Deliveroo customers billed for unordered food

It sounds like Deliveroo don't do any payment validation checks when you order to a new address?

If so, it's a fairly big security hole to leave