Anyone holding my phone can take over my Swiggy account

Earlier today I posted an 8-tweet thread to @SwiggyTech and @swiggydesign about what I think is a possible “security hole” in the Swiggy app. It started with a small mix-up at home, and it ended with me locked out of my own account and support asking me to wait for six months! 🤷‍♂️

As a product engineer myself, I’m not here to rant at Swiggy Cares. I’m genuinely curious about the thinking behind this flow. So here’s the full story, plus what I think a phone number change should actually require.

One account, two people

I have the Swiggy One membership, and because of that my wife also uses “my account” to order food, groceries, etc.

A couple of weeks back, she was out with her friends and decided to order some food quite late at night, to a new address. 🍕 Being a sweetheart, she didn’t want the delivery partner calling me that late, so she went to change the contact number. Except, instead of changing it for the new address, she changed the phone number on the account itself. #oops

Honestly, an easy mistake to make.

Now, the most surprising part: I’m the primary account holder, and I got no OTP and no notification about this change. None. 🤨 The account just quietly moved to a different number without ever asking me.

Finding out a week later

I only found out about a week later, when I tried to log in to Swiggy from my laptop. I entered my number and the web app sent me to a form to create a new account, because it couldn’t find one for my number. 😕

No “hey, this number was on an account until recently, is that you?”. Nothing. As far as the platform was concerned, my number had never been attached to anything.

So I opened the Swiggy app on my phone, found the new number in the account section and pieced the whole story together.

Fixing it should have been easy, right? I went to Edit Account, put my own number back in and hit Verify. And I was greeted with this:

Edit Account in the Swiggy app on 23 February. My details are blurred; the arrow is mine.

“Number used in last 6 months by some user.”

That “some user” is me! It’s my number, and it was on this very account until about a week ago.

Support: “beyond the scope”

No worries, I thought, support can fix this from the backend. On the evening of 23 February I opened a chat with Swiggy support. I explained that my wife meant to change the contact number for one address but ended up changing it for the whole account, asked them to put the account back on my old number, and mentioned that the app wouldn’t let me do it myself because of the six-month error.

The answer: the mobile number “can be changed once in 6 Months through the Swiggy App”. I asked if they could do it from the backend since it was clearly a mistake, or if there was some admin channel I could email.

Alas! What I was asking for is “beyond the scope of what we can do”.

So, the change needed zero approval from me, but undoing it is blocked for six months, and nobody at support can override it. Essentially, I am locked out of my own account. 🤷‍♂️

Why I call it a security hole

In my case it was my wife and an honest mistake, so the worst case is an annoying six months. Fine. Now take the family out of the picture.

Any friend who borrows my phone to place an order can change the account’s number to theirs in a few taps. The new number gets verified, presumably with an OTP sent to that new number, which the person making the change is holding in their hand. My number, the one the account actually belongs to, is never asked. After that:

• I’m not told it happened. I find out the next time I try to log in from somewhere else.
• When I do, Swiggy happily offers to create a brand new account for me.
• The six-month rule now protects the new number from me. I can’t put my own number back, and support says they can’t either.

That account has my saved addresses, my order history and a paid Swiggy One membership. Getting all of it takes a few minutes with my phone and no password.

IMO, this is a big #security #fail.

I get why Swiggy might want a cooldown on number changes. But a cooldown is just a rate limit. It doesn’t check with the current owner, and in my case it’s actively working against the current owner.

What a number change should require

Here’s roughly what I’d expect from any app where the phone number is the login:

1. Confirm from the old number. Send an OTP to the current number before the account moves. If that number is lost, fall back to something else the owner controls. Swiggy already has my email address, right there on the same Edit Account screen!
2. Always notify the old number and the email when the number changes, with a “this wasn’t me” link.
3. Give the old number an undo window. For some days after a change, the previous number should be able to claim the account back without hitting the six-month wall.
4. Make the cooldown smarter. Going back to the number that was on this very account a week ago shouldn’t count as “used by some user”.
5. Let support override it for an owner who can prove the account is theirs.
6. Keep the delivery contact well away from the account number in the UI. The person receiving the food and the person who owns the account are not the same thing, and it shouldn’t be this easy to change one when you meant the other.

Where it stands

The thread ends with the question I actually want answered: don’t you think this is a problem from a security point of view, or am I missing something?

I also told @SwiggyCares under the thread that I’m more interested in hearing from @SwiggyTech and @swiggydesign, and a friend was kind enough to tag them again for me. Neither has replied so far.

For now, the account is still on the wrong number. And none of this is on my wife, by the way. She was only trying to save me from a late-night call from a delivery partner. ❤️