They Almost Got You With The Old Switcheroo

I am out doing my regular run of [Food Delivery Service] work and have been at it for about seven hours when I accept an order for [Popular Burger Chain]. Within a few seconds of accepting the latest order, my phone rings, and because these gig services filter all customer contact through their own platforms, the caller ID says, “[Delivery Service]”. I accept the call.

Caller: “Good evening. Am I speaking with [My Name]?”

Me: “Yes”

Caller: “Great, I am [Caller] with [Delivery Service]. The reason I am calling you tonight is that the order you are on now was placed with a stolen debit card.”

Me: “Oh, wow!”

Caller: “We are going to remove the order and ensure you are compensated for your time. Could you please go into the [Delivery Service] app and unassign the order for [reason]?”

Me: *Does so* “Okay, I’ve removed the order.”

Caller: “Great, now could you please verify your ten-digit phone number so that we can ensure you are compensated for your time?”

I wait for [Caller] to recite my number.

Caller: “Hello?”

Me: “Yes?”

Caller: “Yes, could you please verify your ten-digit phone number?”

Me: *Thinks for a moment in confusion* “Yes, if you can read off my number, I can verify it for you.”

There’s an awkward pause.

Caller: “Could you please verify your number for me?”

There was a longer pause as I try to process this request.

The caller hung up.

What happened was an order was placed for nothing but some condiments which, when combined with a promo code, can let them make free/discounted orders for delivery, but more importantly, it gets them into the system as a customer and eventually gives them access to a gig worker via the app. Once the order is picked up, they call their victim, get the order canceled, and then get the worker to hand over their phone number. With the phone number in hand, the scammer can attempt an account recovery which requires a two-factor code sent by SMS to be entered. The scammer will say they are sending the worker a text to verify the phone number at the same time they are going through the recovery process, the worker recites the code thinking it came from the scammer, and the scammer logs into the account, changes the bank information, and extracts whatever balance the worker has on hand, leaving the worker high and dry.

Being that I work in IT for my day job, my brain had a short-circuit when THEY asked me for my phone number. No one calling me with a legitimate business purpose is going to need ME to provide THEM with my number; they will already have it. I recognized it was wrong in some way.

Now, I’d been at this pretty much all day for three days straight, it was late, I was tired, and if it weren’t for my tech tingles going off, I might well have at least given them my ten-digit. I ended up calling the support line for [Delivery Service] right away to report it, and the scammer’s account was likely closed and the details passed on to the fraud division. It’s an unfortunate fact that enough gig workers fall for this that it is a viable scam to run, so I hope sharing my story here will help others to avoid it.