros/pounds and in return you get a student visa + basic language course. Not all, but many students are coming from pretty bad places in the hope of somehow landing a work visa(Italy and Portugal will grant citizenship if you can prove ancestry for example). The friends of my wife that told me about their lives/this practice, none of them where working for "spending money".

CaptainZapp 8y ago

“Deliveroo takes online security very seriously. Sadly fraudsters rely on the fact that people reuse the same passwords on multiple online services to try and gain entry to different accounts across the web.” Yeah! Blame it on your customers! Way to go! Sigh! Another gig economy service I'm damn sure never to use.

jwdunne 8y ago
That's not even an excuse. There are solutions out there that mitigate the fact people reuse the same passwords.
- philpem 8y ago
  I'd love to see a more specific version of Troy Hunt's "have I been pwned" API which explicitly blocked user/password combinations which had been leaked. The catch is, you'd have to store the pairs together which then makes you a target, so in practice the best you can really do is what's on offer already -- check that the password hasn't been leaked (and maybe if the email address has a high HIBP leak count). That solution would seem to force people into password managers and random high-entropy passwords or passphrases...
- randerson 8y ago
  Example solutions that wouldn't result in a massive customer drop-off though? The average person isn't going to set up 2FA or remember a randomly generated password just for a food delivery website.
OliverJones 8y ago
"...takes online security very seriously..." That is a statement that means its exact opposite. If you get breached, don't let that phrase creep into your announcement. Just say "We were breached. We're sorry. We're cleaning up the mess." or whatever.

ensiferum 8y ago

Disrupt disrupt disrupt. Avoid any liability for any damages or frauds, employ gig workers, grow 10x, be a unicorn make the investors wealthier than before and outsource the negative externalities to society.

thisisit 8y ago

I am wonder if good fraud detection is one of things routinely ignored by unicorns trying to get explosive growth. First, we had ridersharing companies where drivers could start rides without their customers. Then were digital wallets getting hacked left, right and center (in India).

loktarogar 8y ago

Of all the job interviews i've done, Deliveroo stands out as the only company that gave me a trick interview test - said specifically not to write a feature, and when I didn't, they rejected me on that ground. Not surprising their whole business is like this.

StellarTabi 8y ago
I wonder what this says about their company culture or enforcement of ethics.
datenhorst 8y ago
Why would they do that anyway?
- loktarogar 8y ago
  As they explained it, they wanted people who "went above and beyond"
  - kaybe 8y ago
    To the point of ignoring clear directions? Ok..
  - swish_bob 8y ago
    Bullet dodged ...

sergioisidoro 8y ago

This kind of articles and journalism makes me a bit uneasy. This article only exists because the Journalist was affected. If anyone would contact the this paper saying company X has fraudsters leveraging their service (which is not uncommon), this article would never have been written. That aside, I've been on the other side, resolving cases like this. Sometimes cases are complex, take months to figure out while involving multiple stakeholders (police, banks, payment processors, etc), and you have no idea who to trust on the other side of a phone line (it can be a victim, it can be the fraudster).

Doctor_Fegg 8y ago
This kind of reflex journalism hate makes me uneasy. > If anyone would contact the this paper saying company X has fraudsters leveraging their service (which is not uncommon), this article would never have been written. You don't know that. The New Statesman is an excellent magazine and has run plenty of investigations in its time.
- sergioisidoro 8y ago
  It's not journalist hate, and I'm not attacking The New Statesman, I'm criticising this article. If the article would be about the growing problem of online fraud (which is growing quite steadily), and not only about Delivaroo, I would be happy. Yes, I do know that, because as I said I've been on the other side and the number of articles covering individual companies being targeted by fraudsters is low compared with the number of cases. Regardless of the motives that sparked the article, it still brings attention to the topic, which is positive.

