Spot ‘Driver or Shopper Added’ Notices on Delivery Apps Before Your Orders Get Rerouted

Food and grocery delivery apps make life easier—but they’re also targets for account-takeover and reroute scams. A subtle but telling warning sign is a notice like “Driver added,” “Shopper added,” or “Pickup person added” on your account or within an active order. If you didn’t approve the change, someone may be setting up your order to get diverted, picked up by an impostor, or refunded to a card you don’t control. This guide explains how to spot these alerts quickly, why they matter, and exactly how to lock down your accounts before your orders or refunds disappear.

Why “Driver or Shopper Added” Notices Matter

Most delivery platforms allow you to add a trusted driver, shopper, or pickup person to help with fulfillment or collection. Fraudsters exploit this feature by quietly adding themselves to your profile or to a single order. Once added, they can:

• Redirect delivery instructions to a new drop-off location.
• Pick up orders in-store by presenting limited details.
• Communicate with the legitimate courier to confuse handoff details.
• Trigger refunds or credits after claiming delivery problems.

These moves often happen fast—sometimes within minutes of a password reuse or a data breach exposure leading to an account takeover.

Common Places You’ll See These Alerts

Delivery apps surface these notices differently. Watch for:

• Order timeline events: “Driver added,” “New shopper assigned,” or “Pickup person added.”
• Account security emails: “A new delivery contact was added,” “Your pickup contacts changed,” or “A new authorized user was added.”
• SMS or push notifications: “Update: New shopper/driver added to your order.”
• Profile or address book changes: Additional names under “Trusted contacts,” “Authorized pickup,” or “Delivery preferences.”

If you see any unfamiliar name or number added—treat it as urgent, even if the app shows your order is still on track.

How Reroute and Pickup Scams Typically Work

1. Credential exposure: Your email and password pair leaks in a breach or is guessed due to reuse.
2. Quick account access: The attacker logs in, sometimes from a new device or location.
3. Low-friction change: They add a driver/shopper/pickup person or adjust delivery notes to reroute.
4. Order interception: The impostor picks up the order, or the drop-off is shifted to a controlled address.
5. Refund manipulation: The attacker claims non-delivery to secure credits and repeat the scheme.

The whole cycle can happen during a single active order, which is why noticing these additions in real time is critical.

Immediate Steps If You See an Unexpected Add

Move quickly to reduce damage and stop order diversion:

1. Pause changes and contact support in-app: Open the active order, use “Help” or “Report an issue,” and state “Unauthorized driver/shopper/pickup person was added. Please remove and lock my order to original delivery details.”
2. Remove the unfamiliar contact: Go to Delivery settings, Authorized pickup, or Profile contacts and delete any unknown additions.
3. Reset your password: Choose a long, unique password you don’t use elsewhere. Enable a password manager to prevent reuse.
4. Turn on multi-factor authentication (MFA): Prefer app-based or hardware-key authentication over SMS if the platform supports it.
5. Check recent orders and credits: Look for rerouted addresses, in-store pickups you didn’t make, or refunds you didn’t request.
6. Review login activity: If available, sign out other sessions and revoke access from unfamiliar devices.
7. Update delivery notes: Remove any unusual instructions and add a clear safeguard such as “Deliver only to the main entrance; do not change location or hand to unlisted contacts.”
8. Confirm with the courier: Message the driver or shopper in-app: “Please deliver to the original address only. No changes authorized.”

Proactive Settings That Block Reroutes

Most platforms provide controls that reduce the chance of successful interception. Set these once and review quarterly:

• Require re-authentication for profile changes: Look for toggles like “Password required for edits.”
• Lock in your default address: Remove dormant addresses; keep one or two active known locations.
• Disable or limit authorized pickup: Only list people you truly trust and remove anyone you no longer need.
• Restrict communications: Keep order chat inside the app; never agree to switch to text or messaging apps.
• Turn on security alerts: Enable push/email for new device logins, password resets, payment method changes, and contact additions.
• Payment hygiene: Remove old cards and virtualize new ones with bank or card-issuer virtual numbers where possible.

How to Recognize a Legitimate Assignment vs. a Risky Add

Apps legitimately reassign drivers or shoppers during busy periods. Use these checks to decide if action is needed:

• Where the notice appears: A normal reassignment often shows as “New shopper assigned by the platform.” A risky one appears as “A driver was added to your account/authorized contacts.”
• Name and profile details: Official reassignments show verified profiles and ratings. Suspicious adds may show only a first name or a phone number.
• Scope: Reassignment affects the order only; adding a new contact changes your profile or authorized pickup list.
• Instruction changes: If delivery notes, address, or drop-off location suddenly change with the add, treat it as high risk.

