PJ VOGT: So, before we start the show, tiny announcement. There’s actually something we need your help with basically for the past week in the office we’ve been talking about this thing which is just like stuff from our past that is still online that we would like removed from the Internet and it’s turned into a very fun and horrifying thing to discuss. So, like Alex Goldman has an incredibly teenaged live journal, which we’ve actually talked about on the show. He tried to delete that it was archived by me. Emmanuel, one of our producers, has apparently a movie review blog that is still online despite his best efforts, we’re looking for stuff like that from you. It doesn’t just have to be embarrassing like it can be sad it can be just like anything that you want taken off the Internet. It also doesn’t have to be something you’ve written. It can be like a local news story that you were featured in that you wish you weren’t. Just to be clear we’re not going to delete these things for you we just want to hear the stories if you have one, send us an email at replyall@gimletmedia.com, subject line: “Forget It”. Okay, here’s the episode.

[THEME MUSIC]

PJ: From Gimlet, this is Reply All. I’m PJ Vogt.

ALEX GOLDMAN: And I’m Alex Goldman.

PJ: And also in the studio with us is Damiano Marchetti.

DAMIANO MARCHETTI: Hey guys.

PJ: Hey!

ALEX: Hi Damiano.

DAMIANO: How are you guys doing?

PJ: Pretty good.

ALEX: Just ate lunch, feeling full.

DAMIANO: Yeah.

PJ: You know when people ask you how you're doing, they're not just asking whether you're full or not full, right?

DAMIANO: I'm also kind of full.

PJ: Guys! That's not- that’s not what it's supposed to be–

DAMIANO: PJ, how’s your fullness?

PJ: Honestly, I'm a little over full.

DAMIANO: Yeah.

PJ: I was wrong, this feels good. Okay, what’s going on?

DAMIANO: So, a couple weeks ago, I talked to this woman named Tzvety.

ALEX & PJ: Tzvety?

DAMIANO: Yeah.

TZVETY: Yeah, it’s Bulgarian it’s spelled it t-z-v-e-t-y.

DAMIANO: T-z-e-z-v (laughs).

TZVETY: Oh, nope (laughs).

DAMIANO: Tzvety, though?

TZVETY: Yeah, it’s Tzvety. Oh, you said it perfectly.

DAMIANO: Nice.

DAMIANO: She just had this like, wonderful little mystery I would call it.

PJ: Okay.

DAMIANO: And I went into it thinking it would be relatively easy to figure out, like this small simple question must have like a small simple answer. I was so wrong.

ALEX: Okay…So what happened?

DAMIANO: So, Tzvety, she lives in North Carolina, and she doesn't work there anymore. But when she was 18 she got a job at Domino's.

PJ: My old employer. I used to be a Domino's pizza delivery.

DAMIANO: Oh, I knew that.

PJ: Yes, one of the better jobs I had.

DAMIANO: Okay, so she–she was working at a Domino's, she actually kind of like worked her way up.

DAMIANO: What were the things that you most liked about working there? In that first job?

TZVETY: Just this family aspect. Because you work–you work through these like stressful shifts with all these other people and like one of them would teach me how to drive like when it was slow or like after a shift.

DAMIANO: Oh, really?

TZVETY: Yeah.

DAMIANO: That’s nice.

TZVETY: And me and the general manager used to like go drink at her apartment. Um (DAMIANO: Mhm.) so, you know, it's just a whole big family.

DAMIANO: So she's working um in the back of- you probably know this but like when an order comes in, like it shows up on a screen.

PJ: Shows up on the computer and then there's like a sort of backish room where you make it. And it's super, they’ve like, one of the things that is cool is they’ve completely automated it.

DAMIANO: Yeah.

PJ: So you like take down a circle of dough that's already done and then you like put on the toppings of the thing and then you just put it on a conveyor belt and then it comes out the other side and you can go. Also, you can make your own pizzas that are not on the menu and it gets pretty exciting.

DAMIANO: Oh, God!

