DoorDash Strengthens Merchant Portal Protections to Combat Account Takeovers

Merchants are at the heart of DoorDash. From local family restaurants to growing multi-location brands, each merchant relies on our platform to operate efficiently and securely. Sadly, fraudsters target merchants regardless of size and are constantly evolving their tactics to find new ways to compromise accounts. Vigilance and strong defense are critical to protect all merchants on our platform.

As part of our continuous work to strengthen trust and integrity across DoorDash, we're taking additional action to further combat account takeovers and protect merchants from fraud, including:

• Strengthening merchant portal verification

• Enhancing the security of ownership transfers

• Clear fraud protection and support guidelines

"Protecting our merchants' livelihoods is a core part of how we deliver on our trusted partnership," said Bryan Weisbard, Director, Integrity and Fraud Product Management at DoorDash . "We're constantly innovating to make DoorDash the safest and most dependable platform for merchants to do business. These latest enhancements not only strengthen our defenses against fraud, but also ensure that all our merchants can focus on serving their customers with confidence, knowing their hard-earned income and reputation is protected."

Here's what's new, and how merchants can take steps to protect their account.

Stronger Merchant Portal Protections

We're adding new verification steps to keep the Merchant Portal secure. Sensitive actions will require enhanced two-factor authentication to prevent unauthorized updates. This will further help ensure we are providing a high level of security for all our merchants, while maintaining a fast, easy experience for legitimate users.

Merchants are encouraged to keep their contact information accurate and updated so that DoorDash can reach out to help protect and support your business.

Secure Change of Ownership Process

To prevent unauthorized change of ownership transfers, DoorDash has introduced a two-step verification process which requires:

1. Confirmation from the current owner for the ownership change and effective date

2. Government-issued ID + selfie verification for the current owner prior to approval

This added rigor helps ensure that ownership changes can only be completed by verified, authorized individuals, and not by an impersonator without the merchant's consent.

Fraud Protection Guidelines for Merchant Accounts

We understand how disruptive fraud can be, and the serious impact it can have. We're committed to providing a clear, supportive experience for merchants who encounter suspicious or fraudulent activity. DoorDash has always worked to assist merchants impacted by fraud, and we're now formalizing that approach with clear fraud protection and support guidelines. We strongly encourage merchants to regularly monitor their accounts and report any unusual activity promptly so our team can investigate and help resolve the issue.

As part of that investigation, we look closely at what happened and how the unauthorized activity occurred. In situations where an account takeover stems from compromised merchant credentials, eligibility for reimbursement will be evaluated on a case-by-case basis. Depending on the outcome of our internal review, and the type of fraud that has occurred, merchants may qualify for a limited one-time courtesy reimbursement covering up to 30 days of missed payments.

Common Scamming Tactics to be Aware Of

We're sharing additional information with all merchants, reminding them to remain vigilant and informing them of common scamming tactics to be aware of, which are outlined below.

Phishing Scams

In these cases, fraudsters will call you impersonating Merchant Support and attempting to do one of two things:

1. Identify your username, password, and/or login code in order to access your DoorDash Merchant Portal

2. Convince you to share sensitive documents, or details such as banking information, tax ID numbers, etc. in order to impersonate your business

The best way to protect yourself is to avoid providing information over the phone to an unexpected caller or an unknown email address (i.e. does not end with @doordash.com) asking you to send sensitive documentation. Remember: DoorDash may call to confirm a recent change, but we will never ask for a one-time login passcode, or account password, when we contact you. However, if you call Merchant Support, an agent may ask for a passcode to verify your identity.

Compromised Emails

Many cases of identity theft begin with a fraudster first gaining access to your personal or business email and then using that to access your DoorDash account. In order to protect yourself:

1. Avoid common passwords or passwords shared with other accounts

2. Update your DoorDash Merchant Account password and email password periodically

3. Enable multi-factor authentication in the settings of your email provider

By staying alert and following these best practices, you can protect your business from scammers and ensure your DoorDash account remains secure. Don't hesitate to reach out to DoorDash Merchant Support to resolve any issues you may have or if you are unsure about an interaction.