Maybe I'm missing the point but how did the fraud take place to begin with? Somebody fished the author's Deliveroo account and used it to buy a lot of food? If

Maybe I'm missing the point but how did the fraud take place to begin with? Somebody fished the author's Deliveroo account and used it to buy a lot of food? If so what would be the right way for Deliveroo to solve the issue? I mean if they just swallow the cost and reimburse her with no questions asked it seems easy to abuse, I could just order a lot of food then later complain that my account has been breached. Then again that's pretty much what Amazon does in these situations in my experience but not everybody has Amazon's deep pockets... That's not to say that their current response (or lack thereof) isn't bad, it's more that I'm not sure what would be a good response in this situation. I'm also not sure how Deliveroo could be considered liable if the breach is on the user's side (phished password) rather than a server-side vulnerability. If I offer an online service and one user gets their password stolen, would I be liable for that? If so, what should I do if somebody claims that their account was stolen? What if they're actually lying to get access to a legit account?