PJ: So, wait anyways, Tzvety.  

DAMIANO: So, Tzvety. So, there's a screen where the- the–the orders come in and she's working one day and this sort of like strange order comes in.

TZEVTY: So, I remember like we got an order and whenever we get an order that has nothing that needs to be put in the oven at all then it's gonna pop up on the screen and give you a message like, “no items to be made.” We got an order like that and I was like, “okay weird.” So, I right away walk over to see what it is. And I look at it and I see it's just a 20-ounce Coke.

PJ: Just a Coke? Nothing else.

DAMIANO: Just a Coke.

PJ: You can make that order?

DAMIANO: I guess so. So, like, like the Coke that you're drinking right now.

PJ: Right, somebody is just like, “please drive to my house and bring me one Coke.”

DAMIANO: And it was even weirder than that. It wasn't deliver me a Coke. It was a- an order for pickup. So–

ALEX: That's super weird.

PJ: So, take a Coke out of the freezer–fridge.

DAMIANO: Fridge.

PJ: I'll come buy it from you.

DAMIANO: Yes.

PJ: But I'm calling ahead first just in case–

DAMIANO: To say I'm coming.

PJ: Okay.

DAMIANO: And the weirdest part of this order was the name, it was Adam Pisces.

PJ: Adam Pisces, like the astrology sign?

DAMIANO: Yeah, exactly. And Adam Pisces never shows up to pick up his coke. And then, a week later it happens again.

[MUSIC]

TZVETY: So, I don’t think the order was like too soon after the first one.

DAMIANO: Wait, like the exact same order came in again? Like, Adam Pisces, 20-ounce personal Coke?

TZVETY: Yes. Yeah (laughs).

DAMIANO: Woah, and what did you, what did you think when you saw it again?

TZVETY: At that point, I was like, “what is going on?”

DAMIANO: So Tzvety decides she’s going to start poking around. Like try to figure out what is going on with these orders. And so she goes to the one place on the internet where she knows for sure people are going to want to figure it out too. It’s this wonderful place, it’s called DLIVE.

ALEX: What's DLIVE?

DAMIANO: DLIVE is like, it’s like the internet for Domino's employees.

PJ: Is it like from the corporation?

DAMIANO: Yeah, so it's like you can only get into this internet for–if you’re a Domino’s employee you get like a Domino's username and login, probably after your time PJ.

PJ: Yes.

DAMIANO: And on it there's like a message board.

ALEX: Oh, that's so cool!

DAMIANO: Yeah, so she goes on DLIVE and types “Adam Pisces” into the search bar.

PJ: Mhm.

DAMIANO: And like immediately it’s just like post after post  

[MUSIC]

after post of people being like, “I got this weird order from a guy named Adam Pisces. (PJ: Woah.) It was for a personal Coke and like then it just disappeared.” And it was like from all of these different Domino’s like all over the place, like across the country.

PJ: Okay.

TZVETY: And they would ask, you know, “Hey, what's, what's up with this weird order I keep getting from under a name Adam Pisces? Carry out 20- ounce Coke” like the same exact, like characteristics of the orders I would` get–

DAMIANO: Holy Crap! How did you feel?

TZVETY: Yeah, I was like, “Are you–what in the world's going on?”

I like, I was just, I was actually drawn in. I was like, “I have to figure out what is going on with this.”

DAMIANO: So, Tzvety is dying to know what’s been going on–

PJ: She wants to know what's going on with Adam Pisces.

DAMIANO: Yes.

PJ: You've like hit on one of the things that I truly care about in life, which is Domino's Pizza.

DAMIANO: That’s kind of how I feel now, too. Um, so, I wanted to figure out like who is Adam Pisces and what is he up to. And I assumed, like from the start, Adam Pisces has got to be like a pseudonym but just to make sure I went online and I started searching for Adam Pisces. That lead me nowhere, so I had to take a different approach.

DAMIANO: So, I ordered a 20-ounce Coke on the Domino’s website, and I’m walking to go and pick it up. Also, I’m going to ask them about Adam Pisces, hopefully I can get some answers.

