The police say there have been at least four cases involving a scam variant targeting F&B businesses reported since August, with total losses of at least S$42,000. - Photo: ST
SINGAPORE: When her parents noticed that food delivery payment for their hawker business was still not in after two weeks, Pooja decided to check their account information.
She found that the bank account number for the payment for delivery orders on foodpanda had been changed.
The transaction history showed that between Oct 10 and 14, about S$3,000 was paid to an unknown bank account, said Pooja, 36.
She suspected that her parents had been the victims of a scam.
Pooja, who declined to give her full name, made a police report on Oct 24. She also contacted Grab, foodpanda and Deliveroo.
Her parents, who run a stall selling Indian food, have been working with food delivery platforms for seven years, and this is the first time they have fallen prey to a scam.
“They were upset because it is a decent amount of money that we lost,” she said. “At the same time, my parents have gone through a lot of challenges, so they were not really fazed by it.”
Her parents had to stop food delivery orders on foodpanda for a week after that to rectify security issues. They could have made $2,500 during this period, said Pooja, who helps out full time at her parents’ hawker stall in Tampines.
Her family is among food and beverage businesses that have recently fallen prey to scams.
Pooja was speaking to The Straits Times and other media outlets in an online interview on Dec 4 arranged by the police.
In some cases, the victims – the F&B businesses – would receive unsolicited calls from scammers claiming to represent food delivery platforms.
They would then phish for information and use it to access the victims’ food delivery platform accounts or e-mail accounts to maliciously update bank account details, add spoofed e-mail accounts and change account notification settings.
The victims’ earnings would then be diverted to the scammers’ bank accounts or payment service provider accounts.
In a statement on Nov 18, the police said there have been at least four such cases reported since August, with total losses of at least $42,000.
In Pooja’s parents’ case, the scammers did not contact them at all.
She added that when she checked her parents’ e-mail account settings, she found that scammers had gained access to the e-mail account some time in July.
It is possible the scammers then managed to gain access to her parents’ food delivery platform accounts because the same password is used for many platforms, she added.
Scammers had tried to change the payment information of her parents’ Grab account in September, Pooja said.
She added that someone from Grab then called her parents, who are in their 60s, to check if they were the ones who had made the change.
After clarifying that the change had not been authorised by her parents, Ms Pooja updated the password to their Grab account.
She said: “At the time, my father did not think that it would affect our other accounts, so he did not really pay much attention to it.”
It was only in late October that Pooja discovered someone had changed the banking details for her parents’ foodpanda and Deliveroo accounts.
“We thought it was an issue with foodpanda. We contacted their finance team and they said that foodpanda had paid us,” she said.
She added that her parents’ Deliveroo account was affected too, causing them to lose about $50.
Her parents have managed to recoup $1,300 from foodpanda so far, said Pooja.
The police said investigations into Pooja’s case are ongoing.
In response to queries from ST, foodpanda said it is aware of the recent scam variant targeting F&B businesses and that it has implemented measures to protect its vendor partners.
It added that it has been reaching out to vendors to raise awareness and is ready to help if there are suspected scam cases.
The food delivery platform also encouraged vendors to remain vigilant and to contact its support team if they notice suspicious requests, or unusual activity on their accounts.
“Any changes to sensitive information will require verification, and vendors will be notified through multiple channels – such as the vendor portal and e-mail – whenever their details are updated,” said foodpanda.
Also responding to queries from ST, Grab said: “We contact the business’ authorised director directly whenever a request is made to change bank account details.”
It added that it is providing its merchant-partners with knowledge to combat fraudsters and will be introducing more security measures on its platform.
Pooja said her parents will now be more vigilant in guarding their e-mail and food delivery platform accounts.
“I remind them to change their passwords periodically and to have two-factor authentication on their phones so that they get alerts more often,” said Pooja.
When asked if her parents will continue using the platforms, Pooja said: “Are they scared? No. We resolved all the security issues.
“Hopefully, they change some of their policies so that these things can be identified more quickly.”
The Straits Times has contacted Deliveroo for more information. - The Straits Times/ANN
