Your phone buzzes. It’s your food delivery driver, and they sound rushed. There’s a problem with your order, they say, and they just need you to read back the code that popped up on your screen before they can finish the drop-off. Sounds routine. It is not. That code is the one thing you should never hand over the phone, and giving it away can cost you your dinner, your delivery account, or the money sitting in your checking account. This trick is spreading fast across DoorDash, Uber Eats, and Grubhub, and it works because it sounds so boring and official. Here’s how it plays out, and exactly what to do when your phone rings.
Why Delivery Drivers Even Ask for a Code
First, the code is a real thing. DoorDash rolled out a four-digit PIN that some customers now have to share with their driver to confirm the food actually made it to the door. The company added this mostly for people who keep reporting orders as missing when they weren’t. If you can’t give the PIN, the driver just notes that it wasn’t provided. It also stops a shady driver from grabbing your food and claiming they dropped it off.
So a code by itself is not a red flag. Plenty of orders come with one. The problem is when and how someone asks for it. A real driver handing you your bag on your porch might glance at their phone and ask for the four digits. Fine. That’s the system working the way it should. A “driver” calling you fifteen minutes before they arrive, asking you to read the code out loud so they can “release” your order, is not the system. That’s someone fishing. Same four numbers, completely different situation, and the difference is everything.
The Phone Call Is the Whole Trick
Here’s the rule that cuts through all of it: you only give your delivery code to a person who is standing in front of you with your food. Not over the phone. Not over text. Not to “unlock” the order early. Not because the app is “glitching.” If they aren’t at your door, the answer is no.
Why does the timing matter so much? Because once someone has your PIN, they can mark the order as delivered in the app even if you never see the food. A viral video put this on people’s radar, and the mechanics are simple. The fake driver gets your code, taps “delivered,” pockets the money and the food, and you’re left staring at an empty porch with an app that swears your dinner arrived. Good luck arguing with customer service when the record says complete.
So burn this into your brain: code first, food never. Real drivers give you the food, then ask for the code. That order never flips.
Yes, They Might Know Your Exact Order
This is the part that trips people up. You figure a con artist calling out of nowhere would sound clueless. Instead, the caller often knows your name, your address, the estimated arrival time, and the exact meal you ordered right down to the extra ranch. It feels impossible to fake, so you let your guard down.
A woman named Cheryl in Toronto got a call from someone who rattled off her exact order and then asked for a code to “confirm” it. The tell? She’d ordered through Uber Eats, but the verification text hit her phone from DoorDash. That mismatch saved her. Meanwhile, her real driver had no idea any of this was happening and dropped her food off like normal. Someone in the comments said the same trick cost them $270.
Knowing your order proves nothing. These callers can see order details, and they lean on that info to sound legit. Treat a caller who knows everything about your order the same way you’d treat one who knows nothing: do not read them any code.
The Uber Version Goes Straight for Your Account
The food-theft version is bad. The account version is worse. With rideshare, drivers (or people posing as them) have called riders right after they book, claiming Uber has a “new policy” that requires you to verify your account before pickup. They ask for your phone number, your email, and the verification code sent to your device.
Hand that over and you’re not just out one ride. Those codes give thieves full access to your account, including the payment card on file. They can change your settings, book fake trips, and lock you out. In the cases people posted online, the caller got pushy when the rider said no, then canceled the ride out of spite. One driver in Vancouver insisted the code was just “special verification we need for today.” It wasn’t.
Uber has said flat out that it will never call, text, or email you asking for your password, verification code, or banking info. Neither will DoorDash. Neither will any of them. If a request like that comes in, it’s coming from someone who wants your account, not your dinner.
Why One Little Code Does So Much Damage
You might wonder how six digits can wreck your week. These codes are called one-time passwords, and they’re the second lock on your accounts. When you log in somewhere new, or reset a password, or approve a payment, the company texts a fresh code to make sure it’s really you.
That’s great when you’re the one using it. It’s a disaster when you read it out loud to a stranger. The moment they type your code, the system thinks the stranger is you. From there they can get into bank accounts, credit cards, and anything else tied to that login. Some people describe accounts drained to zero and fake charges piling up before they even notice.
That’s why the advice is the same no matter who’s asking or how urgent they sound: never share the code with anyone. A real company does not need you to read back a code they just sent you. They sent it to your phone because your phone is the proof. Saying it out loud hands that proof away.
What to Do the Second Something Feels Off
Trust the itch. If a call feels wrong, it probably is. Here’s the move: hang up. You don’t owe a caller an explanation, and you don’t need to be polite about it. These people count on you being too nice to just end the call.
Then check the order yourself. Open the actual app and look at your order status. Don’t tap links from a text, and don’t call back the number that just rang you. Go straight to the app or the company’s real website and find the info there. If your food is really running late, the app will tell you, and you can message the driver through the in-app chat, which is the only channel a real driver uses anyway.
Watch for pressure. Anyone rushing you, warning that your order will be canceled in thirty seconds, or getting frustrated when you hesitate is waving a giant red flag. Real drivers don’t threaten to cancel your burrito because you won’t read numbers over the phone. If your gut says something’s off, it’s already told you what to do.
Drivers Get Hit by This Too
If you drive for one of these apps, you’re a target from the other direction. There’s a version that starts with a weird order, like a single sauce packet or a drink with no food. It’s built to confuse you. Right after, you get a call from “support” saying they need to sort out the strange order, and to do that they need a verification code sent to your phone.
Give them that code and they can walk right into your driver account and grab your earnings. It works because you’re busy, you’re multitasking, and you’re already on alert for problems, so a call about a problem feels believable.
Real support will never ask for a code over the phone. If you get a fake order for one sauce packet, decline it and move on. Some callers also pose as support to trick drivers and restaurants with promises of a free tablet or printer, then ask you to verify your bank account and Social Security number. Don’t. Handle everything through the in-app help center, period.
The Simple Rules That Keep You Safe
You don’t need to memorize a security manual. Just keep a few habits.
Only give your delivery code to a person holding your food at your door. Never over the phone, never over text, never early. Never read back any code someone else claims to have sent you, because companies don’t call to collect the codes they just texted. Ignore the pressure, since cancel threats, “new policy” lines, and frustrated callers are all part of the act. And verify inside the app, not through a link or a callback number. If it matters, it’ll be in the app.
Turn on extra account protection where you can, and if your bank offers an authenticator app instead of text codes, use it. It’s harder to trick. That’s really the whole thing. This con sounds boring on purpose, because boring makes you comfortable, and comfortable makes you talk. So the next time your phone rings and a stressed “driver” needs a code before they’ll bring your food, just hang up. Your dinner will still show up, and your account will still be yours.