Okay. I’m here. I guess I have to do this now. Okay, here we go.

[walks into Domino’s]

DAMIANO: Hello? Hi, how are you doing?

DOMINO’S EMPLOYEE: Good.

DAMINANO: I ordered uh, I ordered just a Coke under the name Damiano.

DOMINO’S EMPLOYEE: What’s the name?

DAMIANO: Damiano. Oh thank you. Can I–can I ask you a question?

DOMINO’S EMPLOYEE: Yeah, you can.

DAMIANO: So, can I ask you, like, have you ever gotten an order–I’m working on a story about a weird thing that seems to be happening at all kinds of different Domino’s–

DOMINO’S EMPLOYEE: I can’t hear you.

DAMIANO: You can’t hear me? How do I–how do I best talk to you? Maybe through this like split in the partition? So, there’s this weird thing that’s happening–have you ever gotten an order like this for uh just a Coke from a guy named Adam Pisces?

DOMINO’S EMPLOYEE: I still can’t hear you.

DAMIANO: You can’t hear me?

DOMINO’S EMPLOYEE: You got to speak up! Speak up!

DAMIANO: Okay, okay. Have you ever gotten an order, so, I’m working on a story it’s about this thing that seems to be happening at all of these different Domino’s where they just get this order for a Coke from this guy named Adam Pisces.

DOMINO’S EMPLOYEE: No.

[doorbell rings]

DAMIANO: Never? So, it’s this really weird thing where it’s like all these Domino’s all across the country, it’s like they just get this order–

DOMINO’S EMPLOYEE: You want it or you don’t want it?

DAMIANO: Uh, I do want it. I do want it (laughing).

DOMINO’S EMPLOYEE: You’ve gotta pay for it first.

DAMIANO: Okay, I’ll pay for it.

DOMINO’S EMPLOYEE: Okay, $2.22.

DAMIANO: $2.22, okay. So you’re saying nothing like that’s ever happened to you before? No.

[MUSIC]

DOMINO’S EMPLOYEE: $2.22, sir.

[someone laughs in the background]

DAMIANO: Okay.

[register beeps]

I’m sorry to disturb you here at work. Do you know about DLIVE.com?

[register beeps]

Okay.

[register beeps]

DOMINO’S EMPLOYEE: Okay, sir, thank you.

DAMIANO: Alright, thank you very much [walks outside]. Okay, not very successful.

[MUSIC]

DAMIANO: But then, I started to have a little bit more luck just calling Domino’s stores

DOMINO’S GUY: Thank you for choosing Domino’s will this be for delivery or carryout?

DAMIANO: Um, it’s for neither. Do you have just like one second? I’m actually a journalist, um, and I just have a quick question.

DOMINO’S GUY: Okay.

DAMIANO: Um, I- so I’m doing–I’m working on a story and I’m trying to–it seems like this sorta strange thing is happening in a bunch of Domino’s, which is that this man named Adam Pisces is ordering just like a 20-ounce Coke? Um, and then like never showing up to pick it up? Is that happening (DOMINO’S GUY: Yeah.) to you guys?

DOMINO’S GUY: Yeah.

  DAMIANO: It is.

DOMINO’S GUY: It happens at all of them.

DAMIANO: So, can you like- what–it’s such a funny thing. When is it happening to you guys?

DAMIANO: And then you hear him kind of put the phone to the side, and you can hear him in the background talking to his manager.

DOMINO’S GUY: Some journalist, he’s asking about that Adam Pisces thing.

DOMINO’S MANAGER: Who?

DOMINO’S GUY: Adam Pisces, the Coke that happens.

DOMINO’S MANAGER: No.

DOMINO’S GUY: (hangs up)

PJ & ALEX: (laughs)

PJ: He's onto us.

[MUSIC]

DAMIANO: So They didn’t want to talk… but pretty quickly, I found other domino’s employees who were totally game to talk.

