Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deliveroo users are getting defrauded

newstatesman.com

Post reply on HN
Print view View original

81–90 of 354 posts

Re: Deliveroo users are getting defrauded

#81

Post by Nursie »

scrollaway wrote: post #28
K0nserv wrote: post #6

I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. On the topic of this story it seems like a case of credential stuffing so it's not a breach in Deliveroo's systems. Do the requirements as a "Data Controller" still apply in such as…

> I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. I don't believe Deliveroo is obligated to tell you who they send such information to. They are however obligated to tell you that they gather such information and, should they share it with a third party, ensure that said third party is GDPR compliant and sign a data processing agreemen…

Actually, under the GDPR, they must gain permission to process your information for any marketing purposes. This should be on an opt-in basis.

Sounds like an issue to me.

Re: Deliveroo users are getting defrauded

#82

Post by rubyboss »

Deestan wrote: post #74
himlion wrote: post #66

Earlier quoted context omitted.

Is this actually shady? When doing takeaway you are not really paying for the ambiance of the restaurant anyway and IF the quality is the same I wouldn't necessarily have a problem with it.

> IF the quality is the same That's the thing. It isn't. Every franchise, big or small, has wildly different quality of ingredients and preparation (and even send the correct damn drink and remember the dip) among outlets, and if I order from that one, I want that one to prepare my food.

Deliveroo Editions sites are clearly marked on the app with a banner across the main photo of the restaurant. You aren't led to believe the food is coming from somewhere it isn't.

Re: Deliveroo users are getting defrauded

#83

Post by cabalamat »

giancarlostoro wrote: post #22
Waterluvian wrote: post #18

Earlier quoted context omitted.

This is basically the sole "feature" of credit cards I value. Any time I'm buying something from somewhere that might act poorly, I use a credit card for the free leverage I have in a disagreement. Had an old phones screen repaired at a store inside a Walmart. They fixed it but half the screen had no touch capability. They were highly resistant to doing anything about it until I said I would just do a charge back. To…

I've started using privacy.com after I saw a post here on HN about it. It's pretty nice. Basically you link up your bank account and they create debit cards for any online vendors you use, and you can set limits, destroy cards etc. I usually put monthly / transactional limits. Like with Uber Eats I know I only spend x amount, if anybody tried to use my Uber Eats card for 100 USD it would decline it. But also it locks…

> I've started using privacy.com

Which is US only. Is there anything like it for the UK?

Re: Deliveroo users are getting defrauded

#84

Post by quietbritishjim »

murph-almighty wrote: post #76
quietbritishjim wrote: post #42

Earlier quoted context omitted.

The big issue for me is that I have a joint bank account with my partner, so using my debit card for that automatically splits the bill. I suppose we could each get a second credit card that we use only for joint transactions and pay those off from the shared account, but that means that the joint balance is now effectively split over three accounts, and at any time each of us can only see the balance on two of them…

If shared access is the only impediment to you using a credit card, you should try add your partner as an authorized user to your card. You should both get access to the balance and other info.

Thanks, I didn't know about that. That sounds like what I'm after.

Re: Deliveroo users are getting defrauded

#85

Post by tome »

entity345 wrote: post #5

Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card. That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud. As for Deliveroo's support team... Not very g…

To add my anecdata, I had an excellent experience with Deliveroo's support team just before Christmas. Some pizzas arrived damaged. They offered to send exactly the same order again.

Re: Deliveroo users are getting defrauded

#86

Post by K0nserv »

scrollaway wrote: post #61
K0nserv wrote: post #35

Earlier quoted context omitted.

Doesn't GDPR require explicit cosent[0] for collection of sensitive private information? This is what many website has implemented as popups with "I accept" or "Manage Settings" options. I don't remember going through such a flow with Deliveroo and if I did I would have disabled the "marketing" category for sure. 0: https://www.i-scoop.eu/gdpr/explicit-consent/

Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…). To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going…

> To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary.

Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purposes, what seems to be happening here, is not legal. Of course it could be the case that Deliveroo uses Braze for all their push notifications and thus consider it an essential part of their product. IANAL, but as I read the GDPR giving an app location access required for legitimate functionallity is not a carte blanche for the app to use location data for any purpose without obtaining consent for each specific usage.

In any case, like you say it's extremely creepy and the level of accuracy is worrying.

0: https://gdpr-info.eu/issues/consent/

Re: Deliveroo users are getting defrauded

#87

Post by iagooar »

Waterluvian wrote: post #18
entity345 wrote: post #5

Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card. That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud. As for Deliveroo's support team... Not very g…

This is basically the sole "feature" of credit cards I value. Any time I'm buying something from somewhere that might act poorly, I use a credit card for the free leverage I have in a disagreement. Had an old phones screen repaired at a store inside a Walmart. They fixed it but half the screen had no touch capability. They were highly resistant to doing anything about it until I said I would just do a charge back. To…

This doesn't work in Germany, for example. If you charge back, they'll just put you into a central register (called Schufa) that will basically make it impossible for you to get a credit or even to rent an apartment.

Re: Deliveroo users are getting defrauded

#88

Post by laurent123456 »

whyleyc wrote: post #17

This is poor form from Deliveroo - their fraud detection seems particularly lacking, and fobbing customers off for months at a time is not good enough. However the article is unnecessarily sensationalist in banding around GDPR data breaches. Much of the article intimates there has been a Deliveroo data breach, whereas in fact the most likely explanation is attackers reusing passwords leaked from other breaches. This…

Also the hackers managed to change the user's email, which Deliveroo could have easily prevented by sending an email first to the original email address. It's hard to prevent people from using bad passwords, but there are a few easy things they can do to prevent hackers from completely taking over accounts.

Re: Deliveroo users are getting defrauded

#89

Post by phatfish »

skh wrote: post #60
kitbrennan wrote: post #51

I'm not surprised by this response from Deliveroo. Their focus lately has definitely moved away from customer satisfaction. I discovered recently that drivers are allowed - without penalty - to reject an order when they reach the pickup location if they see the receipt and decide it is too far to travel [1]. As a customer you just see your food go: `Assigning Driver -> Driver En Route to Pickup -> Driver Arrived at P…

I think I’m old fashioned but I just don’t understand the appeal of these food delivery services. My friend’s son uses Postmates to order fast food and it seems absurd to me. I must be missing something about theses services given their popularity. Do you mind explaining why you use them?

I don't thinks it's old fashioned. Not being lazy and having a conscience is enough to avoid them.

Although those things are going out of fashion quite fast.

Post reply on HN