Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deliveroo users are getting defrauded

newstatesman.com

Post reply on HN
Print view View original

131–140 of 354 posts

Re: Deliveroo users are getting defrauded

#131

Post by mnutt »

entity345 wrote: post #24
maaaats wrote: post #15

Earlier quoted context omitted.

Problem is most vendors will then block you from ever using their service again. Might not be such a big bummer, after all they're helping people steal your money. But here it was through Apple Pay, so it may have bigger ramifications to block the card.

> Problem is most vendors will then block you from ever using their service again. Who is "most vendors" exactly?

I’ve seen Uber respond to a chargeback by leaving the account active but disallowing all payment methods. With most companies I’d expect it was a customer support mistake rather than vindictiveness, but with Uber it’s hard to be sure.

Re: Deliveroo users are getting defrauded

#132

Post by i_cant_speel »

phatfish wrote: post #89
skh wrote: post #60

Earlier quoted context omitted.

I think I’m old fashioned but I just don’t understand the appeal of these food delivery services. My friend’s son uses Postmates to order fast food and it seems absurd to me. I must be missing something about theses services given their popularity. Do you mind explaining why you use them?

I don't thinks it's old fashioned. Not being lazy and having a conscience is enough to avoid them. Although those things are going out of fashion quite fast.

> having a conscience

What does having a conscience have to do with whether or not you use a food delivery service?

Re: Deliveroo users are getting defrauded

#133

Post by sergioisidoro »

This kind of articles and journalism makes me a bit uneasy.

This article only exists because the Journalist was affected. If anyone would contact the this paper saying company X has fraudsters leveraging their service (which is not uncommon), this article would never have been written.

That aside, I've been on the other side, resolving cases like this. Sometimes cases are complex, take months to figure out while involving multiple stakeholders (police, banks, payment processors, etc), and you have no idea who to trust on the other side of a phone line (it can be a victim, it can be the fraudster).

Re: Deliveroo users are getting defrauded

#134

Post by dmos62 »

kitbrennan wrote: post #51

I'm not surprised by this response from Deliveroo. Their focus lately has definitely moved away from customer satisfaction. I discovered recently that drivers are allowed - without penalty - to reject an order when they reach the pickup location if they see the receipt and decide it is too far to travel [1]. As a customer you just see your food go: `Assigning Driver -> Driver En Route to Pickup -> Driver Arrived at P…

Actually, the driver already knows where the destination is before going to pickup. If he rejects offer after getting to restaurant, it's probably because he asks the staff how long it will take, they reply 10 minutes, which usually means 20, and the driver decides to go looking for another offer. This is largely because some restaurants start making the order only after a driver arrives.

Re: Deliveroo users are getting defrauded

#135

Post by johnnycab »

Midway through writing this story, I got my money back, by the way – and from Deliveroo itself. Other victims have not been so lucky.

The author's experience is not uncommon and seems sensationalised to create a Twitter storm and garnering sympathy, which is uncharacteristic for a journo, who writes about 'tech and digital culture'. It would have been more apt to go into triage mode i.e. stop the bleed of finances and dispute transactions immediately, before entering into communications with the delivery firm. After a resolution, choose to go turbo and further explore the implications of GDPR, then write about your experience in detail.

The article does not leave the reader any more informed or equipped to deal with such a fraud. It does not even pretend to offer any piecemeal advice e.g. don't use/re-use easily guessed passwords, use 2FA, use credit cards or virtual/disposable cards, contact your bank/issuer first, don't bother contacting low-level support via social media, explore data protection laws after a resolution etc.

Re: Deliveroo users are getting defrauded

#137

Post by vivan »

jwdunne wrote: post #123
vivan wrote: post #63

It sounds very much like this journalist is trying to make a mountain out of a mole hill. The real story is that Deliveroo does not handle fraud properly. This is a much lesser crime than what they are being accused of. The author wants to make it seem like Deliveroo has had a data leak and are trying to hide the fact. There is no evidence of this, but if it did turn out to be true then the author would be able to cl…

If I recall, there's no distinction between an en masse data leak and someone being able to access your personal info without authority under GDPR. Both are a data breech. It seems like many people have been affected by this too so clearly Deliveroo doesn't have the mechanisms in place to protect user information. The fact unauthorized people can spend your money through Deliveroo is even worse. Deliveroo are respons…

Do you have a source for that? If that is the case then pretty much every major website is in breach. Credential stuffing is rampant and very easy to do these days. It's not the website's fault that the user gave out their password.

However, I do agree that Deliveroo needs to do more to protect users against this. 2-factor authentication, email confirmation from a new IP, re-entry of card details when ordering to a new address are all simple ways to handle this. Deliveroo has not prioritised this because their main priority is growth.

Re: Deliveroo users are getting defrauded

#138

Post by scrollaway »

K0nserv wrote: post #86
scrollaway wrote: post #61

Earlier quoted context omitted.

Hm, I tried to create an account to check the signup flow but it looks like you need to place an order to create an account (and I'm not that hungry) (also, that's a really fun and interesting way of massaging growth numbers…). To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going…

> To add to what detaro was saying; even if explicit consent were required for sharing your location data, Deliveroo most likely got it; they after all need it to know where your order is going to go. When such functionality is core to the app, an opt-out is not necessary. Per GDPR[0] consent must be specific. i.e. aquiring constent for a legitimate feature of an app and then also using the data for marketing purpose…

I just replied elsewhere in the thread regarding this. Consent to collect was acquired, but nothing actually says they're processing this data for marketing purposes if you haven't opted in to it.

I've seen this pattern quite often: The opt in/out flag is stored somewhere and companies invalidate the data they have based on that in the marketing tooling itself; collection still happens regardless. I've not used it but it's even possible Braze has information on the optin/optout and the ability to immediately reject data about optouts.

The reality is that, while the clean and intuitive privacy practices we're talking about are compliant, they're not required for compliance. Companies go the least-effort route. Deliveroo has clearly done a GDPR pass on their practices so I highly doubt they're using the data in question for marketing (even if they're collecting it).

But I'm still encouraging you to go and talk to them about it. I promise you if you're polite and clear about what and where the issue is, you can likely get some changes done. It's pretty fulfilling, too :)

Re: Deliveroo users are getting defrauded

#139

Post by [deleted] »

Nursie wrote: post #81
scrollaway wrote: post #28

Earlier quoted context omitted.

> I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough. I don't believe Deliveroo is obligated to tell you who they send such information to. They are however obligated to tell you that they gather such information and, should they share it with a third party, ensure that said third party is GDPR compliant and sign a data processing agreemen…

Actually, under the GDPR, they must gain permission to process your information for any marketing purposes. This should be on an opt-in basis. Sounds like an issue to me.

[deleted]

Re: Deliveroo users are getting defrauded

#140

Post by Nursie »

scrollaway wrote: post #112
Nursie wrote: post #81

Earlier quoted context omitted.

Actually, under the GDPR, they must gain permission to process your information for any marketing purposes. This should be on an opt-in basis. Sounds like an issue to me.

No, it's not that clear cut. This is the relevant text: https://gdpr-info.eu/art-6-gdpr/ Specifically, section 1 (b) and all of section 4. Deliveroo clearly needs location data; that they happen to be sending it to Braze is fine if they signed a DPA. So the question is, is the data sent to Braze exclusively for marketing? More critically: If it is collected regardless of consent, does marketing-specific processing st…

> No, it's not that clear cut. ... the question is, is the data sent to Braze exclusively for marketing?

I'm not sure you're actually disagreeing with me. See -

> Actually, under the GDPR, they must gain permission to process your information for any marketing purposes.

Post reply on HN