Essay

Why fraud models should only propose. By Amir Shachar.

Read the essay
Skip to content
Riskernel

Teardowns · 002

DoorDash 2020 to 2021: paid for deliveries that never happened

By Riskernel · · Sources accessed 2 November 2026

The money did not leave through a stolen card. It left through the company’s own payout trigger, pulled over and over by people who could set the order status.

How to read the tags. Confirmed means a public source we cite states it. It does not mean we verified it ourselves. Not yet confirmed is a hypothesis we would test in a review. The facts below are what federal prosecutors alleged and what defendants pleaded to, as relayed by the press [1][2].

Court and regulator detail is cited as reported. Court detail on this page, from the guilty plea to the sentencing, is taken from the reporting in [1][2]. The primary records are the US Attorney’s Office releases on the plea and the sentencing. A DoorDash statement that it detected the fraud in 2021 is left out because we could not trace it to a published source.

Events 2020 to 2021 (scheme); November 2023 to May 2025 (guilty pleas)

What happened

Prosecutors say a group worked together in 2020 and 2021 to defraud DoorDash [2]. They created fake customer accounts and fake driver accounts and used the customer accounts to place costly orders across one US region [1]. They then logged into DoorDash internal systems with login credentials belonging to two DoorDash employees and manually reassigned the orders to the fake driver accounts they controlled [1].

The fake drivers reported the food as delivered. Each report triggered a payment made through a vendor acting for DoorDash [1]. Using the same employee logins, the group changed an order’s status from “delivered” back to “in process,” reassigned it to the fake drivers again, and restarted the cycle [1]. Prosecutors say each order took under five minutes and the cycle ran “hundreds of times” [1].

The total reported is more than 2.59 million dollars in fraudulent payouts [1], which AFP rounds to more than 2.5 million dollars [2]. A third defendant pleaded guilty in May 2025 to one count of conspiracy to commit wire fraud. Another defendant, a former employee, had pleaded guilty in November 2023 [1][2].

Attack tree

How the flow was abused.

Root goal: collect platform payouts for deliveries that did not occur. Leaves marked Hypothesis are ours to test, not facts from the record.

GOAL Collect platform payouts for deliveries that did not occur
  1. ABuild both sides of the marketplace
    1. A1Fake driver accounts
    2. A2Fake customer accounts placing high-value orders
  2. BControl the order record
    1. B1Use employee logins to reassign orders to fake drivers
    2. B2Rewind “delivered” back to “in process” and reassign
  3. CTrigger the payout
    1. C1Fake driver reports “delivered”, payment fires
    2. C2Payment sent through a vendor acting for the company
  4. DStay below the radar
    1. D1Fast cycles, under five minutes per order
    2. D2Repeat hundreds of times across the region
Public record Built from public reporting (The Register, Al Jazeera citing AFP); court details are as reported through those outlets. High, Medium and Low are our qualitative judgement of likely loss per leaf, based on the scale and repetition the sources report, not dollar estimates.

Findings

Confirmed 5

F-01 Confirmed

Both sides of the marketplace were fake.

The group created fake customer and driver accounts and used the customer accounts to place costly orders.

F-02 Confirmed

Employee credentials opened the door.

The group logged into internal systems with the credentials of two DoorDash employees and manually reassigned orders to driver accounts they controlled. AFP describes it as “an employee’s credentials”.

F-03 Confirmed

The payout fired on a status that the actors could set.

The fake driver accounts reported the food as delivered and each report triggered a payment through a vendor acting for DoorDash.

F-05 Confirmed

It was fast and repeated.

Prosecutors say each order took under five minutes and the cycle ran hundreds of times. The total was more than 2.59 million dollars.

Not yet confirmed 2

F-06 Not yet confirmedHypothesis

Test: can an internal tool reassign a customer’s order without its own scoring?

Neither The Register nor AFP says how the logins were obtained. We would test how an internal tool can reassign a customer’s order, and whether internal-tool actions are logged and scored like customer actions.

Evidence
No public source we read states this. Sources read: [1] The Register, 16 May 2025 · [2] Al Jazeera (AFP), 14 May 2025
F-07 Not yet confirmedHypothesis

Test: would payout-time checks that link the two sides stop a payout?

The sources describe the scheme, not what the operator could see while it ran. We would test whether a customer account and a driver account sharing a device, payment instrument, address or network, an order that flips from “delivered” back to “in process,” and one internal login reassigning many orders to drivers created minutes ago would have stopped a payout.

Evidence
No public source we read states this. Sources read: [1] The Register, 16 May 2025 · [2] Al Jazeera (AFP), 14 May 2025

The three controls that matter most

For a fintech or marketplace about to launch a payout, a refund or a creator or driver payment:

  1. Never let one actor write the status that releases money. A payout should rest on evidence the paid party cannot author alone: a counterparty confirmation, a location or device check, or a second system. If an internal tool can edit that status, the tool needs the same scrutiny as an outside user.
  2. Make a paid state hard to rewind, and alarm when it is. A move from “delivered” back to “in process” after payout is an event in its own right. Treat any reversal of a state that already released money as an alert, and require a second approver for the reversal.
  3. Link identities across both sides, and score employee actions too. Compare customers and drivers (or buyers and sellers) on device, payment instrument, address and network. Log internal-tool actions as events and score them: who reassigned how many orders, to which accounts, how recently created.

Sources

Date accessed for every source: 2 November 2026. Numbers on this page are only those a cited source states. Headlines are quoted with any dollar figure written in words, in square brackets.

  1. The Register. “DoorDash scam used fake drivers, phantom deliveries to bilk [2.59 million dollars].” Published 16 May 2025. Accessed 2 November 2026.
  2. Al Jazeera (AFP). “Delivery driver pleads guilty to stealing [2.5 million dollars] from DoorDash.” Published 14 May 2025. Accessed 2 November 2026.

Court detail on this page, from the guilty plea to the sentencing, is taken from the reporting in [1][2]. The primary records are the US Attorney’s Office releases on the plea and the sentencing. A DoorDash statement that it detected the fraud in 2021 is left out because we could not trace it to a published source.