I saw a similar post on reddit about a week ago ( <a href="https://www.reddit.com/r/canada/comments/bgrl7n/canadian_mcds_app_is_not_safe/" rel="nofollow">https://www.reddit.com/r/canada/comments/bgrl7n/canadian_mcd...</a> )<p>From the top comment, speaking to support on the phone:<p>> "He then admitted that the issue was that The App would occasionally load the wrong user's account, which was allowing people to purchase using someone else's CC."<p>If that is what is happening, maybe it is similar to the caching issue Steam had when serving store pages a year or two ago.
> "I expected them to do the refund because it was their fault," he said. "It's their application. If it's not secure, they should take responsibility."<p>The internet has been retelling some version of this story forever: company system screws paying customer, and company refuses to help or even admit a problem.
Were these users on the Android version of the app? Would this exploit be device agnostic or would something in how Android handles in-app payments have effected this? Does the platform matter here?