Hacker News Reader

Hacker News

Comment by martinald | Hacker News Reader

Parent Full thread

martinald

But what you going to do with 3 £100+ takeaway orders back to back? You can hardly resell it!

View on HN

Probably something like this:

1) People pay the fraudster for "discounted" food.

2) The fraudster places the order using the stolen account.

3) The fraudster tells the people who paid them: "Go to the pub car park at 9pm and wait for the Deliveroo driver. If he asks, your name is John Smith."

4) Profit.

Indeed, maybe there's an app called "Delilaloo" on the App Store that serves as the frontend for these scams

but then THAT should be the real story, why did the journalist stop digging?

it's also pretty hard to imagine it's worth the effort, you still need to advertise so people know about your service! the service would have suspiciously similar dishes advertised in menus corresponding to original restaurants etc... the unsuspecting customer gets to open the door for a Deliveroo person! there's just so many ways this would go wrong in the real world that it doesnt make sense to invest time and effort in MitM'ing Deliveroo from a limited set of compromised accounts...

This all indicates the fraud is happening from within Deliveroo

Put it in the fridge or freezer?

Why would they ever sell it at a loss? Everyone needs food, so they get the value by consuming it themselves.

When you're not paying for it in the first place, there's no "loss." It's all profit.

what about time, effort and risk of finding leak dumps, thinking through how you can use the data, and then possibly get caught? none of this makes sense, should we blindly believe them there was any "credential stuffing" happening at all? was this explanatation not simply chosen to guilt-trip the customer?

You can find some places that would take fake order in exchange of easy money. Or create a shadow platform where people people can order on Deliveroo with crypto currencies.

Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right?

Not even that hard to investigate because there’s a complete paper trail after a fraud is reported of what was ordered, who delivered it, and where it was delivered.

>Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right?

That's how the cop would describe it of course. Anyone with half a brain knows they always throw the book but the whole book never sticks.

What sticks will probably wind up being some sort of fraud and the punishment will probably be something like fine and probation.

I agree that none of this is making any sense. They would have to advertise the service, and every single customer might report the service when he ens up accepting his food from a DELIVEROO guy! It's simply not sustainable, the hassle is not worth the effort etc... I think there was no "credential stuffing" involved, it's just to make customer feel guilty. Note how the article ends with an agreement they reached to jointly publish a statement (portraying the event as caused reckless password reuse), perhaps Deliveroo hopes to construe this common agreement to the statement as admision on the side of the journalist "if only I had used a different password".

To me all this suggests the fraud is happening within Deliveroo, at a level above the delivery people.

The only credential fraud outside of Deliveroo I can envision is if the black hat hackers contact the restaurants to conspire, the food is then never made but the profit is shared...

>but what you going to do with 3 £100+ takeaway orders back to back

Eat it.

When I was in college if the pizza guy was in the lobby (invariably trying to call someone who wasn't picking up their phone) very long it was customary to ask him what he was delivering and buy it if you wanted it.

Yeah this is the part I also don't quite understand.

What they may do is:

Order items that aren't as perishable such alcohol & ice cream (e.g. Ben & Jerries) and then resell those via partner off-license shops.

You could open a service on a darknet forum - £100+ worth of food for £20. And people on these forums are well aware on how to receive the order without getting into trouble.

Can you not buy things like bottled and canned drinks from places on Deliveroo? I suppose you could resell those.

Yes, bottles of wine as well.

Fair enough. But the markup on those items is crazy; you could order £100 worth of beer + wine and I'd be surprised if you could resell it for more than £10-20. Seems like a really risky way to make (not much) money.

You can sell in bulk to shady grocery stores and restuarants at slightly below wholesale costs and they sell to their customers.

This is how the market for stolen gas works anyway, I'd imagine stolen cola and beer would be similar.

Look at the world around you there are people literally starving to death do you honestly think it would be hard to sell groceries on the side? Order 100$ in meat and cheese and offer it at a discount and you will have people lined up around me. I would have literally no problem selling this all day long around me. You comment made me wonder how you can not see the disparity in the world. As for the risk of stolen goods that really is a minor risk I think. The poor want their next break. In my town it would be so easy to offload stolen food just through word of mouth.

Reply on news.ycombinator.com