Windsor, Ont., business owner out $27K after he's scammed via the Uber Eats app

A concern possessor in house of windsor, Ont., says he's come out thomas more than $25,000 after scammers compromised his banking details on a popular food delivery platform.

Kosta Apatsidis, who runs Gyros and More in Windsor-Essex, said he last received money from Uber Eats a year ago, and Uber says it has found fraudulent activity on his account.

It's been a blow, Apatsidis said, and he's now working with the food delivery platform to come to a resolution.

Apatsidis said he has eight Gyros and More locations and is missing money from two of them: $20,000 over a year at his Walker Road location, and $7,000 at his Amherstburg location that's been missing the past six months.

He said somebody changed the bank account number in the tablet Uber Eats provides to handle orders on the platform and deleted the order history.

The Windsor Police Service said in a statement that members of its financial crimes unit have received the complaint and are investigating.

Apatsidis, in the meantime, stopped accepting orders through the app in September, saying he initially believed there was just a delay being paid out.

Apatsidis said his business deals with other food delivery platforms, but this problem has only occurred with Uber Eats.

“The police told us that they had several cases with Uber Eats the same way," he said. "Something has to be done from the law."

Apatsidis said police helped him recover some of the lost details. That's when he learned someone else’s bank account was added to the Uber account.

Police were able to recover lost data showing about $15,000 in losses, he said.

Apatsidis said he reached out to Uber numerous times, both via email and call, looking for a resolution, but never received “a straight answer."

"Nobody gives us an answer and nobody takes their responsibility."

In an emailed statement, Uber said it would work with the restaurant for a resolution.

“Uber is committed to helping protect our communities from predatory scams. We regularly remind our restaurant and business partners to stay vigilant, and be aware of phishing emails and to never share account information, such as passwords or verification codes, with anyone.”

On Wednesday, Uber Eats reached out to Apatsidis, confirming third-party fraudsters had gained access to the account and offering a resolution, a portion of what Apatsidis says he has lost.

But the ordeal has left Apatsidis sour. He said it shouldn’t take contacting the media to get answers from Uber.

“We lost trust and I'm looking at taking Uber Eats out of all our franchises,” he said. “They betrayed the trust that I had for the company.”

This is not the first time a scam similar the one that's impacted Apatsidis has been reported.

From Saskatoon to St. Johns, many restaurants have fallen prey to such scams. This has also occurred in many U.S. states.

“What's problematic about that is it puts businesses at risk if they use Uber to try to sell their food or goods," said Daniel Tsai, an adjunct professor at Queen’s University in Kingston, Ont. "So, this is an issue.”

He said this puts Uber Eats at reputational risk and could make people skeptical about using the service.

“Transparency is really the best disinfectant, and it is really important to have that on the part of Uber because they can at least educate businesses to be safe and secure in their cybersecurity practices."

In a statement, Uber said it uses several prevention techniques to mitigate unauthorized access to their systems.

“We’re continuously enhancing security by strengthening our policies, practices and technology. We harness technology to detect known fraudulent patterns and proactively alert merchants to suspicious activity. 

“To help protect merchants from these scams, we may withhold payouts (until merchants’ accounts are secure) when there’s suspicion or reports of fraud.”

Jeff Horncastle is the client and communications outreach officer at the Canadian Anti-Fraud Centre.

He said account takeovers have been seen across different platforms, including food delivery services.

“So the question is how do fraudsters get access?" he said. "It's kind of hard to pinpoint exactly how it happens, but from what we're seeing, there's social engineering involved.”

Horncastle said these types of scams often target small businesses and individuals because they're less likely to have sophisticated cybersecurity protections.

More often than not, these fraudsters operate from other countries, making enforcement more difficult.

But he said there are ways to ensure safety: People should be cautious about unsolicited messaged that urge immediate action, no matter how much personal information they have.

"If you're not sure, reach out to the service provider directly to confirm, the way you normally communicate with them directly," he said.

"Use strong unique passwords. We see that if a business, for example, uses the same password on multiple platforms, one of those platforms gets compromised, then you're at risk for all of your accounts if you're using the same password.”

Horncastle said the private-sector partners should also educate their partners. Uber said Wednesday that it regularly shares such guidance with their merchants. 

The company said Uber will never call, text or email to ask for personal information like log-in credentials, passwords, verification codes and such, and advises operators to double check any emails they receive that come from an Uber domain, such as @uber.com, @et.uber.com, or @ext.uber.com 

“Add your store's banking information to Uber Eats Manager as soon as you join the platform. Verify that all Uber Eats Manager users are associated with your store, particularly admin and manager roles,” Uber said.

“Promptly review your bank account after each payout period.”

Videojournalist

---

---