And I learned so much from them. Not just about Adam Pisces, but also about the completely absurd world that is Domino’s Pizza.

So the thing that you have to understand about Domino’s Pizza is like a lot of other fast food chains, their whole thing is efficiency right? Like they want standardized pizzas delivered as quickly as possible, and they have all these systems in place to make that happen.

But the people who these systems are meant to control… they’re like 19 year olds who wanna go to work, make some money, and like maybe get stoned.

I really enjoyed talking to them and they all had theories about what was happening with these Adam Pisces orders. One of the first guys I talked to was this guy named Benny.

[MUSIC]

[phone ringing]

BENNY: Yellow.

DAMIANO: Hi, Benny?

BENNY: Yes. This is he.

DAMIANO: Hi, this is Damiano on from Reply All. How you doing?

BENNY: Oh, just peachy. How are you?

DAMIANO: Good. Peachy, wow, that is good.

BENNY: Oh. Yeah.

DAMIANO: Where are you right now? [electronic dinging sound]

BENNY: I’m- I’m–

DAMIANO: Oh, you just won at Mario Party.

BENNY: No, I'm actually currently at work boxing up an order.

DAMIANO: Benny worked at Domino’s for a long time, he actually works at a different pizza place now. But he had two theories about what was going on with these Adam Pisces orders. And the first theory, it was just kind of wonderful. What he thought was going on was that the Domino’s ordering system was being tested by this like special elite squad of Domino’s employees called OER Pizza testers.

PJ: OER?

DAMIANO: Yeah, it stands for Operations Evaluation Report. Did you en–encounter that at your time at Domino’s?

PJ: I don't think so.

DAMIANO: So they are these people who work at Domino’s corporate and they like show up at a Domino’s randomly, unannounced to perform like this weird audit. So basically like they’re there and it’s like a pop quiz to make sure like everyone at that store is doing everything completely by the book.

BENNY: They come through and it's like a very stressful time. Like, I remember like the Domino's 15 miles away would be like, “Aw, we just got hit by OER, shit.” And we'd be like, “Oh no.” And we'd have to like clean up everything really quick. And it was, uh, it was always very odd.

DAMIANO: And the things that they care about like they can feel completely like random and arbitrary. Li, it’s like, is your shirt tucked in, is the like size of the bubble on that pizza to code.

ALEX: To code (laughs)?

DAMIANO: That’s like a literal thing.

ALEX: Really?!

DAMIANO: Yeah. And I talked to this woman Romana who was working at a store one time when OER showed up like completely unannounced as usual.

ROMANA: I was alone in the store with a 17-year-old making the pies. And like, I am a wake n baker so I was probably still toasting.

DAMIANO: Oh my god.

DAMIANO: And the OER guy walked into the kitchen.

ROMANA: And like he called me over and was like “How- what do–what do you think of this pizza?” And I was like, “Yeah, it looks good.” He’s like, “What do you think of the mushrooms?” And I was like, “They look good.”

He’s like, “Do you think there are enough mushrooms on this pizza?” And I was like, “I, yeah.” And he’s like, “Well, well they’re aren’t.”  And I was like, “I don’t- I don’t- I- I’m sorry- I didn’t–” I didn’t even make the pizza. Like, I don’t know why I was being like interrogated about the pizza. Um, he’s like “Were you going to deliver this pizza?” And I’m like “Yes, I’m the delivery driver, what’s going on?” He’s like, “Why don’t you go call this customer and let them know that their pizza didn’t have enough mushrooms on it and we’re going to make them another one.”  

PJ: That is such a–

ALEX: That’s not cool.

PJ: Wild misunderstanding of why anyone orders Domino's Pizza.

DAMIANO: It’s so crazy .

ROMANA: It was so weird and the guy took it so, so, so seriously. And we, we remade her pizza. But you know what that means? We ate her old pizza. It was fine.   

