Calgarian Pam Sando is demanding answers and her money back after she said her SkipTheDishes account was hacked.
Sando first became aware of some fraudulent activity on Christmas day.
She told Global News she got a delivery notice from SkipTheDishes advising that her order was on its way to an address in Montreal.
Sando, who lives in Calgary, checked her phone and found that it was the last of three orders to be placed that day in Montreal — all within less than half-an-hour.
“Would not their first clue be that they’re delivering in Montreal — not Calgary?” she asked.
Sando said she even tried to stop the last delivery from happening by alerting an employee on the company’s chat service. But she said she was told it was too late, and the order was already on its way.
“When I asked them to take it to a shelter because it was on a hacked account, they wouldn’t do that,” she added. “They still delivered the food to whoever had hacked my account.”
According to Sando, she then logged on to her account using a laptop to investigate what was happening. She said that’s when she found a total of five saved addresses — all in Montreal — as well as other personal and financial information.
She told Global News she doesn’t understand how this could have happened.
“They’ve had my information for three years, since SkipTheDishes started, and all of a sudden I’m ordering from an obscure phone number to an obscure address in Montreal? No that doesn’t hold water. Sorry.”
SkipTheDishes told Global News in an email: “An account takeover, which is common across ecommerce platforms, is a type of fraud where an unknown party uses stolen account credentials such as usernames, email addresses or passwords, and attempts to gain access to other websites and platform using those same credentials.
“No SkipTheDishes systems have been breached.”
We were also told the company has multiple security measures in place to safeguard personal and financial information and it advised customers to be vigilant with their online security.
As for what happened in Sando’s case, the company said it could not say, citing privacy reasons.
It would also not say how many cases of “account takeovers” it had dealt with in the past, however it did say that in most cases when fraud does happen, customers received a refund from either their financial institution or SkipTheDishes, depending on the specifics of their case.
How to protect yourself from ‘account takeovers’
University of Calgary professor and cybersecurity expert Tom Keenan agreed with the company that account takeovers are common. He also said they’re very easy for fraudsters to carry out on unsuspecting consumers.
“To some extent we’re getting lazy,” he said.
“We’re storing things in places, like on our browsers because it’s convenient and sometimes it comes back to bite us. We have to secure everything — our banking, our credit cards, our SkipTheDishes accounts.”
Keenan said there are a number of ways to secure those accounts including not reusing passwords, keeping them confidential, checking credit card bills, and even setting up an alert on accounts that can advise if a fraud is occurring.
He did, however, question why no alerts by the credit card company or SkipTheDishes were activated in Sando’s case.
“I’m going to go out a limb and say three orders in matter of minutes, delivered in Montreal, should wake up somebody’s fraud detection algorithm,” he added.
However, he also acknowledged criminals are smart — and getting even smarter.
“The person to blame is the the bad guy,” Keenan added. “And the problem is figuring out who that bad guy is.”
Sando said she has now deleted her SkipTheDishes account and taken all of her personal and financial information off of her other food delivery accounts.
She also signed up for fraud alerts at her bank, and she changed all of her passwords.
She told Global News she’s still angry with the company for what she called “not taking accountability” for the fraud in the first place.
She’s now waiting for her bank to get her the $167 back.
“$167 — not a lot of money,” she said. “But let’s face it, that would have been a real nice dinner once the restaurants open up.”
Comments