---
title: Food Delivery Fraud: From Diner to Doorstep
source_page: https://www.sardine.ai/media/fraudology/episodes/food-delivery-fraud
canonical: https://www.sardine.ai/media/fraudology/episodes/food-delivery-fraud
format: text/markdown
date: 2026-09-24T04:01:00.000Z
description: Food delivery fraud spans diners, drivers, and merchants. Breaking down refund abuse, account takeover, and layering controls at the right moment…
---

**Quick links:** [Human page](https://www.sardine.ai/media/fraudology/episodes/food-delivery-fraud) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# Food Delivery Fraud: From Diner to Doorstep

**Published:** 2026-09-24T04:01:00.000Z

Food delivery fraud spans diners, drivers, and merchants. Breaking down refund abuse, account takeover, and layering controls at the right moment…

Welcome back to Fraudology.
I'm joined today by Sudhir Lanka, Associate Director of Fraud Strategy at GrubHub. Sudhir's team doesn't just cover GrubHub anymore. His scope recently expanded to include Wonder, GrubHub's new parent company, and Blue Apron, which means he's thinking about food delivery fraud across three genuinely different business models at once, and I wanted to dig into how that actually changes his approach.
We get into what makes a three-sided marketplace uniquely exposed to fraud, since GrubHub has to protect diners, restaurants, and drivers all at the same time, and a gap in protection on any one side eventually breaks trust for everyone else. Sudhir walks through the primary fraud vectors his team deals with, account takeover, payment fraud, refund abuse, and promo abuse, and gives some of the most specific, real-world detail I've heard on this podcast about how each one actually plays out, down to the exact excuses customers give to get a refund they're not owed.
What you'll hear in this episode:
How Sudhir's career path through JP Morgan Chase, Discover, and GrubHub shaped his approach to fraud strategy at each stage of scale
Why GrubHub, Wonder, and Blue Apron each carry different food delivery fraud risks despite serving the same underlying mission
The three primary fraud vectors GrubHub tracks, account takeover, payment fraud, and refund and promo abuse, and how they show up differently across business lines
A detailed walkthrough of restaurant account takeover, including how a compromised owner's email can lead to a redirected ACH payout and an expensive double payment for GrubHub
Real examples of driver and diner collusion, including self-delivery loops and a surprising exploit tied to minimum wage laws in cities like Seattle and California
Why refund abuse and first party fraud can't be predicted at the time of transaction, and Sudhir's framework for placing controls at the actual point of irreversibility instead
How layered fraud controls work across account creation, checkout, and post-order stages, including multifactor authentication, 3DS authentication, CVV validation, and delivery PIN verification
The difference between soft friction and hard friction, and why Sudhir intentionally reserves harder friction for a very small percentage of customers
Why Sudhir sees fraud strategy as fundamentally pro-growth, not anti-growth, and how protecting trust across the marketplace translates directly into revenue
You should listen to this episode if you:
Work in fraud strategy at a marketplace, food delivery, or platform business balancing multiple user types
Are dealing with refund abuse, promo abuse, or first party fraud and want a real framework for controlling it without over-relying on prediction
Want to understand restaurant account takeover and payment redirection fraud from the platform's side, not just the consumer side
Are building or refining layered fraud controls and want concrete examples of where soft friction versus hard friction actually belongs
Need language to make the case internally that fraud strategy is pro-growth, not a blocker to it
### Episode notes
Three business lines, three different food delivery fraud risks
Sudhir's team now covers GrubHub, a traditional online food delivery platform, Wonder, a newer ghost-kitchen concept offering multiple cuisines from a single physical location, and Blue Apron, a meal-kit subscription service. Each business model creates a different fraud surface. A three-sided marketplace like GrubHub, with diners, restaurants, and drivers all interacting, has far more entry points for fraud than a subscription-based service like Blue Apron, which tends to see more contained issues like card testing or account takeover instead.
Account takeover hits differently depending on which side of the marketplace it targets
