In the early hours of the morning, while people were sleeping soundly at home, the Meituan account on their mobile phones was being used to place orders frantically in a strange city thousands of miles away - group buying coupons for restaurants such as "Beef****" and "**Teppanyaki", and the coupon codes were quickly written off.
Recently, Red Star News reporters received reports from users in Shaanxi, Gansu, and Guangdong that their Meituan accounts had been stolen from other places without their knowledge, and the methods of the theft all involved the Meituan monthly payment function. These users have all enabled password-free payments of less than 500 yuan.
The amount of losses of these users ranged from more than 1,000 yuan to more than 4,000 yuan. Some of them chose to call the police. The police receipt obtained by the reporter showed that the relevant police were "further investigating", while other users said that no case has been filed yet.
On July 28, a reporter from Red Star News contacted Meituan customer service based on the information provided by the damaged users. These coupon codes were written off and could no longer be refunded. The platform determined that the users may have accidentally clicked on malicious links on their mobile phones, were infected by viruses, and were placed orders remotely. If you need to know the background details of stolen orders, you need to obtain them through judicial verification procedures.
"Silent" theft in the early hours of the morning
Purchase multiple group buying coupons in a row
Mr. Quan is a Meituan user from Zhangye, Gansu. Around 12 o'clock in the middle of the night on July 21, about 2,475 yuan was swiped from his Meituan account through monthly payment, which was used to purchase multiple group buying coupons.
"I didn't notice it at all at the time, and it wasn't until the early morning of July 24 that another 1,500 yuan was swiped." Mr. Quan told reporters that he did not receive a text message reminder from Meituan about this transaction on the 24th, but received a risk control text message from the bank - the bound Postal Savings Credit Card prompted that "there may be risks" and suspended the transaction.
The record of Mr. Quan’s Meituan account being stolen
"I clicked on the Postal Savings App and saw that it was 'Specially Invited by Meituan.' I opened Meituan. I was dumbfounded when I opened it." It was around 5 a.m., and Mr. Quan found that there were 6 unwritten coupons in his account, so he quickly canceled them manually, recovering a loss of 1,500 yuan on the 24th. However, the five coupons stolen on the 21st have all been written off and cannot be recovered.
A screenshot of the Meituan App provided by Mr. Quan shows that the purchase time of the five coupons that have been written off is from 12:00 to 12:25 on the 21st, and the write-off time is from 11:39 to 8:29 on the 21st. The group buying coupons are all "Niu******", and the write-off locations include Beijing, Nanjing, Nantong, Yiwu and other places.
Mr. Wu in Wuzhou, Guangxi, encountered an even more intensive attack. From 2:35 to 43 am on July 23, in just 8 minutes, his Meituan account generated 4 consecutive orders through Dianping and Meituan, all of which were used to purchase group buying coupons for the "Niu****** Store" in Jinhua, Zhejiang - 456.59 yuan, 377.88 yuan, 378 yuan, 457 yuan, totaling 1,669.47 yuan.
Mr. Wu’s record of stolen Meituan account
The reporter saw in the screenshot of its App that all four orders were paid through Meituan Monthly Payment, and all were completed in the early morning hours. One order was placed through Dianping, and three orders were placed through Meituan. Meituan’s monthly payment bill shows that all 1,669.47 yuan was included in the August bill, and the repayment date is August 8.
Mr. Wu himself was in Guangxi at the time, and all the coupon codes had been canceled in Jinhua. He immediately initiated a refund appeal through Meituan, and all four appeals for orders were rejected by the platform, with only "Appeal Rejected" displayed. Mr. Wu reported the case to Datang Police Station of Wuzhou Municipal Public Security Bureau and received 110 police on-site receipts. The receipt showed that the alarm time was 18:10 on July 24, and the handling status was "further investigation."
Mr. Xu from Weinan, Shaanxi Province encountered a similar situation. At about 3:30 a.m. on July 12, his Meituan monthly payment generated 4 consecutive orders, totaling about 1,800 yuan, all of which were used to purchase coupon codes for stores such as "Niu******" in Xi'an. Mr. Xu told reporters that he had enabled small password-free payments, with the limit set to less than 500 yuan, and each amount of fraudulent transactions was controlled within 500 yuan.
Mr. Xu’s record of stolen Meituan account
"On July 22, I suddenly received a monthly payment reminder. After I made one payment, I discovered that there were still 11 installments left, and I realized something was wrong." After checking the order, Mr. Xu found that he was in his hometown in Weinan, but the coupon code was written off in Wenzhou, Hangzhou, Beijing and other places. Therefore, he called the local police in Weinan, but the police have not yet responded to the filing of the case.
Meituan customer service speculates that users’ mobile phones have been controlled
The canceled coupon code cannot be refunded
On July 28, a Red Star News reporter contacted Meituan customer service based on the accounts, orders and personal information provided by some of the stolen users. Customer service said that the platform has unified the compensation rules and made it clear that once the group buying coupons are written off offline, there is no channel for refunds after consumption. Users who want to recover their losses can only call the police and then retrieve the platform's backend data through judicial verification procedures.
In response to Mr. Wu's fraud dispute, Meituan Financial customer service explained to reporters that the platform judged through backend review that the victim had previously clicked on an abnormal pop-up advertisement on the website, resulting in a black screen on the phone and remote control of the background. The fraud orders were all completed within the user's local login session. Meituan App cannot identify the underlying Trojans and remote control behaviors of the mobile phone system, and can only determine that the account is operating normally.
Customer service said frankly that the platform will not block orders simply because the transaction occurs in the early morning. Even if there are multiple group purchases of the same type in a short period of time, if there are no strong risk signals such as new device logins from other places or large amounts exceeding limits, it will be difficult for the system risk control to automatically block the transactions. In response to requests for refunds, customer service gave a clear answer: As long as the group buying coupons are verified off-line at offline stores, the platform cannot handle refunds independently, even if the victims have called the police. "Now we can only contact the police to recover it. At present, (Meituan) cannot refund it under any circumstances because it has been used. Even if the police contacts (Meituan), it cannot be refunded."
Customer service further explained that if users want to retrieve account login logs and complete backend records of orders in order to obtain the data at the time of the fraud, they must go through judicial verification procedures.
In response to Mr. Quan’s Meituan account being stolen, Meituan customer service said that after the platform detected that Mr. Quan’s account generated abnormal orders in batches in the early morning, it has implemented background restrictions and frozen the account. The account can never be logged in and used. However, the refund authority for canceled orders in the account is not in the hands of the account security department. Customer service has no right to directly determine whether refunds can be made. It can only transfer refund requests to the order review department for review, without any refund commitment.
The customer service line stated that Mr. Quan’s stolen orders were all taken away in the early morning. “So we suspected that we were defrauded, so we called the police as soon as possible and asked for help from the police. If the police need the cooperation of the platform, we will cooperate as soon as possible.” The other party said that if the police need to contact Meituan, the user can contact the police directly after calling the police. If Meituan needs to cooperate with the police, they can directly call the relevant number of Meituan, and Meituan can cooperate with the police.
Red Star News reporters sorted out the characteristics of many stolen users and found that their mobile phones were all Android systems, and a considerable number of people had black screens on their mobile phones due to clicking on unknown links. Mr. Guo from Zhumadian, Henan Province, lost about 4,000 yuan due to fraud. He recalled: "There was a black screen (on the phone), and I turned it off and restarted it." Mr. Ling from Foshan, Guangdong Province was stolen for more than 3,800 yuan. He also told reporters, "There have been times when the mobile phone got stuck when clicking on the App. Anyway, I couldn't click it, and then the screen went black and I tried again."