They say too many cooks spoil the broth—but one scammer can spoil your bank account a whole lot faster.
In this publication, we’re digging into a sneaky scam that's targeting restaurants across the country, costing them tens of thousands of dollars in redirected funds—all under the guise of a trusted food delivery partner. Let’s get into it.
Scammers are impersonating food delivery services to hijack restaurant accounts and reroute payments to fraudulent bank accounts—leaving small businesses fighting for months just to recover their money.
How It Works:
- The Phony Outreach: A scammer poses as a representative from a popular delivery app (like DoorDash, Uber Eats, or Grubhub).
- The Infiltration: Through a convincing call, email, or even in-person visit, they persuade staff to share account credentials or one-time passwords (OTPs).
- Account Takeover: Once inside the platform, the scammer updates the restaurant’s banking info—redirecting payouts to their own account.
- Silent Theft: Payments start flowing to the scammer, often for weeks before anyone notices.
Who’s Targeted:
- Restaurant owners and managers, especially those relying heavily on third-party delivery services.
- Small-to-midsize businesses with multiple locations.
- Overworked staff in accounting or admin roles who may not spot a slick impersonation.
Real-Life Example:
The Galveston Restaurant Group—which owns several well-known eateries in Texas—flagged suspicious email activity in March last year. Even after raising concerns to their delivery service provider, nearly $30,000 in payments were diverted into a scammer’s account.
“They denied, denied, denied, but we wouldn’t let them bully us,” said Johnny Smecca, one of the company’s principals.
It took nearly a year of persistent follow-up and legal pressure before the third-party delivery service agreed to repay the lost funds—with conditions, including a non-disclosure agreement.
Why You Should Care:
If your business uses delivery apps, your revenue stream could be vulnerable to redirection—without any warning. And recouping lost funds? That’s a long, exhausting process that requires documentation, legal pressure, and an unrelenting paper trail.
Even worse? Scammers don’t stop at food apps. The same business lost $1,420 to a trademark scam just months later.
How to Protect Yourself:
- Never share account credentials or OTPs with anyone over phone, email, or text—even if they claim to be from a known provider.
- Designate a single person or small team to manage vendor communications and account updates.
- Set up multi-factor authentication (MFA) on all delivery app dashboards.
- Regularly review payout history and bank account details on file.
- Train your team to spot phishing tactics and suspicious communications.
Quick Tips & Updates:
Quick Tip #1: Did you know? Food delivery fraud, including account takeovers and payment redirection, is now one of the most common scams facing restaurants in the U.S.
Pro Tip: Always verify third-party communication independently. Don’t use the contact info from the email or caller—go to the official website or account dashboard.
According to the FBI’s 2023 Internet Crime Report, small businesses lost $4.57 billion to cybercrimes, up 38% from the year before.
Bottom Line:
- Scammers are impersonating delivery platforms to hijack restaurant payouts.
- Victims lose thousands and face lengthy battles for repayment.
- The hospitality industry is now among the top three targets for cybercrime.
- A little training and skepticism can save a lot of money—and stress.
Stay safe, stay informed.
Keywords Defined:
- Third-Party Delivery Service: A platform (like Uber Eats or DoorDash) that facilitates food orders and deliveries for restaurants.
- Account Takeover: A cyberattack where scammers gain access to an account and assume control of it.
- One-Time Password (OTP): A single-use code used for verifying a user’s identity, often in two-step verification processes.
- Non-Disclosure Agreement (NDA): A legal contract preventing parties from sharing specific details or outcomes publicly.
- Phishing: A cybercrime where attackers trick individuals into revealing sensitive information by pretending to be trustworthy sources.
To read more, kindly find source article here