Fraud attempts are becoming more sophisticated, and protecting your merchant account has never been more important. At DoorDash, we’re committed to partnering with you to keep your business, your earnings, and your information secure. This guide outlines practical steps you can take today, from strengthening your passwords to detecting suspicious activity, so you can confidently manage your account and know what to do if something doesn’t look right. By staying informed and taking a few simple precautions, you can significantly reduce your risk of fraud and keep your focus where it belongs: running your business.
What is an account takeover (ATO)?
An account takeover (ATO) happens when someone gains unauthorized access to your DoorDash account. This can occur if a bad actor obtains your login information, for example, through phishing, reused passwords, or malware,and then uses your account without your permission. With access, the bad actor may try to change your profile details, add new users, update banking information, or place fraudulent orders. ATOs can disrupt your business, so it’s important to keep your account information secure.
Common signs of an ATO include:
Unexpected changes to your account details or banking information
Missing weekly payments from DoorDash
Login notifications you didn’t initiate
Orders or actions you don’t recognize
Locked-out access or password reset emails you didn’t request
Unsolicited calls from those pretending to be DoorDash support asking for a one-time passcode
As a reminder, DoorDash may call to confirm a recent change, but we will never ask for a one-time login passcode when we contact you. However, if a merchant calls in to Merchant Support, an agent may ask for a passcode to verify your identity.
What should I do to protect my account if I believe I’ve been hacked?
Immediately report this activity to DoorDash Merchant Support via the Merchant Portal.
If you are unable to access your portal, reach out to Merchant Support
You can click the “Need help?” button in the bottom right of any page in the Merchant Portal
If you still have portal access, ensure your contact details are correct and update your Merchant Portal password.
Navigate to the Mx portal and click the “Reset Password” button in order to receive a link to update your details
Ensure your underlying email is secure. When in doubt, update your email password and turn on multi-factor authentication with your email provider:
Why am I being asked to go through ID verification?
For sensitive changes like a store change of ownership, DoorDash may request ID verification to confirm that the person facilitating the ownership matches the owner or store manager. This provides an extra layer of security to prevent phishing attempts and impersonation.
What is your current policy for supporting merchants impacted by fraud?
We understand how disruptive fraud can be, and the serious impact it can have. We’re committed to providing a clear, supportive experience for merchants who encounter suspicious or fraudulent activity. DoorDash has always worked to assist merchants impacted by fraud, and we’re now formalizing that approach with clear fraud protection and support guidelines. We strongly encourage merchants to regularly monitor their accounts and report any unusual activity within 30 days so our team can investigate and help resolve the issue.
As part of that investigation, we look closely at what happened and how the unauthorized activity occurred. In situations where an account takeover stems from compromised merchant credentials, eligibility for reimbursement will be evaluated on a case-by-case basis. Depending on the outcome of our internal review, and the type of fraud that has occurred, merchants may qualify for a limited one-time courtesy reimbursement.
What can I do to protect my account?
Use a Strong, Unique Password – Most account takeovers start with a compromised email account. Use a unique password for your store’s email that you don’t reuse anywhere else. Avoid using common phrases or personal information.
Monitor Account Notifications – Keep an eye on your email and texts for updates related to account changes. If something looks unfamiliar, or you receive a notification about something you didn’t authorize, such as a password reset, bank change, or new manager addition, reach out to DoorDash Merchant Support via the Merchant Portal, to investigate and secure your account.
Turn On Multi-Factor Authentication (MFA) – Enable MFA on your email and DoorDash accounts. This adds an extra layer of protection, making it much harder for someone to access your account even if they have your password.
Watch for Phishing Attempts – Be cautious of anyone contacting you by phone, email, or text asking for your login code or personal information. If the message doesn’t come from an @doordash.com email address, it’s likely fraudulent. When in doubt, reach out to DoorDash Support directly instead of replying or clicking on any links. Remember: DoorDash may call to confirm a recent change, but we will never ask for a one-time passcode when we contact you. However, if a merchant calls in to Merchant Support, an agent may ask for the passcode to verify your identity.
Stay vigilant – DoorDash will never call you and ask for a one-time passcode (OTP). If you receive an unsolicited call from someone claiming to be from DoorDash and asking you to make sensitive account changes, immediately hang up. This is likely a fraudulent attempt. Please contact Merchant Support for assistance.
You can find more information here on how DoorDash is strengthening merchant security with new verification steps, account alerts, and fraud protection policies.
