Saskatoon café says scammer redirected money owed from food app

A café owner in Saskatoon says she's happy with a resolution Uber Eats came up with after alleged fraud.

Between September 2023 and the end of 2024, thousands of dollars worth of Uber Eats orders fulfilled by Tot Café ended up in an unknown bank account based in Calgary, according to the business owners.

Uber Eats told the café that in September 2023, it got a request from Tot Café's verified email to change the bank account associated with the restaurant and hadn't been made aware of the payment issue until this past month.

It turned out a fraudulent user had accessed Tot Café's email. The total owed to the café after co-owners Nicole Kwau and Boxiong Xiao reached out to Uber Eats, by their calculations, was $8,600.

"It was actually frustrating at the beginning because I was thinking, 'Oh my gosh, we're going to lose that much money,'" said Kwau. "It's actually a lot of money for small businesses like us."

Kwau said there is a happy ending, as Uber Eats is reimbursing the lost money.

Saskatoon police Sgt. Matthew Bradford, who investigates economic crime, said many fraudsters target small- and medium-sized businesses, as many of them don't have sophisticated firewalls or cybersecurity.

"They're running their email, their business email from their personal devices, their personal laptops," Bradford said.

"Just being mindful that these kinds of frauds can occur and to research and take steps to protect your devices and your accounts from potential threats is key."

Saskatoon police say they get reports about businesses having their email compromised nearly every week.

Typically a business will get an email and click a link that allows fraudsters to redirect money or intercept money meant for the business.

A fraudster might also pose as a vendor or supplier and get the business to send money meant for that vendor or supplier.

Kwau said Tot Café is still using food apps, but paying extra attention to payment and security.

"If [food apps] promise to send us the money, for example every Monday, and we don't get the money on Monday, then we should contact them immediately just to avoid future issues like this," Kwau said.

Kwau is warning other small business owners to use two-step authentication, and never give out personal email addresses or personal phone numbers.