A complaint about a cake with inedible plastic decorations led Chinese authorities to uncover a network of 67 ghost restaurants on delivery apps. These establishments operated with fake licenses, no physical address or health inspection, and transferred orders to unknown kitchens. The scandal has put millions of users on alert.
How code and APIs allow hiding non-existent kitchens 🍽️
Delivery platforms rely on automated verification systems that approve licenses through OCR and government databases. Scammers exploited these APIs by submitting edited documents and generic addresses. Additionally, they used multiple accounts and virtual routers to simulate locations. The backend did not validate the physical existence of the establishment, only the digital paperwork. Thus, an order could be redirected to any unregistered kitchen.
The cake that cannot be eaten and the kitchen that does not exist 🎂
It turns out that ordering a cake decorated with plastic figurines was the start of an investigation that uncovered restaurants as real as a syrup unicorn. While the user complained about not being able to bite the decoration, the apps distributed menus from kitchens that only existed in a database. The moral: if your dinner comes from a place with no address, it might also be made of plastic.