Credit Card Skimming Operations
Credit card fraud remains one of the most devastating schemes targeting restaurants, with restaurants losing 4%-5% of their profit to fraud each year, reaching up to $6 billion dollars annually. The mechanics are terrifyingly simple yet effective.
Restaurants are particularly strong targets for skimming operations because guests hand over their cards and lose sight of them while payments are being processed. Unscrupulous servers can then use hand-held skimmers to steal credit card information. One high-end Manhattan restaurant fell victim to a trusted staff member who secretly installed a skimming device on the restaurant’s POS terminal, allowing them to collect hundreds of customers’ credit card information over several months. These stolen credit card details were sold on the dark web, leading to widespread unauthorized transactions. By the time the fraud was uncovered, the restaurant had accumulated thousands of dollars in chargeback fees.
The Auto-Gratuity Double-Dip Scam
Auto-gratuity scams occur when an employee takes advantage of customers who may not have noticed that the gratuity was already added, and allows them to add an additional tip. This seemingly minor oversight can cost customers significant money when servers deliberately remain silent about automatic service charges.
Smart diners have learned to scrutinize their bills carefully, but many restaurants have grown even more sophisticated in their approach. Many restaurants now include an Automatic Gratuity, but some restaurants manipulate them by calculating through the post-tax total rather than the pre-tax amount to inflate the tip. The practice has become so widespread that industry experts recommend customers always verify tip calculations independently, regardless of how reputable the establishment appears.
Fake Delivery Driver Identity Theft
The rise of food delivery apps has created an entirely new category of restaurant-related fraud that’s catching both customers and legitimate drivers off guard. Scammers place an order for something insignificant, like a single sauce packet. This fake DoorDash order is often a vital indicator of a potential scam.
The scheme works with devastating precision: while en route, the driver receives a call from someone claiming to be DoorDash support. These fake support representatives then request verification codes and personal information, ultimately gaining control of driver accounts. It can lock Dashers out of their accounts, leaving them unable to work for hours or even days, resulting in lost income.
Location Spoofing for False Deliveries
Technology has enabled a new breed of delivery fraud that’s nearly impossible for customers to detect in real-time. Drivers can use software to send bogus GPS location data to fake a delivery. The false data appears to show they collected and delivered the order. The customer never gets their order, but the driver is still paid.
The financial impact extends far beyond individual orders. The delivery apps will typically compensate the driver for their time and refund the affected customer, all while the delivery driver never completed the order to begin with. This type of fraud results in poor user experience, wasted food, and significant losses for the delivery app. The sophistication of these schemes means legitimate customers may never receive their food while fraudulent drivers collect payment from multiple sources.
The Void Transaction Money Grab
One of the most insidious forms of internal restaurant fraud involves manipulating transaction records to steal cash directly from customers. Wrongly voided transactions happen when a server charges a customer for their full order, but later voids certain items and pockets the money for said items.
This scheme thrives because it can’t be detected on most restaurant POS systems and flies under the radar unless inventory is consistently checked. Customers pay their full bill, receive their complete order, and remain completely unaware that their server has manipulated the system to steal portions of their payment. The elegance of this fraud lies in its invisibility – everyone appears satisfied while money disappears into employee pockets.
Refund Fraud Through Mobile Payment Apps
The integration of mobile payment technology has created opportunities for sophisticated internal fraud that combines traditional refund scams with modern payment processing. Employees use a mobile payment app to divert funds to their own accounts from customers’ credit cards instead of tendering the customer’s order. The employee rings up a transaction for the customer, but instead of using the POS terminal, they swipe or tap the customer’s card on their phone where a mobile POS application is already installed and an account is set up to mimic the name of the restaurant. The customer is charged the correct amount, but the funds go to the employee’s account. The employee then voids or discounts the transaction in the POS system, leaving the customer none the wiser because if the customer looks at their account, they’ll see a withdrawal for the transaction amount from a business that sounds like the restaurant they were at.
Fake Restaurant Listings on Delivery Apps
Fraudsters have discovered they can create entirely fictional restaurants on delivery platforms, accepting orders and payments without any intention of providing food. Users have reported scammers are registering fake restaurants, which are sometimes inspired by real places to give them an air of authenticity. Once the customer has placed the order, it has been accepted and the customer has paid, the “restaurant” cancels the order.