johnnycab 8y ago

Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky. The author's experience is not uncommon and seems sensationalised to create a Twitter storm and garnering sympathy, which is uncharacteristic for a journo, who writes about 'tech and digital culture'. It would have been more apt to go into triage mode i.e. stop the bleed of finances and dispute transactions immediately, before entering into communications with the delivery firm. After a resolution, choose to go turbo and further explore the implications of GDPR, then write about your experience in detail. The article does not leave the reader any more informed or equipped to deal with such a fraud. It does not even pretend to offer any piecemeal advice e.g. don't use/re-use easily guessed passwords, use 2FA, use credit cards or virtual/disposable cards, contact your bank/issuer first, don't bother contacting low-level support via social media, explore data protection laws after a resolution etc.

OptionX 8y ago

I find it funny how the new "I know I guy" is the "I tweeted to my many followers" when it comes to dealing with problems.

aembleton 8y ago

Another good reason to use a fintech bank account such as Monzo [1] or a credit card such as Tandem [2] or a virtual card that can forward transactions onto any other card such as Curve [3]. All of these services can give you a push notification every time a transaction is made on your account so that you are immediately made aware and are able to cancel them. You can block the card from within the app immediately. 1. http://join.monzo.com/r/vrlkxvo http://join.monzo.com/r/vrlkxvo (Using this link gives us both £5) 2. https://www.tandem.co.uk/credit-card/ https://www.tandem.co.uk/credit-card/ 3. https://www.imaginecurve.com/ https://www.imaginecurve.com/ (Sign up with WAI91 and we both get £5)

wil421 8y ago
Amex has the same thing and their customer protections are generally better than the Fintech companies. Although Amex is not so common in the U.K. Do any UK credit card companies offer consumer and fraud protection above the norm? Amex would immediately side with me if I showed them the Deliveroo communication. Another Citi VISA I had offered 18 months warranties on laptops and other electronics if I used the card.
- aembleton 8y ago
  The only one I've needed to claim against was Curve. I lost my wallet and my card was used in a McDonalds. I knew immediately and froze the card. Curve then refunded me a week later, when I contacted them. Thanks for letting me know about Amex doing this. Might provide better customer service and many places do accept it.
- C1sc0cat 8y ago
  A lot of places in the UK especially low cost places wont accept amex because of the charges. I saw my mangers amex get declined when they tried to pay for a team meal (15 people) a few years ago
  - wil421 8y ago
    Yes at least the U.K. isn’t as obsessed with cash as Germany is. I had trouble until on of my Europoeran colleagues told me about Amex Vicinity. You can see places around you and it can make it easier to use corporate Amex cards.[1] [1]https://www430.americanexpress.com/mrec/mersearch/index?intcLang=en_US&dom_country=US https://www430.americanexpress.com/mrec/mersearch/index?intc...

JackFr 8y ago

Calling the police seems like an important thing the author didn't seem to do. This is not a nuisance, it's a crime. I am less interested in fining Deliveroo, rather I would like to see them forced to cooperate with law enforcement to prosecute thieves.

simias 8y ago

Maybe I'm missing the point but how did the fraud take place to begin with? Somebody fished the author's Deliveroo account and used it to buy a lot of food? If so what would be the right way for Deliveroo to solve the issue? I mean if they just swallow the cost and reimburse her with no questions asked it seems easy to abuse, I could just order a lot of food then later complain that my account has been breached. Then again that's pretty much what Amazon does in these situations in my experience but not everybody has Amazon's deep pockets... That's not to say that their current response (or lack thereof) isn't bad, it's more that I'm not sure what would be a good response in this situation. I'm also not sure how Deliveroo could be considered liable if the breach is on the user's side (phished password) rather than a server-side vulnerability. If I offer an online service and one user gets their password stolen, would I be liable for that? If so, what should I do if somebody claims that their account was stolen? What if they're actually lying to get access to a legit account?

