Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deliveroo users are getting defrauded

newstatesman.com

Post reply on HN
Print view View original

1–10 of 354 posts

Re: Deliveroo users are getting defrauded

#3

Post by lultimouomo »

martinald wrote: post #2

I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering? I must be missing something here.

Maybe the restaurant is part of the scam, and the food is never prepared? Still it would remain extremely easy to trace the fraudsters.

Re: Deliveroo users are getting defrauded

#4

Post by conradk »

martinald wrote: post #2

I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering? I must be missing something here.

From my experience with Deliveroo, you can pretty much order at any address, wait for the delivery person at the doorstep and retrieve your order without actually living there.

Re: Deliveroo users are getting defrauded

#5

Post by entity345 »

Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card.

That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud.

As for Deliveroo's support team... Not very good in my experience, but that's common. Their competitors are no better.

Re: Deliveroo users are getting defrauded

#6

Post by K0nserv »

I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough.

On the topic of this story it seems like a case of credential stuffing so it's not a breach in Deliveroo's systems. Do the requirements as a "Data Controller" still apply in such as case? Regardless Deliveroo seems to be handling this poorly.

0: https://twitter.com/K0nserv/status/1087753850088554496

Re: Deliveroo users are getting defrauded

#7

Post by entity345 »

conradk wrote: post #4
martinald wrote: post #2

I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering? I must be missing something here.

From my experience with Deliveroo, you can pretty much order at any address, wait for the delivery person at the doorstep and retrieve your order without actually living there.

I once asked for delivery to a pub's car park. No problem and the delivery guy did not ask for any ID or anything.

Re: Deliveroo users are getting defrauded

#8

Post by giancarlostoro »

lultimouomo wrote: post #3
martinald wrote: post #2

I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering? I must be missing something here.

Maybe the restaurant is part of the scam, and the food is never prepared? Still it would remain extremely easy to trace the fraudsters.

I would be shocked if it's that simple and Deliveroo didn't bother looking better into it. If we laymen can figure this out on an online forum in a small amount of time why can't Deliveroo figure it out and report the Restaurants to the police. Worse yet, how is this happening to so many people! I swear we'll hear they got hacked in a few more headlines.

Re: Deliveroo users are getting defrauded

#9

Post by EthanV2 »

By the sounds of it this is a simple credential reuse attack (it's even states as such in the article) so I really don't see where these accusations of a "data breach", and "encryption, which appears not to have been in place” come from. If these fraudulent transactions are the result of credential reuse I really don't see the GDPR violation here.
Post reply on HN