The psychological manipulation runs deep in these schemes. Look at whether the prices seem unusually low, or the delivery area seems particularly large – scammers could be working a wide area to try to target as many people as possible. Customers fall victim because the offers seem too good to refuse, only to discover they’ve been charged for meals that never existed from kitchens that were never real.
Account Takeover Through Phishing
Restaurant fraud increasingly targets customer accounts through sophisticated social engineering techniques. Bad actors might send a phishing email or contact someone via social media, impersonating a third-party delivery app. They often make the customer believe that their account has been compromised and that they need to verify their login details for recovery purposes. The communication looks real and therefore doesn’t raise many red flags, so customers voluntarily share their account information.
Once fraudsters gain access, the financial damage spreads quickly. From this point, the fraudster can either order food for themselves and charge the victim’s credit card, or they can charge other interested parties a small fee to use the compromised account to the same end. In the worst case scenario, an innocent user can find themselves out hundreds of dollars or more in fraudulent food charges.
Gift Card Duplication Schemes
Restaurant gift cards have become prime targets for sophisticated duplication fraud that can devastate both customers and businesses. A scammer uses a skimming device to copy the information from the magnetic stripe of a legitimate physical gift card. The copied data is then used to create a duplicate card that appears authentic. For instance, a fraudster might skim card details at a compromised point-of-sale (POS) terminal. Later, they use the cloned card in-store to purchase high-value items or redeem balances before the original cardholder notices.
The timing of these frauds makes them particularly cruel for victims. In the past, these gift card frauds were only limited to physical theft, but with advanced technology, digital scams have become harder to detect. Customers often discover their gift card balances have been drained only when they attempt to use them for special occasions or celebrations.
Promotion Abuse and Fake Account Creation
Delivery platforms lose millions annually to sophisticated promotion abuse schemes that exploit new customer incentives. Legitimate users might use both their work and personal emails to take advantage of this once, but fraudsters will scale that approach to a whole different level. They will create multiple fake accounts in bulk and then sell them to those looking for a discount on food. When done on a large scale, this wastes the platform’s marketing budget and eventually leads them to cut down on promotions, slowing order volumes for restaurants.
The most sophisticated version involves what experts call “collusion fraud.” Bad actors use different account types to simulate a legitimate order. They create a restaurant account, multiple driver accounts and many consumer accounts and manipulate the app by using these accounts to complete numerous fake orders. This creates artificial demand that distorts market dynamics and harms legitimate restaurants competing for visibility.
Cash-on-Delivery Manipulation
As delivery platforms experiment with cash payment options to reduce fraud, new scams have emerged targeting both drivers and customers. Fraudulent drivers looking for a free meal and a little cash may eat the customer’s meal or swap it with something else and still take the customer’s money. This typically only works the first time it’s attempted. The fraudulent driver will likely be booted from the delivery app after a customer reports them.
The reverse scam proves equally damaging to drivers. The other type of cash-on-delivery scam involves customers who take the food but don’t give the delivery driver the correct amount of cash in exchange or hand off counterfeit money. Unfortunately, the driver may not realize what has happened until it’s too late. These schemes exploit the trust-based nature of cash transactions while leaving innocent parties to absorb financial losses.
Fake Health Inspector Extortion
Restaurant owners face threats from scammers impersonating government officials to extract money through fear and urgency. One common method that fraudsters have historically used to target restaurants is by impersonating a health inspector. These scammers can call, email, or show up in person with claims of a health code violation and usually attempt to collect a baseless fine or gather personal information to use for identity theft. Even when these scammers don’t have official business cards or paperwork, they can feed off restaurant owners’ fear and urgency to force them into compromising situations.
The psychological pressure tactics prove remarkably effective against busy restaurant operators. Similar schemes began to crop up elsewhere as scammers looked to take advantage of the COVID-19 pandemic. When dealing with suspicious activity like this, health officials recommend asking for official city identification and paperwork behind any health code violation claims. The fear of regulatory shutdown often overrides common sense, making restaurant owners vulnerable to paying fake fines to maintain their operations.
