The attackers used cunning schemes and help from within the company.
The federal court for the Northern District of California has filed charges against two residents of Houston, Texas, for stealing more than a million dollars from food delivery service couriers DoorDash. According to the indictment, Oluwatobi Otukelu and Evan Edwards stole wages from at least 138 couriers from six US states over the past two years.
The scam scheme involved using the personal details of couriers to trick DoorDash customer service. The attackers called representatives of customer service, posing as couriers who allegedly lost access to their accounts. They demanded to change the login details, and then redirected the funds to bank accounts under their control.
To confirm the identity of the couriers, the fraudsters used a variety of personal data, including phone numbers, dates of birth, information about recent transactions, and even the last four digits of driver's licenses. The indictment does not specify the sources of this information, but mentions the possible involvement of other accomplices.
In some cases, DoorDash asked for selfies to verify identity. In response, the attackers sent photos of themselves in an attempt to bypass the company's enhanced security measures.
The stolen funds were used for personal purposes. For example, in July 2023, one of the accomplices stole $759.88 from the courier's account, half of the amount went to pay off Edwards' loan for a Mercedes C300 convertible. It also turned out that the attackers tried to get DoorDash employees to participate in this scheme.
DoorDash confirmed the thefts and said it had initially referred the case to the FBI. Otukelu and Edwards were arrested on September 26. The company said that it suspended employees involved in the fraudulent scheme, and expressed hope for a fair punishment of the perpetrators.
Source
The federal court for the Northern District of California has filed charges against two residents of Houston, Texas, for stealing more than a million dollars from food delivery service couriers DoorDash. According to the indictment, Oluwatobi Otukelu and Evan Edwards stole wages from at least 138 couriers from six US states over the past two years.
The scam scheme involved using the personal details of couriers to trick DoorDash customer service. The attackers called representatives of customer service, posing as couriers who allegedly lost access to their accounts. They demanded to change the login details, and then redirected the funds to bank accounts under their control.
To confirm the identity of the couriers, the fraudsters used a variety of personal data, including phone numbers, dates of birth, information about recent transactions, and even the last four digits of driver's licenses. The indictment does not specify the sources of this information, but mentions the possible involvement of other accomplices.
In some cases, DoorDash asked for selfies to verify identity. In response, the attackers sent photos of themselves in an attempt to bypass the company's enhanced security measures.
The stolen funds were used for personal purposes. For example, in July 2023, one of the accomplices stole $759.88 from the courier's account, half of the amount went to pay off Edwards' loan for a Mercedes C300 convertible. It also turned out that the attackers tried to get DoorDash employees to participate in this scheme.
DoorDash confirmed the thefts and said it had initially referred the case to the FBI. Otukelu and Edwards were arrested on September 26. The company said that it suspended employees involved in the fraudulent scheme, and expressed hope for a fair punishment of the perpetrators.
Source
