I agree that none of this is making any sense. They would have to advertise the service, and every single customer might report the service when he ens up accep

I agree that none of this is making any sense. They would have to advertise the service, and every single customer might report the service when he ens up accepting his food from a DELIVEROO guy! It's simply not sustainable, the hassle is not worth the effort etc... I think there was no "credential stuffing" involved, it's just to make customer feel guilty. Note how the article ends with an agreement they reached to jointly publish a statement (portraying the event as caused reckless password reuse), perhaps Deliveroo hopes to construe this common agreement to the statement as admision on the side of the journalist "if only I had used a different password". To me all this suggests the fraud is happening within Deliveroo, at a level above the delivery people. The only credential fraud outside of Deliveroo I can envision is if the black hat hackers contact the restaurants to conspire, the food is then never made but the profit is shared...