Deliveroo users are getting defrauded • Hacker News Board

Re: Deliveroo users are getting defrauded

#241

Post by vivan » Thu, Jan 24, 2019, 5:24 PM UTC

snowwolf wrote: post #196

vivan wrote: post #137

Earlier quoted context omitted.

Do you have a source for that? If that is the case then pretty much every major website is in breach. Credential stuffing is rampant and very easy to do these days. It's not the website's fault that the user gave out their password. However, I do agree that Deliveroo needs to do more to protect users against this. 2-factor authentication, email confirmation from a new IP, re-entry of card details when ordering to a n…

In the UK, the ICO guidelines are "A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." The key part being "unauthorised disclosure of, or access to, personal data." So does credential stuffing qualify - In my opinion yes, as it is unauthorised access to personal data. They then go on to say "Wh…

So if someone hacks your email because you didn't have sufficient protections in place, does that make the email provider liable? Seems like an argument that falls apart very quickly.

Re: Deliveroo users are getting defrauded

#242

Post by snowwolf » Thu, Jan 24, 2019, 5:32 PM UTC

vivan wrote: post #241

snowwolf wrote: post #196

Earlier quoted context omitted.

In the UK, the ICO guidelines are "A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." The key part being "unauthorised disclosure of, or access to, personal data." So does credential stuffing qualify - In my opinion yes, as it is unauthorised access to personal data. They then go on to say "Wh…

So if someone hacks your email because you didn't have sufficient protections in place, does that make the email provider liable? Seems like an argument that falls apart very quickly.

Yes, exactly that if the email provider hasn’t put in place sufficient defences. Why wouldn’t they be liable? They have a duty of care under GDPR to protect your personal data. If they are negligent in that duty then absolutely they should be liable.

Re: Deliveroo users are getting defrauded

#243

Post by CydeWeys » Thu, Jan 24, 2019, 5:32 PM UTC

neka wrote: post #144

vivan wrote: post #63

It sounds very much like this journalist is trying to make a mountain out of a mole hill. The real story is that Deliveroo does not handle fraud properly. This is a much lesser crime than what they are being accused of. The author wants to make it seem like Deliveroo has had a data leak and are trying to hide the fact. There is no evidence of this, but if it did turn out to be true then the author would be able to cl…

Yeah - it boils down to ye olde case of people reusing passwords. Half of the article talking about GDPR and the ICO is irrelevant. What's happened is she has an easy/reused password that's ended up in a breach, fraudster locks her out of the account and offers discounted deliveroo orders to their customers and she gets charged. That's it.

It sounds like Deliveroo could step up their security then, as they don't seem to be doing much to catch credential stuffing, suspicious/fraudulent orders, etc. They could be doing way more.

Re: Deliveroo users are getting defrauded

#244

Post by anonknowsaguy » Thu, Jan 24, 2019, 5:33 PM UTC

ams6110 wrote: post #194

anonknowsaguy wrote: post #106

Earlier quoted context omitted.

I've only seen this happen to people on student visas that permit little or no working hours.

Students will do all kinds of "harmless" under the table stuff to get/save a little extra spending money. That's different to me than an person desperate for money to pay rent or buy food.

That's certainly true and they are illegally working. But maybe your image of a student might be a bit narrow? There's a large industry in Europe of language schools. You pay the school/country a few thousand euros/pounds and in return you get a student visa + basic language course. Not all, but many students are coming from pretty bad places in the hope of somehow landing a work visa(Italy and Portugal will grant citizenship if you can prove ancestry for example). The friends of my wife that told me about their lives/this practice, none of them where working for "spending money".

Re: Deliveroo users are getting defrauded

#245

Post by laumars » Thu, Jan 24, 2019, 5:35 PM UTC

skh wrote: post #205

mikestew wrote: post #161

Earlier quoted context omitted.

I think I’m old fashioned but I just don’t understand the appeal of these food delivery services. "Old-fashioned"? Nice try, Grandpa. I'm approaching retirement, and delivery of restaurant food has been a thing since before I was born. Hell, Domino's was founded in 1960.

But not fast food delivery. This is a recent thing. And most restaurants didn’t do delivery. I don’t see the point of ordering a meal that is best eaten hot to be delivered when it comes to the house warm.

Domino's comes under the genre of fast food too. It's not all just burgers and fries.

Re: Deliveroo users are getting defrauded

#246

Post by Symbiote » Thu, Jan 24, 2019, 5:35 PM UTC

wil421 wrote: post #231

C1sc0cat wrote: post #221

Earlier quoted context omitted.

A lot of places in the UK especially low cost places wont accept amex because of the charges. I saw my mangers amex get declined when they tried to pay for a team meal (15 people) a few years ago

Yes at least the U.K. isn’t as obsessed with cash as Germany is. I had trouble until on of my Europoeran colleagues told me about Amex Vicinity. You can see places around you and it can make it easier to use corporate Amex cards.[1] [1] https://www430.americanexpress.com/mrec/mersearch/index?intc...