DAMIANO: So everyone is really used to OER just like showing up, having these sorta like weird and byzatine like rules about how everything’s supposed to go and been doing all these like tests and checking all of these things and it always feels like slightly arbitrary and mysterious (PJ: Yeah.) to people. And so Benny’s like, maybe it’s OER who’s sending these Adam Pisces orders. Like maybe they’re checking something, I don’t know exactly what they would be checking, but like maybe it’s them–

PJ: Oh, but like the $2 Coke pick-up is like some obscure test that their testing them on.

DAMIANO: Yeah, like who knows like is the fridgegerator cold enough? Like are you getting the Cokes out fast enough?

PJ: Right.

ALEX: And it fits perfectly with the weird arbitrariness of the tests that they already perform in, in the store.

DAMIANO: Right. Sometimes they will put orders in, they will do test orders, a lot of the time it’s like have–, put a pizza order in and then they–it’s a secret shopper putting a pizza order in and they’ll be like, “How fast is this pizza getting out the door?”

PJ: Mhm.

ALEX: Mhm.

DAMIANO: The thing that didn’t make sense to me about this theory is that like with the OER testers there’s always a point where they’re like, they’re like, “You did this thing wrong.”

PJ: Right. Nobody’s showing up and saying, “You just failed the sell somebody a Coke test.”

DAMIANO: Right, like, no one pops out of the closet to be like, “You did it wrong!”

ALEX: “Ha-ha!” (laughs)

DAMIANO: The idea of somebody testing the Domino’s system, somebody like inside of Domino’s testing system, that made a lot of sense to me. And Benny, he actually had an idea of a different person who’d be testing the system. One, like, a group of people who would actually make, make a lot more sense.

PJ: Who’s that?    

DAMIANO: So, his idea was that it might be franchise owners, people who have to keep tabs on like a bunch of different stores.  

BENNY: The guy who owned the one I, I worked at, he owned over a hundred Domino’s locations around the U.S.

DAMIANO: Oh.

BENNY: So, it could be something that that certain franchise owner is doing. I'd like to see what the store numbers are, like, how much revenue they're making for those days. Because, because if they aren't making enough, it could be Domino’s thinking, ”Oh, well, this store isn't making enough their online orders must not be pushing through there must be a problem.” (DAMIANO: Huh.) So they might force one to go through.

PJ: It’s like test email when you think your email’s down.

DAMIANO: Yeah, that's exactly how I was thinking–do you ever like get one of, have one of those days where like no one’s texting you back.

PJ: And you just text yourself texts.

DAMIANO: Yeah, you just like pathetically like, “Maybe my text messages don't work.”

PJ: I've never done that (DAMIANO laughs) but I could definitely imagine someone doing that (laughs).

[MUSIC]

DAMIANO: So Benny thought like Adam Pisces just has to be the name that some franchise owner somewhere has chosen to test like all of their different locations. And he got really excited about the idea of trying to figure out if this was true.

BENNY: Aw, I love this. This is crazy. Um, yeah, I’ll, I’ll reach out to some people and see what they know about the situation and see if they know anyone who knows anything about the situation.

DAMIANO: That's amazing. Thank you so much Benny.

BENNY: Oh, no problem man.

[MUSIC OUT]

DAMIANO: Alright Benny give us that good news.

[Ringing]

BENNY: Yellow.

DAMIANO: Benny, it’s Damiano.

BENNY: Hey, how’s it going?

DAMIANO: Good, man. How are you?

BENNY: Oh, just peachy, again.

DAMIANO: So we hung up the phone, what did you do?

BENNY: I immediately messaged some of my friends who still work at Domino’s, um, and had them look at LIVE and they saw all the stuff about Adam Pisces.

DAMIANO: Mhm–

BENNY: And so it was this kind of pandemic and then that was essentially all they could do. And so I had–I have another friend that I’m fairly close with and he was able to bring up revenue reports for those stores.

DAMIANO: Oh wow.

BENNY: Yeah. And we saw no correlation there.

DAMIANO: So no correlation, which means if it were the franchise owners who were behind the Adam Pisces orders Benny would have seen that like there would be a bunch of Adam Pisces orders at stores who were having like really bad sales days.

