Fraud involving Lyft driver Picking up an order

[suthap]

Hello Community

We recently got burned on a recent pick-up transaction which may cost us $1500 and lost product. I was wondering if this scam was running around any other cities around the world.

We are a wine merchant located in Seattle. We received an online order for pick-up, consisting of 10 bottles of high end wine, totaling $1,525.16. We fulfilled the order and marked it as ready for pick-up at 4:13pm. At 4:38pm a Lyft driver appeared, and said he was picking up an order for the person that placed the order. We communicated via the Lyft app and confirmed with the supposed customer that we were approved to release package to Lyft driver. The package was released. 8 Hours later at 12:14am we received email messages from the customer claiming the order was a fraudulent order, that she was abroad and did not place the order. We received two emails, the first email telling us that this was a fraudulent transaction and to cancel the order, then the second email sent at 12:17am responding directly from an order confirmation auto-generated by our store. Which brings into question, if this was indeed perpetrated by a fraudulent third party, they had full access to her email account, credit card numbers, addresses, etc, shouldn’t they or their bank be on the hook for this transaction as their information was compromised?

Upon checking our fraud analysis, the order was consistent with a legitimate order, with indicators such as correct billing address, correct credit card security checks, correct geolocation, and an IP consistent with King County, using a T-mobile device. When analyzing the email received from person claiming fraud, we could determine that the sending IP, was also from a T-Mobile USA range, however sent from a +0300 timezone offset, placing them in a UTC+3 region at the time of sending. From this analysis, we can’t determine if this was indeed fraud or if the customer purchased the items and are trying to skip out on payment.

We then reached out to Lyft to see if they could identify the driver that did the pick up, who summoned the driver and ultimately where the driver dropped off the package. Lyft stated that due to privacy, they would not release any information, but will only do so if contacted by police investigation.

We filed a police report. With the track record of prosecutions around this jurisdiction, we don’t have hope that it will be investigated, even though it falls under a Class C felony. If it does go into criminal investigation, we have video footage, and other evidence.

Key takeaway from this incident, even though this transaction passed all Shopify’s fraud detectors, do not release any orders to third party couriers such as Grubhub, Ubereats or Lyft.

Anyone else experience something like this?

[Maximus3]

Yes I think it’s safe to say don’t let high value pick up orders go to anyone but the customer or expressly authorized people.

Fraud and crime is everywhere, especially in cities like Seattle (sanctuary, dshs, tent city, needle exchange, free methadone, Ave rats, abolish police, chaz, etc.) Wish ya luck with getting it sorted out.

[SealSubs-Roan]

@suthap

Hello Community

We recently got burned on a recent pick-up transaction which may cost us $1500 and lost product. I was wondering if this scam was running around any other cities around the world.

We are a wine merchant located in Seattle. We received an online order for pick-up, consisting of 10 bottles of high end wine, totaling $1,525.16. We fulfilled the order and marked it as ready for pick-up at 4:13pm. At 4:38pm a Lyft driver appeared, and said he was picking up an order for the person that placed the order. We communicated via the Lyft app and confirmed with the supposed customer that we were approved to release package to Lyft driver. The package was released. 8 Hours later at 12:14am we received email messages from the customer claiming the order was a fraudulent order, that she was abroad and did not place the order. We received two emails, the first email telling us that this was a fraudulent transaction and to cancel the order, then the second email sent at 12:17am responding directly from an order confirmation auto-generated by our store. Which brings into question, if this was indeed perpetrated by a fraudulent third party, they had full access to her email account, credit card numbers, addresses, etc, shouldn’t they or their bank be on the hook for this transaction as their information was compromised?

Upon checking our fraud analysis, the order was consistent with a legitimate order, with indicators such as correct billing address, correct credit card security checks, correct geolocation, and an IP consistent with King County, using a T-mobile device. When analyzing the email received from person claiming fraud, we could determine that the sending IP, was also from a T-Mobile USA range, however sent from a +0300 timezone offset, placing them in a UTC+3 region at the time of sending. From this analysis, we can’t determine if this was indeed fraud or if the customer purchased the items and are trying to skip out on payment.

We then reached out to Lyft to see if they could identify the driver that did the pick up, who summoned the driver and ultimately where the driver dropped off the package. Lyft stated that due to privacy, they would not release any information, but will only do so if contacted by police investigation.

We filed a police report. With the track record of prosecutions around this jurisdiction, we don’t have hope that it will be investigated, even though it falls under a Class C felony. If it does go into criminal investigation, we have video footage, and other evidence.

Key takeaway from this incident, even though this transaction passed all Shopify’s fraud detectors, do not release any orders to third party couriers such as Grubhub, Ubereats or Lyft.

Anyone else experience something like this?

Hello @suthap
Sorry you have to go through this. Similar spams that use compromised accounts, payment details, and third party couriers have been reported as well, unfortunately. For high value pick-up order, it is helpful to ask for a photo ID that matches the name on the order, confirm pick-up through a known customer contact number, do not release the order to third party drivers unless previously authorized, and hold fulfilment if anything doesn’t feel right. Security camera footage and detailed order records will also reinforce your case if you have a chargeback or investigation.

[Moss_Mercury]

I’d treat high-value pickup orders through Lyft/Uber/Doordash/etc. as a red flag going forward, even if Shopify’s fraud check passes. I’d require ID matching the order/payment name, a pickup signature, and only allow a third-party courier if approved in advance through a known customer contact method. For this case, I’d gather the police report, footage, order timeline, AVS/CVV results, and any Lyft/chat screenshots in case there’s a chargeback.

[suthap]

Hi Syed

thank you for your input. as for the response, as the owner, i am handling the dispute.