The troubles with Amex, and Germany's increased acceptance of Visa and Mastercard cards, is because of the EU's rules on restricting processing fees.

Those rules mostly don't apply to Amex (they were not considered part of the Visa-MC duopoly).

There's some interesting background here: https://www.headforpoints.com/2018/02/08/american-express-eu...

Re: Deliveroo users are getting defrauded

#247

Post by Symbiote » Thu, Jan 24, 2019, 5:36 PM UTC

egourlao wrote: post #168

aembleton wrote: post #154

Another good reason to use a fintech bank account such as Monzo [1] or a credit card such as Tandem [2] or a virtual card that can forward transactions onto any other card such as Curve [3]. All of these services can give you a push notification every time a transaction is made on your account so that you are immediately made aware and are able to cancel them. You can block the card from within the app immediately. 1…

I agree. I'd also add that my experience with fintech services, in regards to fraud detection, has been excellent. I've been using Revolut for the past year. Just 2 weeks ago, they detected a potential fraudulent transaction with - you guess it - Deliveroo, for an amount of £25 (I don't live in the UK). The transaction, as well as my card, was immediately blocked. I then received a push message asking me to confirm w…

They obviously vary, but my British legacy bank no longer wants to be told when I'm going abroad.

I don't use their app. If they suspect a fraudulent transaction, they block it and call me.

Re: Deliveroo users are getting defrauded

#248

Post by astura » Thu, Jan 24, 2019, 5:37 PM UTC

ams6110 wrote: post #203

pbalau wrote: post #67

Earlier quoted context omitted.

I think you are just trying to be that guy. I go to this website, pick what I want, pay and some time later what I ordered gets delivered to my door. What's there to get?

Fast food is pretty bad when it's fresh. It's awful after it's been in transit for 20-30 minutes or more. The idea of spending $10 or more to get a lukewarm burger and mushy limp french fries has no appeal to me.

I think people are ordering from more upscale restaurants, not McDonalds.

Food temperature is a personal preference, some people are really picky about food being hot/fresh, some aren't. I prefer the taste of room temperature food over hot food so "sitting around for 20 minutes" would be a feature for me.

Re: Deliveroo users are getting defrauded

#249

Post by Bartweiss » Thu, Jan 24, 2019, 5:39 PM UTC

cabalamat wrote: post #83

giancarlostoro wrote: post #22

Earlier quoted context omitted.

I've started using privacy.com after I saw a post here on HN about it. It's pretty nice. Basically you link up your bank account and they create debit cards for any online vendors you use, and you can set limits, destroy cards etc. I usually put monthly / transactional limits. Like with Uber Eats I know I only spend x amount, if anybody tried to use my Uber Eats card for 100 USD it would decline it. But also it locks…

> I've started using privacy.com Which is US only. Is there anything like it for the UK?

Many banks offer this service without any third party. I don't generally see it advertised a lot, I assume because it's confusing to people who have no interest in it, but you can look up something like "virtual credit card" or "temporary credit card number" and probably find a bank offering it.

The very crude answer is to get a prepaid card and load it with enough to cover each purchase, then toss it as soon as it gets misused. Which works, but doesn't sound worth the hassle unless you seriously expect a bad outcome.

Re: Deliveroo users are getting defrauded

#250

Post by chumali » Thu, Jan 24, 2019, 5:41 PM UTC

ddeokbokki wrote: post #189

talltimtom wrote: post #147

Earlier quoted context omitted.

What’s immoral here? You know someone who can’t work so you let him rent your phone so he can work. I mean it’s not respecting the law, but it’s no more immoral than companies renting out cars, houses, or tools used by others to earn a living.

Deliveroo riders have some of the worst working conditions, it's a grind and people do it because they need the cash. Going as far as circumvent legal regulations and even pay to be able to do such a job is a good indicator that the person doing it is desperate for income. Many people believe wealth should be shared, that everyone deserve happiness, and that no one should spend their lives slaving away just to surviv…

This is the same argument leveled against sweatshops and it is frankly a fallacious one.

It proposes a false dichotomy where the worker has to either be in well paying and fulfilling employment (which obviously is not an option given their circumstances) or alternatively, they must be saved from the tyranny of their employer (usually through enactment of regulations which will leave them jobless).

Either way all it achieves is to deprive the worker of income, experience and the agency that comes with being able to make their own employment decisions. Your comment, despite seeming conscientious, gives little consideration to utility of the worker and the pragmatic decisions they face.

A sense of moral outrage towards a company (or individual) for perceived exploitation of their employees might be justified, but is not sufficient grounds for limiting the freedom of exchange.