5 ms·

But what you going to do with 3 £100+ takeaway orders back to back? You can hardly resell it!

philpem 8y ago
Probably something like this: 1) People pay the fraudster for "discounted" food. 2) The fraudster places the order using the stolen account. 3) The fraudster tells the people who paid them: "Go to the pub car park at 9pm and wait for the Deliveroo driver. If he asks, your name is John Smith." 4) Profit.
- kami8845 8y ago
  Indeed, maybe there's an app called "Delilaloo" on the App Store that serves as the frontend for these scams
  - DoctorOetker 8y ago
    but then THAT should be the real story, why did the journalist stop digging? it's also pretty hard to imagine it's worth the effort, you still need to advertise so people know about your service! the service would have suspiciously similar dishes advertised in menus corresponding to original restaurants etc... the unsuspecting customer gets to open the door for a Deliveroo person! there's just so many ways this would go wrong in the real world that it doesnt make sense to invest time and effort in MitM'ing Deliveroo from a limited set of compromised accounts... This all indicates the fraud is happening from within Deliveroo
unforeseen9991 8y ago
Put it in the fridge or freezer? Why would they ever sell it at a loss? Everyone needs food, so they get the value by consuming it themselves.
- ams6110 8y ago
  When you're not paying for it in the first place, there's no "loss." It's all profit.
  - DoctorOetker 8y ago
    what about time, effort and risk of finding leak dumps, thinking through how you can use the data, and then possibly get caught? none of this makes sense, should we blindly believe them there was any "credential stuffing" happening at all? was this explanatation not simply chosen to guilt-trip the customer?
djmobley 8y ago
Can you not buy things like bottled and canned drinks from places on Deliveroo? I suppose you could resell those.
- entity345 8y ago
  Yes, bottles of wine as well.
- martinald 8y ago
  Fair enough. But the markup on those items is crazy; you could order £100 worth of beer + wine and I'd be surprised if you could resell it for more than £10-20. Seems like a really risky way to make (not much) money.
  - astura 8y ago
    You can sell in bulk to shady grocery stores and restuarants at slightly below wholesale costs and they sell to their customers. This is how the market for stolen gas works anyway, I'd imagine stolen cola and beer would be similar.
kami8845 8y ago
Yeah this is the part I also don't quite understand. What they may do is: Order items that aren't as perishable such alcohol & ice cream (e.g. Ben & Jerries) and then resell those via partner off-license shops.
14 8y ago
Look at the world around you there are people literally starving to death do you honestly think it would be hard to sell groceries on the side? Order 100$ in meat and cheese and offer it at a discount and you will have people lined up around me. I would have literally no problem selling this all day long around me. You comment made me wonder how you can not see the disparity in the world. As for the risk of stolen goods that really is a minor risk I think. The poor want their next break. In my town it would be so easy to offload stolen food just through word of mouth.
y04nn 8y ago
You can find some places that would take fake order in exchange of easy money. Or create a shadow platform where people people can order on Deliveroo with crypto currencies.
- zaroth 8y ago
  Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right? Not even that hard to investigate because there’s a complete paper trail after a fraud is reported of what was ordered, who delivered it, and where it was delivered.
  - dsfyu404ed 8y ago
    >Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right? That's how the cop would describe it of course. Anyone with half a brain knows they always throw the book but the whole book never sticks. What sticks will probably wind up being some sort of fraud and the punishment will probably be something like fine and probation.
  - DoctorOetker 8y ago
    I agree that none of this is making any sense. They would have to advertise the service, and every single customer might report the service when he ens up accepting his food from a DELIVEROO guy! It's simply not sustainable, the hassle is not worth the effort etc... I think there was no "credential stuffing" involved, it's just to make customer feel guilty. Note how the article ends with an agreement they reached to jointly publish a statement (portraying the event as caused reckless password reuse), perhaps Deliveroo hopes to construe this common agreement to the statement as admision on the side of the journalist "if only I had used a different password". To me all this suggests the fraud is happening within Deliveroo, at a level above the delivery people. The only credential fraud outside of Deliveroo I can envision is if the black hat hackers contact the restaurants to conspire, the food is then never made but the profit is shared...
thisisit 8y ago
You could open a service on a darknet forum - £100+ worth of food for £20. And people on these forums are well aware on how to receive the order without getting into trouble.
dsfyu404ed 8y ago
>but what you going to do with 3 £100+ takeaway orders back to back Eat it. When I was in college if the pizza guy was in the lobby (invariably trying to call someone who wasn't picking up their phone) very long it was customary to ask him what he was delivering and buy it if you wanted it.