vivan 8y ago
Standard security practices: not allow delivery to a new address without reconfirming credit card details, sending email confirmation upon login from a new location/device, and in the more extreme cases, 2 factor auth.
- simias 8y ago
  That makes a lot of sense now that you point it out. Thank you.

sschueller 8y ago

After Brexit (March 29, 2019) is the GDPR still valid?

detaro 8y ago
I believe the current plan is to keep laws as they are until parliament gets around to replacing them, so I'd expect the equivalent of GDPR (without the EU-coordination bits) to apply for at least a while.
s_dev 8y ago
Presuming the UK actually exits. They can still withdraw A50 -- or possibly extend it but the EU has cast doubt on this. Even if it does exit -- EU will have incredible influence over the UK and can effectively enforce GDPR on most companies over a certain size as those companies will have to create entities and corporate structers in the EU for varying reasons -- mostly tax minimisation for exporting. Little sole traders with no amibition of expanding outside the UK will probably have the benefit of not having it enforceable on them. Again this presumes the UK chooses not to implement it's own data protection laws.

deleted 8y ago

[deleted]

HenryBemis 8y ago

Fun fact regarding newstatesman.com I am a user of NoScript, AdBlockPlus (still using 2.9.1), with its "Element Hiding Helper for Adblock Plus". My NoScript had already blocked 24 domains, which I guess I have added in the years before. I proceeded to block another 6-7. When the site reloaded, and was perfecly visible, the count was "Untrusted (13)". Which means the original 6-7 that I 'just' blocked were loading at least another 12. And then companies are wondering why Noscript, uBlock, etc. are so popular and complain about when we care about our privacy!

resca79 8y ago

I did one order in Milan with deliveroo, from that day I receive kind of emails and phone calls from different call centers.

neya 8y ago

There is one more aspect of fraud the journalist has missed - chargeback fraud. Chargeback fraud is where companies try to lengthen the timeline of resolution of a fraudulent incident such as this one so that it exceeds your bank's official timeline for being eligible for getting your money back. Usually it's about 45-60 days and varies from bank to bank. To me, as someone who worked in this industry before, this simply seems like a ploy by Deliveroo to escape absorbing the chargeback cost. Because, that is exactly what would happen if you called your credit card's bank/company and ask them to initiate a charge back for the fraudulent transactions instead of begging Deliveroo - the money will first be refunded to you almost immediately (varies from bank to bank) and then an investigation will be opened against the merchant in question (in this case, Deliveroo) and when you prove your credit card company valid proof that you're innocent by sharing logs, screenshots, etc. the dispute would be settled and the bank will side with you, the customer and thus this will lead to a loss on the merchant to bear the fraudulent transacted amount. It seems, Deliveroo may be doing EXACTLY this to avoid letting the customer becoming eligible for a refund later through their banks by pushing them past the chargeback window. This is actually criminal in some countries, and grounds for a class action suit, which I hope someone sues them for if they are found guilty of this. The other reason for the elongated resolution timelines is because Deliveroo actually benefits from these transactions - think about it, they earn for each transaction and in some markets, if I'm not wrong, the larger the transaction, the more they earn. So, why would they do something fast that affects their revenues negatively. Anyway, my personal experience with Deliveroo also has never been positive and don't recommend them at all.

rzwitserloot 8y ago

It sounds like the GDPR is more or less unrelated and those fines are not forthcoming. If deliveroo's own analysis is correct (and that is admittedly an 'if', but if you come out and say 'we hash our passwords, and you can quote me', let's assume they aren't complete morons in thinking that nobody on their staff would ever leak it if they didn't), then the problem is not that there has been a security breach over at deliveroo. The problem is merely that [1] Their handling of a breach of account info that they weren't the cause of is very bad, both not investigating / blocking the recipients of the food orders (clearly 'whitewashing' fronts), or even trying to take it seriously, and [2] doing a bad job at enabling (or even motivating) their users to have good account security. Anywhere from scanning such credentials lists out in the wild and autoblocking any user/pass combo that is also a valid deliveroo login, to offering TOTP. Both are, to be clear, very bad. Deliveroo deserves all the scorn they are getting. But neither of these issues is something you can be fined for, at least, not via GDPR.