Consumer-side account takeover is the fraud type most people already know, but Sudhir's most striking example was on the restaurant side. A compromised owner's personal email can lead a fraudster straight into changing the ACH payout information on a restaurant's account, redirecting real money away from a small business while GrubHub still owes that restaurant its original payment. Since this kind of compromise happens entirely outside GrubHub's own systems, Sudhir notes there's often no visibility into it until the restaurant calls to report a problem.
Refund abuse can't be predicted, so Sudhir places controls at the point of irreversibility instead
Unlike payment fraud, refund abuse involves a real customer using their own payment method, which means it can't be flagged at the moment of transaction. Sudhir's approach is to intentionally let the order go through, then apply controls only once a customer crosses a clear pattern of abuse, tens or hundreds of false claims, not one or two. His broader framework applies well beyond refund abuse. Place controls at the point where a loss actually becomes irreversible, rather than trying to predict bad behavior before it happens.
Driver and diner collusion shows up in some surprising forms
Beyond the more obvious case of someone posing as both the customer and the driver to collect a payout on their own order, Sudhir described a subtler exploit tied to minimum wage laws for delivery drivers in cities like Seattle and parts of California. Drivers place extremely low-dollar orders themselves, just to collect the guaranteed driver pay tied to that order, exploiting a policy meant to protect legitimate drivers instead.
Layered controls, and the difference between soft and hard friction
Sudhir breaks his approach into two tracks, long-term infrastructure built to stop major attacks like credential stuffing and synthetic identity creation, and a shorter-term investigative track that adapts daily to new attack patterns. Layered fraud controls get applied at each stage of the customer journey, device and behavioral biometrics and multifactor authentication at account creation, 3DS authentication and CVV validation at checkout, and delivery PIN verification after payment has already occurred. That last detail stood out to me specifically, since a PIN requested at delivery adds friction after the transaction, when it can't be exploited by someone simply intercepting a food order in a public place like a hotel lobby.
Reframing fraud strategy as pro-growth, not anti-growth
Sudhir closed with a point I think more fraud leaders need to say out loud. Fraud strategy isn't about blocking growth, it's about protecting the trust that makes growth possible in the first place. When diners, restaurants, and drivers all trust that a platform will pay them and protect them fairly, they keep coming back, and that directly turns into revenue.
### Key takeaways
Food delivery fraud looks different across business models, with three-sided marketplaces like GrubHub facing more entry points than subscription services like Blue Apron.
Restaurant account takeover can lead to redirected ACH payouts, creating both a loss for the restaurant and a costly double payment for the platform.
Refund abuse and first party fraud can't be predicted at the time of transaction, since the customer is using their own legitimate payment method.
The point of irreversibility framework means placing fraud controls at the moment a loss becomes unrecoverable, rather than trying to predict abuse in advance.
Driver and diner collusion can take unexpected forms, including exploiting minimum wage laws through intentionally low-dollar self-orders.
Layered fraud controls should be spread across the customer journey, from device and behavioral biometrics at login to CVV validation at checkout to PIN verification at delivery.
Soft friction protects both customers and the platform without meaningfully disrupting legitimate users, and should be reserved primarily for that purpose.
Framing fraud strategy as pro-growth, rather than anti-growth, makes the business case for investment clearer to leadership and cross-functional teams.
### Final takeaway
What stuck with me most in this conversation is how naturally Sudhir moved between three very different businesses under one umbrella and still landed on one consistent principle. You can't predict every kind of fraud before it happens, but you can be deliberate about exactly when you choose to act. Whether that's refund abuse, account takeover, or a driver quietly gaming a minimum wage policy, the real skill in fraud strategy is knowing precisely where the point of irreversibility sits, and building your controls right there.
Episode resources & links
Connect with Sudhir Lanka | LinkedIn
Associate Director of Fraud Strategy, GrubHub
Connect with Karisse Hendrick | LinkedIn
Host of the Fraudology Podcast
Award-Winning Cyberfraud Expert
Ecommerce Fraud Prevention Consultant
Startup Advisor, Keynote Speaker, and
Consultant to Fortune 500 merchants