In this guide · 8 sections
Short answer
Give each staff member their own merchant app login with the lowest role they need, keep owner and finance logins with the owner, and protect the business email behind them with MFA. Lock order tablets to the order apps, never share passwords or OTPs over the phone, and check payout bank details monthly.
The scam targeting F&B merchant accounts
On 18 November 2025 the Singapore Police Force issued an advisory on scams impersonating food delivery platforms. Since August 2025 there had been at least four reported cases, with losses of at least S$42,000. The pattern described by the police:
- An unsolicited call claims to be from a delivery platform, citing a point-of-sale terminal upgrade or connection problem.
- The caller asks for email addresses, mobile numbers, platform passwords or OTPs; in one case, a photo of an NRIC over WhatsApp.
- Scammers then log in to the platform account or the business email, change the payout bank account, add their own email and switch off notifications.
- Earnings go to the scammer's account. Victims only notice when they check with the platform.
Accounts to lock down first
Most outlets have more accounts than they realise. List them, note who can log in, and protect the ones that control money first.
| Account | Why it matters | Minimum protection |
|---|---|---|
| Business email | Password resets and platform notices go here | MFA, unique password, owner-only admin |
| Delivery merchant portals (GrabFood, foodpanda, Deliveroo) | Payout bank details, menu, promos | Owner login kept by owner, staff on limited roles |
| POS back office | Sales, refunds, discounts, staff PINs | Separate staff PINs, refunds limited to managers |
| Bank and payment provider | Where money lands | MFA, transaction alerts, limits on PayNow |
| Google Business Profile and social media | Reviews, opening hours, customer messages | Two owner-level admins, MFA |
| Wi-Fi router | Network for POS and tablets | Changed admin password, separate guest Wi-Fi |
The Straits Times reported in December 2025 on a hawker family whose email was accessed months earlier and whose reused password then opened their delivery accounts. A unique password per account and MFA on email would have closed that path. CSA's guide to strong passwords and 2FA recommends passwords of at least 12 characters and two-factor authentication on email and other accounts.
Staff roles on delivery platforms
Don't share the owner login with the counter. Delivery platforms let you create separate staff accounts with limited rights. Grab's GrabMerchant portal overview describes three roles:
| GrabMerchant role | What it can do |
|---|---|
| Owner | Full access to portal and app, can add and manage staff roles |
| Store Manager | Full portal access, can grant access to employees |
| Cashier | Manage orders and daily sales; menu edits PIN-protected; no promos, GrabPay refunds or insights |
Grab adds that Billing and Payments settings can only be changed by users with an Admin role. foodpanda's partner portal also has user management with different permission levels; check the roles your account manager has set up. The rule is the same everywhere: cashiers and part-timers get the cashier-type role on their own login, and only the owner (and perhaps the finance person) can see or change payout details.
When staff leave: the F&B leaver checklist
In F&B, people leave often and sometimes suddenly. Make offboarding a ten-minute routine on their last shift.
Disable their merchant app logins
In GrabMerchant, go to Employees and disable the person; do the same on foodpanda and other platforms.
Remove their POS PIN or account
Delete or deactivate their staff profile so refunds and discounts can't be made under it.
Change any shared passwords they knew
Tablet PIN, Wi-Fi admin password, shared social media logins. A password manager makes this quick.
Check admin lists
Remove them from Google Business Profile, Facebook and Instagram, and any WhatsApp Business devices.
Collect devices and keys
Return work phones and tablets, and check nothing was left signed in to personal accounts.
Monthly checks for payouts and alerts
Payout diversion works because nobody looks until money is missing. Put these on a monthly calendar reminder for the owner:
- Open each delivery platform's billing or payout settings and confirm the bank account is yours.
- Check the email addresses and phone numbers on each merchant account; remove any you don't recognise.
- Confirm notification settings are on, so changes to bank details trigger an email or SMS to you.
- Compare platform payout statements with what reached your bank.
- Review the business email for forwarding rules or recovery settings you didn't create.
If your email or social accounts have already been taken over, follow our guide to hacked social media and WhatsApp accounts. If you're reviewing how much of your sales should go through delivery apps at all, see restaurant online ordering vs delivery apps.
Do it yourself or get help?
An owner can set up staff roles and the monthly payout check in an afternoon. The harder parts are getting every staff member off shared passwords, locking down tablets across outlets, and training a changing team to recognise scam calls.
Our Password Manager Rollout (S$290) moves the team to unique, shared-safely passwords. Security Awareness Training (S$390) covers scam calls and phishing in plain language for frontline staff, and Device Encryption & Management (S$490) locks down order tablets and lets you wipe lost ones.
Frequently asked questions
The Singapore Police Force described calls from people posing as delivery platforms, citing terminal upgrades or connection issues, and asking for emails, passwords, OTPs or NRIC photos. With those, scammers log in to the platform or business email, change payout bank details, add their own email and turn off notifications, diverting the outlet's earnings.
No. Give each person their own login with the lowest role they need. GrabMerchant's Cashier role can manage orders and see daily sales but can't create promotions, refund GrabPay payments or view insights, and only Admin-role users can change billing and payment settings. Separate logins also let you remove a leaver without changing everyone's password.
Use a business-owned tablet on a business account, lock it to the order apps with Guided Access or a kiosk mode, set a manager-only PIN and auto-lock, keep automatic updates on, and don't sign in to email or banking on it. Turn on find-my-device so it can be wiped if it goes missing.
Contact the platform immediately through the support channel in its official app or portal, and ask them to freeze payouts and restore your bank details. Change the platform and email passwords, turn on MFA, remove unknown emails and devices, make a police report, and tell your bank. Check your other delivery accounts too.
Treat any such request as a scam. The police advisory says scammers asked victims for platform passwords and OTPs while posing as delivery platforms. If someone calls about your account or tablet, hang up and contact the platform through the official merchant app, or call the ScamShield Helpline on 1799 to check.