Probably something like this: 1) People pay the fraudster for "discounted" food. 2) The fraudster places the order using the stolen account. 3) The fraudster tells the people who paid them: "Go to the pub car park at 9pm and wait for the Deliveroo driver. If he asks, your name is John Smith." 4) Profit.

kami8845 8y ago
Indeed, maybe there's an app called "Delilaloo" on the App Store that serves as the frontend for these scams
- DoctorOetker 8y ago
  but then THAT should be the real story, why did the journalist stop digging? it's also pretty hard to imagine it's worth the effort, you still need to advertise so people know about your service! the service would have suspiciously similar dishes advertised in menus corresponding to original restaurants etc... the unsuspecting customer gets to open the door for a Deliveroo person! there's just so many ways this would go wrong in the real world that it doesnt make sense to invest time and effort in MitM'ing Deliveroo from a limited set of compromised accounts... This all indicates the fraud is happening from within Deliveroo

unforeseen9991 8y ago

Put it in the fridge or freezer? Why would they ever sell it at a loss? Everyone needs food, so they get the value by consuming it themselves.

ams6110 8y ago
When you're not paying for it in the first place, there's no "loss." It's all profit.
- DoctorOetker 8y ago
  what about time, effort and risk of finding leak dumps, thinking through how you can use the data, and then possibly get caught? none of this makes sense, should we blindly believe them there was any "credential stuffing" happening at all? was this explanatation not simply chosen to guilt-trip the customer?

djmobley 8y ago

Can you not buy things like bottled and canned drinks from places on Deliveroo? I suppose you could resell those.

entity345 8y ago
Yes, bottles of wine as well.
martinald 8y ago
Fair enough. But the markup on those items is crazy; you could order £100 worth of beer + wine and I'd be surprised if you could resell it for more than £10-20. Seems like a really risky way to make (not much) money.
- astura 8y ago
  You can sell in bulk to shady grocery stores and restuarants at slightly below wholesale costs and they sell to their customers. This is how the market for stolen gas works anyway, I'd imagine stolen cola and beer would be similar.

kami8845 8y ago

Yeah this is the part I also don't quite understand. What they may do is: Order items that aren't as perishable such alcohol & ice cream (e.g. Ben & Jerries) and then resell those via partner off-license shops.

14 8y ago

Look at the world around you there are people literally starving to death do you honestly think it would be hard to sell groceries on the side? Order 100$ in meat and cheese and offer it at a discount and you will have people lined up around me. I would have literally no problem selling this all day long around me. You comment made me wonder how you can not see the disparity in the world. As for the risk of stolen goods that really is a minor risk I think. The poor want their next break. In my town it would be so easy to offload stolen food just through word of mouth.

y04nn 8y ago

You can find some places that would take fake order in exchange of easy money. Or create a shadow platform where people people can order on Deliveroo with crypto currencies.

zaroth 8y ago
Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right? Not even that hard to investigate because there’s a complete paper trail after a fraud is reported of what was ordered, who delivered it, and where it was delivered.
- dsfyu404ed 8y ago
  >Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right? That's how the cop would describe it of course. Anyone with half a brain knows they always throw the book but the whole book never sticks. What sticks will probably wind up being some sort of fraud and the punishment will probably be something like fine and probation.
- DoctorOetker 8y ago
  I agree that none of this is making any sense. They would have to advertise the service, and every single customer might report the service when he ens up accepting his food from a DELIVEROO guy! It's simply not sustainable, the hassle is not worth the effort etc... I think there was no "credential stuffing" involved, it's just to make customer feel guilty. Note how the article ends with an agreement they reached to jointly publish a statement (portraying the event as caused reckless password reuse), perhaps Deliveroo hopes to construe this common agreement to the statement as admision on the side of the journalist "if only I had used a different password". To me all this suggests the fraud is happening within Deliveroo, at a level above the delivery people. The only credential fraud outside of Deliveroo I can envision is if the black hat hackers contact the restaurants to conspire, the food is then never made but the profit is shared...

thisisit 8y ago

You could open a service on a darknet forum - £100+ worth of food for £20. And people on these forums are well aware on how to receive the order without getting into trouble.

dsfyu404ed 8y ago

>but what you going to do with 3 £100+ takeaway orders back to back Eat it. When I was in college if the pizza guy was in the lobby (invariably trying to call someone who wasn't picking up their phone) very long it was customary to ask him what he was delivering and buy it if you wanted it.