the real issue IMHO is the "credential stuffing attack" makes no sense: hungry people getting their hands on leaked password dumps? a bunch of black hat hackers

the real issue IMHO is the "credential stuffing attack" makes no sense: hungry people getting their hands on leaked password dumps? a bunch of black hat hackers running a Delivery clone, getting clean money from customers, but really getting an innocent Delivery user get charged, and having the order be sent to the address of the customer? none of this makes sense! It seems to me like the corruption or fraud is within Deliveroo.