People Are Making Bots to Snatch Whole Foods Delivery Order Time Slots

Social distancing and stay-home orders have led to booming demand for grocery delivery services. In some big cities, people report not being able to find an open delivery time slot for days or weeks at a time. And now Motherboard has found a series of bots that automatically give some people an upper hand when limited delivery time slots are available on Amazon Fresh or Wholefoods.

A slew of developers have made bots and other tools that, in some cases, automatically hunt for a free delivery slot, grab it, and then complete the user's food order, making sure they have a much better chance of buying food before other people snatch up the slot. While some of the developers told Motherboard they designed their bots to help those in need, such as senior citizens who may need to stay inside as exposure to the coronavirus could be more serious for them, others are dealing with the ethical issue of releasing a tool that can clearly be abused, by allowing those who can figure out how to use a technical tool to buy food while others go without.

"Yes, it's an unfair advantage over others who aren't tech-savvy but may still need to purchase items urgently. However, I try my best to reduce the abused [sic] problem," Manfong, the developer behind a Chrome extension that notifies users when a delivery slot is available, told Motherboard in an email.

Checkout bots, often reserved for buying things like limited edition sneakers or concert tickets, are in particularly high demand at the moment for other items. Last week Motherboard reported how one developer had created a bot dedicated to buying the Nintendo Switch, with resellers grabbing as many as they can to sell for a profit during the crisis. Now, that idea of getting a technical one-up over others has expanded to buying essential items such as food.

The increasing number of people using services like Amazon Fresh, Whole Foods, and Instacart has led workers on these services to be put at risk during the pandemic, too.

Data scientist Pooja Ahuja publicly released her own bot a few weeks ago, which checks for a free delivery slot on Wholefoods or Amazon Fresh. Her tool goes a step further though, and can also checkout automatically.

"You just have to run the bot once, and as soon as there is a delivery slot available, it secures it for you, and completes the entire process through checkout," Ahuja told Motherboard in an email.

Ahuja explained that some of her colleagues, friends, and family have eldery members at home, and so they tend to order their groceries online.

"But with the extensive rise in demand for delivery services, it became almost impossible for them to find a delivery slot," she told Motherboard. And when there was a slot, it was for deliveries in two or three day's time, and not the same day, so she decided to create her bot.

"I designed the bot for those who find it extremely inconvenient in these times to step out, or find it not safe for themselves to be outside. It is my contribution to help flatten the curve, I really hope this'll help reduce the number of people going out," Ahuja said.

Ahuja said she frequently uses the bot herself to order groceries, and said people have reached out to her saying they've used it too. On the bot's Github page, users have asked if the tool can be expanded to work with other food delivery services, and hundreds of Github users have "starred" the bot, essentially bookmarking the tool for potential use later.

When asked if Amazon or Wholefoods presented any sort of mitigations to people ordering food via a bot, Ahuja said she added certain wait times to the tool, "which helps Amazon not see us as a harmful bot."

"So far there have been no blocks from Amazon," she added. Amazon did not respond when Motherboard asked the company if using a bot like this to automatically purchase food would be against the site's terms of service.

Motherboard found other similar tools that people had specifically developed to have a better chance of successfully ordering food from Amazon Fresh and Wholefoods during the pandemic. Most, like Manfong's Chrome extension, focus on identifying a delivery slot, and then quickly notifying the user who has to then complete the checkout themselves.

"Me and my wife were trying to order stuff off Amazon Fresh but finding an available slot was near to impossible. This made me build the bot and share it with others so they can use it too," Bryan Gaikwad, who developed a script for finding delivery slots and released the tool publicly, told Motherboard in an email. Adrian Hertel told CNBC his own tool is designed for a similar purpose.

Techies have turned to other tools to help them order food online.

"We've ordered groceries a few more times using this. Just last night as a matter of fact," Anand Iyer, the CEO of child care company Trusted, told Motherboard in an online chat, referring to a Chrome extension that rapidly refreshes a user's webpage and can push an alert when certain text appears. "It was going to be impractical to keep refreshing my browser window to find a lot," Iyer added.

Some of those most at risk of the coronavirus, such as the eldery, who are staying inside and may need to use food delivery services are not going to be able to use bots or scripts to help them order food, or even know that this is a technical possibility. Instead, these bots may disproportionately benefit those who do have the technical know-how to do so, leaving others behind.

Keenan, an Amazon Fresh user from Los Angeles, previously described to Engadget just how hard it can be to secure food through Amazon Fresh without the benefit of a bot. "I've literally been trying to order Amazon Fresh for the past week or longer," he told the publication. "I kept on top of it, and just kept trying day after day, multiple times per day and hour, which was exhausting to say the least […] If you go through that entire process over and over as items continue to sell out, let me tell you that isn't fun." Eventually after a week he did manage to find an open window, he added.

With the room for abuse in mind, Manfong said their extension has a reasonable refresh time of 15 to 20 seconds.

"I think the people who use the F5 key to refresh the page may use one to two seconds which [is] definitely faster than this extension," they told Motherboard. They've also added a disclaimer to the tool's page asking, "Please Do NOT abuse this extension and please HELP THOSE IN NEED during these tough times!"

In response to whether he believed his tool may put less tech-savvy people at a disadvantage, Gaikwad added in an email, "That was not my intention as I mentioned it was just a project I built to test the concept. I willing to take my source code down if needed." After the publication of this piece, it appears Gaikwad removed the code from his Github page; the tool repository now returns an error.

Other developers don't appear to see the ethical quandary with releasing such tools, though. When asked if she was worried that people who aren't in serious need for her auto checkout bot may still use it just to get ahead of others, Ahuja told Motherboard, "What I've noticed with the rigorous testing is that, many delivery slots do open up over the day for same day delivery. Even if someone did use the bot to want to get ahead of people in need, more slots will open up for those who need it, and the bot can help out them as well. One way or the other we can help reducing the number of people stepping out."

An Amazon spokesperson told Motherboard in an emailed statement, "Grocery delivery is a vital service as communities face the challenges of COVID-19. Our primary focus is increasing delivery availability every day so that we can serve more people. To do this, we’ve rapidly expanded grocery pickup, increased hiring, transitioned select stores to exclusively fulfill delivery orders and more. And, in the coming weeks we will release a queueing feature giving customers a virtual place in line to secure time to shop and schedule delivery, allowing for a more equitable distribution of delivery windows."

Update: This piece has been updated to include additional comment from Gaikwad and to mention that Gaikwad seemingly removed his code from Github after publication.

Subscribe to our cybersecurity podcast, CYBER.