Your weekly dose of scam-proofing in 3 minutes or less. No fluff, just the latest hacks, scams, phishing attacks, and cyber cons you actually need to know about.

You order a curry. Twenty minutes later, you get a message from "Uber Eats support." There's a problem with your payment. They need to verify your details outside the app. Could you share a one-time code so they can confirm the order?

You share it.

Your Uber Eats account is now theirs. Your saved payment card is now theirs. And they are currently ordering $300 worth of food across town on your account.

Or maybe you are the driver. A "customer" messages you mid-delivery — there's a problem with the order, it needs to be cancelled, your platform flagged it as fraudulent. To compensate you, they just need your bank details.

You provide them.

The week's earnings you were expecting in your account on Friday? Gone.

Or maybe you are the restaurant. A "support agent" from DoorDash calls to say they are sending you a free tablet to manage orders more efficiently. They just need to verify your login and bank details first.

You verify them.

Your account is taken over. Your payment settings are changed. Your revenue starts going somewhere else.

Scammers are targeting every single person in the food delivery chain. Customers, delivery workers, and restaurants simultaneously, using the same app ecosystem against them all. The Australian government's Scamwatch issued a national alert on this scam just days ago. It is active, it is growing, and almost nobody outside the industry knows it exists yet.

1️⃣ The customer version

You receive a message or call claiming to be from your delivery platform — Uber Eats, DoorDash, Deliveroo, Just Eat, whatever you use. The story varies:

- There is a problem with your payment and they need to re-verify your details.

- Your account has been flagged for suspicious activity and needs to be secured.

- Your order has been cancelled and they need to process your refund.

- They can see your order but need additional information to process it outside the app.

They ask for a one-time code, login details, your mobile number, or bank information. They use these details to take over your account, change your payment settings, or redirect money.

The one-time code is the key. When you share it, you hand over your account. Simple as that.

2️⃣ The driver version

Scammers contact delivery drivers and restaurants claiming they are sending a free tablet or printer to handle food delivery orders. To do that, they say, they need to verify your phone number, email and login, Social Security number, and bank account to send the equipment.

Other driver-specific variants include:

- A "customer" contacts the driver to say the order was cancelled for being fraudulent, and offers to compensate the driver for the wasted journey — if they share their bank details

- A "platform support" call says there is a problem with the driver's account and asks them to confirm their login by reading out a code sent to their phone

- Messages about a "double order" error, with a refund promised in exchange for account verification

Scammers gain access to driver accounts and redirect the money they have earned. A driver who has worked all week discovers their earnings have been paid into someone else's account.

3️⃣ The payment method is the tell

Scammers posing as support agents for food delivery services contact restaurants and tell them they are sending a free tablet or printer to help manage food orders more easily. To do that, they say, they need to verify the restaurant's phone number, email and login, and bank account.

Once they have the login, they change the restaurant's payout details. Revenue from orders continues to flow, just to the scammer's account instead of the restaurant's.

Food delivery platforms are built for speed. Everything about the experience. Placing an order, confirming a delivery, resolving a problem, is designed to happen fast. Scammers exploit that culture of urgency directly.

When a message arrives claiming your order has a problem, your instinct is to fix it quickly before the food goes cold, the driver leaves, or the account gets locked. That instinct, entirely reasonable in normal circumstances, is the mechanism the scam relies on.

The US food delivery market is projected to reach $500 billion by 2027. The scale of the platforms means hundreds of millions of people are familiar with receiving messages from DoorDash, Uber Eats, and Deliveroo, which makes impersonating them trivially easy and almost impossible to distinguish from a real communication.

The driver version is particularly cruel. Delivery workers are often working multiple orders simultaneously, managing navigation, and communicating with customers, all at the same time. They are distracted by design, and scammers know it.

- FTC warning, 2025: The US Federal Trade Commission issued a specific warning about scammers impersonating DoorDash and Uber Eats support agents targeting both restaurants and drivers. The FTC noted that after getting a driver or restaurant owner's email, the scammer asks for an email verification code, which immediately hands over account access. "Don't share any email verification code with someone who contacted you out of the blue," the FTC warned.

- Facebook fraud marketplace, 2025: Researchers discovered active Facebook groups with thousands of members buying, renting, and selling stolen DoorDash, Uber Eats, and Deliveroo driver accounts. Posts offered accounts "for any state" with a "warranty." The accounts were used to fraudulently earn delivery income under someone else's identity, while the legitimate account holder faced potential deactivation for activity they knew nothing about.

- CBS News investigation, May 2026: An investigation found drivers working for food delivery apps using accounts that did not belong to them, obtained through theft or rental markets. Uber confirmed it coordinated 3.6 billion rides and deliveries in Q1 2026 alone. At that scale, verifying every account is, in their own words, "impossible."

🚩 Any message or call about your order, account, or payment that asks you to act outside the official app.

🚩 Requests for a one-time code, verification code, or login details from anyone who contacted you first.

🚩 Offers of free equipment (tablets, printers) that require you to verify your bank or login details.

🚩 A "customer" or "support agent" offering to compensate you for a cancelled order in exchange for your bank details.

🚩 Urgency, act now, before the order is cancelled, before your account is locked, before the driver leaves.

🚩 Any request to handle payment or account issues outside the official platform app or website.

✔ Never share a one-time code with anyone who contacted you first

This is the master rule for this scam. One-time codes are designed to verify that you are you. The moment you share one with someone else, you have handed them the keys. Legitimate platform support will never ask for a code they triggered, if a code arrives and someone is asking you to read it out, that someone is taking over your account.

✔ Handle everything through the official app — nothing outside it

Every legitimate issue with a food delivery order, payment problems, refunds, account queries, cancellations, can be resolved through the official app or website. If someone is asking you to resolve a problem outside the app, by phone, or via a separate link, that is not platform support. That is a scammer.

✔ Call back on official numbers only

If you receive a call claiming to be from your delivery platform and you want to verify it, hang up and call back using the number on the platform's official website, not the number that called you. A legitimate support call will have a record of your issue. A scam call will not survive a callback.

✔ Drivers: never share bank details or login codes mid-delivery

No legitimate platform will ever ask a driver to verify bank details or share a login code during an active delivery. If something feels off mid-shift, finish the delivery, then contact support through the driver app, not through a number or message from an unknown contact.

✔ Restaurants: change payment details only through official portal logins

Any change to banking or payout details should only ever be made by logging into your restaurant's dashboard directly through the platform's official website. If anyone contacts you asking to update your bank details on your behalf, that is the scam.

If someone from your delivery app asks for a code, they are not from your delivery app.

That's it for this week.

Food delivery scams are new enough that most people haven't heard of them, and fresh enough that the Australian government issued a national alert just this week. They work because the platforms are built for speed, the communication channels are already familiar, and the scam is almost indistinguishable from a real support interaction.

The rule is simple. Everything goes through the app. No codes to strangers. No bank details over the phone. No exceptions.

Your lunch is not worth your account details. And your earnings are not worth a verification code.

Catch you next time,

Dan & the Goldphish Team

📌 P.S. Know someone who drives for Uber Eats or DoorDash? This is the one to send them today — this scam is active right now.