netik 8y ago

All of this discussion about the company here (which isn’t responding in a correct and honest way) and not much discussion on the root cause of this problem. The journalist and the 40+ People were victims of a credential stuffing attack which means they used the same password on multiple sites. Had they used a password manager to roll a new password per site and had deliveroo had proper rate limiting, this attack would have been mostly mitigated. There’s not much excuse for this behavior.

randyrand 8y ago

Pretty bad pronoun use in the headline.

femto113 8y ago

Credential stuffing attacks aren't a valid excuse IMO, and should not make this sort of fraud possible. Amazon for example instituted a very simple and effective policy years ago: if you want to deliver something to a new address using an existing payment method you need to reenter the payment details. This means even if someone guesses your username and password and you have a valid CC on file they still can't send a package to some arbitrary new address. It's conceivable that the fraud is on the merchant side, with a restaurant faking a large order to an existing address, but in that case Deliveroo still has responsibility for allowing bad merchants into the system.

zackify 8y ago
I actually found the other day, if I edit an existing address, it doesn’t make me re-enter payment details. But adding a new one does. Not sure if this was due to a trusted device or if it always does it though.

vivan 8y ago

Interestingly the same author had a very different opinion when the same was happening to someone else. https://www.newstatesman.com/science-tech/internet/2018/09/gdpr-easier-access-data-hackers-access-online-security-spotify https://www.newstatesman.com/science-tech/internet/2018/09/g... > Although what Spotify has done, or failed to do, by handing over data to whoever is logged in on an account, could be considered irresponsible, it is in no way illegal – and, in all likelihood, is generally the norm.

MagicPropmaker 8y ago

> (Later – a lot later – a Deliveroo spokesman would tell me it was likely I had been the victim of a “credential stuffing” attack, in which hackers obtain lists of usernames and passwords and try them out on other platforms.) So this Tech Journalist uses the same password on every site?

DoctorOetker 8y ago
the real issue IMHO is the "credential stuffing attack" makes no sense: hungry people getting their hands on leaked password dumps? a bunch of black hat hackers running a Delivery clone, getting clean money from customers, but really getting an innocent Delivery user get charged, and having the order be sent to the address of the customer? none of this makes sense! It seems to me like the corruption or fraud is within Deliveroo.

adlkjnndnnd 8y ago

Zero proof seems to be given in the article that it is Deliveroo's fault. While they probably should be more helpful, spreading the accusations based on guesswork seems to be yet another example of shoddy modern journalism.

Jewell14 8y ago

My husband and I had two state tax liens in New York that were listed as Joint Responsibility. We both did a lot of to get this off our credit but all effort doesn't yield result. so we decided it was best to go online in search of a reliable Credit agency who understands the credit system to come to our rescue and just after a deep search i came across Cyber Hack and emailed him at cyberhack005@gmail .com. I told him about withdrawing our tax liens from my credit report and he explain to me the whole process to help me solve this. After some days we both got an agreement tax liens were completely gone after running his hack and my credit scores being raised to golden scores I. He sent me verification of good work he had done on my credit he sent and I checked my credit report to confirmed and it's exactly what he sent me I found on 3 credit bureaus.. I couldn't have imagined my life so good so fast

DoctorOetker 8y ago

I don't understand? hungry people are buying leaked credentials? black-hat hackers are selling meals through a competing service to customers who then open the door for a Deliveroo guy? None of this is making sense! Either the fraud is within Deliveroo (dig deeper!), or locating the served customer will result in the discovery of some kind of weird low-usage "stolen credential delivery of Deliveroo foods" service (dig deeper!) This is not properly fleshed out IMHO... but yeah lets market and compare credit and debit cards and point systems and pffff