Deliveroo Credit Card Cloning Query?

dr_adidas01

Elmer_BeFuddled said:

Pray tell, what is VAU?

Visa Account Updater (VAU)

Visa Account Updater enables a secure electronic exchange of account information updates between participating Visa card issuers and acquirers for credential-on-file merchants, which enables a more seamless payment process.

When participating issuers re-issue cards, they submit the new account number and expiration date to VAU. Participating merchants send inquiries on their credentials-on-file to VAU and are provided with updated card information, if available. This helps participating issuers retain cardholders by maintaining continuity of their payment relationships with participating merchants

MaryNB

Elmer_BeFuddled said:

Pray tell, what is VAU?

Visa Account Updater
Means that if you get a new credit card, the issuer updates your card details with participating retailers (ones that you've already provided your card details to). This means when my friend's mother got a new card, we presume Deliveroo got the updated card details so the person who got her initial card details was able to continue using Deliveroo after she got a new card. (I will point out I'm not sure if she was able to confirm that this was happening, but it's the only thing we could find to explain it, other than three cards in a row being using by someone else on deliveroo). 

Elmer_BeFuddled

Many Thanks dr_adidas01 and MaryNB for the explanation.

senaiboy

Interesting. Another victim here, Barclaycard being used on Deliveroo (never used them before). As expected, Barclays refunded within days with no question asked.

My card details most certainly have been stolen in 2019, because it was issued in that year which was also the year I started using Curve (kind of a "go-between" payment card, which means the actual credit card is never used online or physically).

For what it's worth, I've submitted the details onto Action Fraud (https://www.actionfraud.police.uk/) as well - it did state on there that if you have reported it to your bank, they would have reported the fraud to police.

phillw

Migster said:
So you're saying that her card was cloned twice and on each occasion, the fraudsters were then able to make contactless payments with the cloned cards? 

It might be a relay attack where someone pays for something with their phone but the details are being read from a real card elsewhere and transmitted over the air. 

Card fraud is inevitable, even if nobody at the bank or card manufacturer is involved then your card details can be stolen if you use it in a card reader that has been modified. 

Just be vigilant and dispute transactions you didn't make.

jimroy

This happened to me last week on my Barclaycard. I have never used nor have an account with Deliveroo.
I believe my card was skimmed somehow at my local BP garage at the tyre pressure machine where you have to make a £1 payment via contactless card (physical) to use it. It was acting up a bit last time (beginning of December) trying to take £2 off me instead I remember. I had to keep resetting it to take the right amount.
Prior to that I'd used the card twice at the same place in the latter half of last year and once with chip and pin at an Argos in August.

It was a bit of a nightmare as it happened after 8pm and I had to contact Barclaycard via Apple Business chat to block my account and they got me to repeat everything via online message from my online account and to request a new card that way. I  got a response the next day saying it had all been sorted via the previous agent. It hadn't, so I had to call up and get it sorted out properly. They gave me a £20 distress/inconvenience payment. I got refunded the fraudulent payment after it had debited (though the pending zero pre-authorisations are still showing) and I have received my new card in the post.

I've also fedback to the app developers that they should add a card blocking feature in their app as since you can't contact them properly after 8pm then you need to be able to control your account yourself.

Yaff1e

I've also just noticed a Barclaycard / Deliveroo fraudulent transaction here from January for £49.51. The Barclay advisor I spoke to said they'd had a lot and they think Deliveroo have had a breach or passwords are being reused from elsewhere. Definitely not in my case though as Deliveroo don't deliver to my postcode so I don't have an account with them and I use a password manager for my passwords so they're all unique and a minimum of 20 characters.

born_again

Yaff1e said:

I've also just noticed a Barclaycard / Deliveroo fraudulent transaction here from January for £49.51. The Barclay advisor I spoke to said they'd had a lot and they think Deliveroo have had a breach or passwords are being reused from elsewhere. Definitely not in my case though as Deliveroo don't deliver to my postcode so I don't have an account with them and I use a password manager for my passwords so they're all unique and a minimum of 20 characters.

Your card details have just been compromised somewhere & fraudster has set up a deliveroo account.

pbartlett

Deliveroo has quite a high level of fraud like this, mainly because the delivery address does not have to be the billing address.

[Deleted User]

My card got done this week, I only used the card for big companies and trading 212. 

It is an inside job, all of the sites (about three) which had the card saved do not reveal the full card number. So it isn't a case of my login details being stolen. I use a password manager which generates random passwords in addition. 

Does anyone know if Apple Pay can be framed in the same way?