A “new” restaurant called Velvet Orchid Lounge is live on Uber Eats right now with unbelievable “Buy 1 Get 1 Free” platters (R396 for two massive platters – too good to be true, and it is).
The moment you place an order, the menu itself asks you to put your phone number in the special instructions. Seconds later you get a WhatsApp from a number flagged as a scammer on Truecaller. They send a “tracking link” (a tinyurl that goes to a fake Uber Eats login page on some random ngrok URL).
The fake site asks for your email and phone number “to track your order”. When you enter it, Uber Eats sends YOU a real OTP. If you type that OTP into the fake site, the scammers instantly get full access to your Uber Eats account. They can order anything, anywhere, using your saved card (no bank approval needed), mark it “delivered by store staff” so you can’t report it as missing, and empty your wallet before you even realise.
I spotted it immediately (I work in IT), never entered the OTP, and spent the last 4 days desperately trying to warn Uber Eats.
Their response? They initially refused my refund because the scammers marked the order “Completed”. After hours of fighting they finally refunded me, but they completely ignored every single piece of proof I sent:
The store is using stolen photos from Debonairs, Ocean Basket, and random Google images
The WhatsApp scam chat
The fake ngrok login page
Four days later and Velvet Orchid Lounge is STILL ACTIVE on the app, still running the exact same scam, still asking customers for their phone numbers.
Uber Eats has done absolutely nothing to remove this fake restaurant. They don’t verify who they let on their platform and they don’t care when you prove active fraud is happening.
This isn’t “a compromised account” – this is a 100% fake store Uber Eats allowed on the app that is actively stealing from people, and Uber Eats is protecting the scammers by refusing to act.