ALEX: Right.

DAMIANO: But that’s not what he saw, he saw that the Adam Pisces orders were all over the place. Sometimes they were at the stores that had really good sales that day and really bad days, like there was no pattern to it.

PJ: So, that kinda busts a little hole in the theory of like that it’s a what’s going- why are–test texts type of thing–

DAMIANO: Yes.

ALEX: And I mean the other thing is if they were doing some type of internal test, why would they use such a conspicuous name over and over and over again?

DAMIANO: I know. You think they’d use like Johnny Normalname.

PJ: Yeah.

DAMIANO: Yeah–

PJ: Johnny Normalname would be very slick.

DAMIANO: (laughs) So, Benny’s contact could not tell him what was going on with these orders, but Benny did not give up.   

BENNY: So I went higher up the flagpole. I knew one more guy who's in direct contact with everyone in the company, the CEO, the CFO, he knows–

DAMIANO: Oh wow. I had no idea that you had such high up Domino's contacts.

BENNY: Yeah–

DAMIANO: So, up until this point we had thought that all these orders were a test from within Domino’s. But according to Benny, his contact thought that actually, the orders were coming from outside of the company. From this seedy Domino’s underworld.

[MUSIC]

DAMIANO: He thought that the Adam Pisces orders were actually somebody testing stolen credit cards.

BENNY: So, he said, um, it was a credit card theft tactic that people would purchase a small purchase with the card to see if it was an actual card number and if it went through they would purchase other expensive items and gift cards online with the credit card. But Domino's was always the first–an easy first purchase because it would be completely anonymous because you could have that guest account.

PJ: Really?

DAMIANO: Yes. But the thing I don’t understand about this theory was that a lot of these Adam Pisces orders are to be paid in cash. They’re not credit card orders. So how could this be about credit cards if the orders are in cash?  

[MUSIC OUT]

PJ: Yeah.

DAMIANO: And Benny was like, here’s what's going on at the franchises I know about.

BENNY: When you order through Domino's, um, online you can order for pickup or, or delivery.

DAMIANO: Uh huh.

BENNY: And if your credit card gets declined, Domino’s still wants that order. So, they just switch it to cash–

DAMIANO: Ohhhhhhhhh!

BENNY: And so the, the card gets declined and it switches to cash–

DAMIANO: Oh my god! Okay–

BENNY: And that's how he knows that the card isn't going to work.

DAMIANO: And this theory made a lot of sense to me. Like when someone steals a credit card, they just want to see if the card works. And so a lot of the times, the first purchase they’ll make on that card is something cheap… like a Coke at Domino’s.

ALEX: Hmm.

DAMIANO: Um–

PJ: It’s funny that’s happened to me in the past like my card’s been stolen–

DAMIANO: Really–?

PJ: And it was like a hamburger at McDonald’s, a soda at CVS, uh, expensive laptop computer and I was just like, “Oh, they were hungry.”

DAMIANO: (laughs) Yeah, and I mean it also makes sense because it’s like those small purchases are less likely to be flag–flagged also by your credit card company.

PJ: Right.

DAMIANO: So, it’s like you can see if the card is working and like no one is going to be the wiser. And so it seemed completely possible that Adam Pisces was like this front for a group of–like a credit card hacker or a group of credit card hackers who had a bunch of different credit card numbers and they wanted to sort of like create a program that could test all of them.

PJ & ALEX: Got it.

DAMIANO:  And then I found this other group of thieves. Their entire scam is done using stolen credit cards and one of their main targets is Domino’s itself. And so it felt super plausible to me that maybe it was them behind these Adam Pisces orders. They’re called pizza plugs.

[MUSIC]

DAMIANO: Hey, this is Damiano from Reply All. How’re you doing man?

EDGAR: Good.

DAMIANO: Did you just wake up?

EDGAR: Yes.

DAMIANO: Cool. Did you have a late night?

EDGAR: Yeah, someone broke into my car.