Red Flags That Suggest an Active Takeover

• New device or location login alerts around the same time as the add.
• Delivery instructions referencing gates, codes, or locations you never use.
• Payment method changes or new gift cards/credits appearing on your account.
• Customer support contacts you didn’t initiate appearing in the order history.
• Multiple address entries you don’t recognize added to your profile.

Protect the Personal Data in Your Delivery Profiles

Delivery apps often store more than they need. The less exposed data, the less an attacker can exploit:

• Limit saved addresses: Delete old dorms, Airbnbs, workplaces, and friend addresses.
• Trim contact info: Use your main phone and email only; remove backups you no longer control.
• Mask apartment details: Keep sensitive notes minimal; avoid storing door codes in plain text. Rotate codes regularly.
• Use virtual cards: Where supported, pay with virtual numbers that can be locked or replaced instantly.
• Avoid linking unnecessary accounts: Only connect accounts (e.g., rewards, wallets) that you actively monitor.

What to Tell Support to Speed Resolution

When you report the issue, be concise and specific. A short script helps:

• “I did not add this driver/shopper/pickup person.”
• “Please remove all unauthorized contacts and lock my order to the original address.”
• “Please force log out of all sessions except this device.”
• “Please audit and reverse any unauthorized refunds, credits, or rerouted deliveries.”
• “Please enable re-verification for profile edits on my account.”

Request a support case number and keep a screenshot of the suspicious notice, order number, and timestamps.

If a Charge or Refund Looks Wrong

If you spot charges, tips, or refunds you didn’t authorize:

• Dispute through the app immediately, attaching screenshots of the add and order changes.
• Lock or replace the card used for the order, especially if it’s stored on multiple delivery apps.
• Monitor your bank and card statements for duplicate or follow-on charges.
• If you suspect broader identity issues (new cards, accounts, or credit pulls you didn’t make), add fraud alerts and review your credit reports.

For ongoing monitoring of identity-related activity that can follow account takeovers or broader data exposures, consider a privacy-focused credit and identity monitoring solution. A practical option is available here: SmartCredit for privacy, credit monitoring, and identity protection.

Set Up a Personal “Delivery Security Routine”

A simple routine can prevent most reroute scams:

1. Before ordering: Confirm address and delivery notes; verify no extra authorized contacts exist.
2. During the order: Watch for “driver/shopper added” or instruction changes; keep all communication in-app.
3. After delivery: Review the receipt, credits, and order timeline; remove any temporary addresses or pickup contacts.
4. Monthly: Change your password if you reused it elsewhere; audit sessions, payment methods, and alerts.

How This Connects to Your Broader Digital Privacy

Attackers often test exposed credentials on low-friction apps like delivery services before moving on to banking, email, or cloud storage. If a bad actor can add themselves to your orders undetected, they might also:

• Reset other accounts via email or SMS if those accounts share passwords.
• Use saved addresses and notes to infer your routines and physical security gaps.
• Leverage stored payment methods for “small test” charges before larger fraud.

Treat any odd account behavior as a prompt to refresh passwords, enable MFA, and prune personal data across your high-risk accounts.

Simple Password and MFA Upgrades

Strong authentication reduces 90%+ of these incidents:

• Use a password manager to create unique 16+ character passwords for each delivery app.
• Prefer app-based MFA (authenticator) or a hardware key. If only SMS is available, still enable it.
• Update recovery options: Ensure the recovery email and phone are current and private.
• Disable old sessions: If your app shows logged-in devices, sign out of all but your current one.

When to Escalate Beyond the App

Escalate if you encounter repeated takeovers, unresponsive support, or evidence of broader fraud:

• Contact your bank/card issuer to issue a new number and monitor for follow-on charges.
• Place a temporary fraud alert with credit bureaus if you see signs of identity misuse.
• File a report with local authorities if goods were stolen via rerouting or pickup impersonation.
• Preserve evidence: screenshots, emails, chat logs, timestamps, and support case numbers.

Conclusion

“Driver added” or “Shopper added” notices are easy to overlook—but they’re among the earliest, clearest clues that someone may be trying to hijack your delivery. Treat any unfamiliar addition as urgent, remove it, lock your order to the original address, reset credentials, and enable strong alerts and MFA. With a short security routine and tighter data hygiene in your delivery profiles, you can stop reroutes before they start, keep your orders in your hands, and reduce the personal information available for attackers to exploit across your digital life.