DAMIANO: Oh, shit!

DAMIANO: This is a guy I’m going to call Edgar.

PJ: Uh huh.

DAMIANO: And I found him advertising himself online as a pizza plug.

A pizza plug is like a person online, often on like Twitter, and they’re advertising like um they’re advertising um that basically like if you order from them, you can get radically discounted Domino’s Pizza. Like, I think it, like, sometimes the deals are like for five dollars you can get four pizzas.

ALEX: How are they getting four pizzas for five bucks?

DAMIANO: So, basically what they’re doing is something called credential stuffing, something we’ve talked about on the show many times. Probably many Domino’s customers are reusing a password that has leaked in some data breach of some other company. And so, the hackers are using those bad passwords to get into the Domino’s accounts then they’re basically like ordering as many pizzas as they can on that account before the account gets flagged for fraud.

ALEX: Okay.

DAMIANO: And Edgar told me he got into like pizza plug a couple years ago.

EDGAR: I was playing uh Fortnite and I remember and I had saw on the news some kid got in trouble for ordering pizza plug and I went on Twitter and at the time that’s when pizza plug really like started to blow up. And I ordered it. And it came! You know, I had another friend that did it with me and after that we were just hooked on it.

DAMIANO: (laughs)

EDGAR: Yeah.

DAMIANO: But you saw–how did you learn about the method?

EDGAR: I think I, uh, started accusing people of it and then I said you know, “Show me a picture of your methods.”

DAMIANO: Uh huh.

EDGAR: So, the per- the–the pizza plug, they have this software it’s called Combos. It’s a weird like code to crack accounts and they, they’re stealing people’s Domino’s accounts and they’re using the credit card on the account and they’re ordering people food.

DAMIANO: The problem with ordering from a pizza plug is that what the pizza plug is doing is illegal. And so when you buy pizzas from them, they send your address to Domino's and say like, "Hey, deliver these illegal pizzas to this person." So, now Domino's has your address, uh, which doesn't always work out well. Wait [typing] watch this clip.

NEWS ANCHOR: All new at 5, this is a social media scheme you need to know about if you're looking for deals on pizza. You could be set up to take a huge fall.

NEWS REPORTER: A student at the University of Georgia didn't think twice when he saw a deal advertised on Twitter to get $52 worth of pizza for $10. Even if he was skeptical, there's plenty of rave reviews from real people who are satisfied customers across the country. They’re mostly young people just like 19-year-old Nick Thomas.

NICK THOMAS: I mean I thought he had employee discounts...

PJ: Nick Thomas, the chyron says, “Almost arrested.”

PJ & DAMIANO: (laugh).

REPORTER: But reality hit hard when undercover police showed up at his door dressed as pizza delivery drivers.

PJ: Woah!

NICK THOMAS: And then three police officers came up with tasers pointed at me from those steps, two more over there with tasers and guns pointed at me.

REPORTER: Students like Thomas...

DAMIANO: So yes it’s very risky for the people ordering from pizza plugs. And even if you don’t get arrested, you still have to trust this total stranger on the Internet who’s like promising that they’ll send you a cheap pizza if you send them money (ALEX: laughs) and um, and like all you have to really go on is a Twitter feed of a bunch of people being like, “sweet pizzas bro thank you for sending me pizza!” Edgar, the guy, found him advertising himself on Twitter as a pizza plug. His like Twitter feed is just like retweets of pictures of people being like, “Legend! #Pizzaplug.” And then like, four pizzas stacked on top of each other with a 20-ounce Squirt or something. And Edgar said that after a while of being a pizza plug he realized those reviews that he was retweeting of his like great service, there was no way for anyone to tell if they were real.

EDGAR: Alright, buddy. So I’m going to tell you. I am not a real pizza plug. I’m a scammer, I take people’s money.

DAMIANO: Ohhh! So, when you retweet all of those like those, those things on your Twit–

EDGAR: Yes.

DAMIANO: Are those fake?

EDGAR: They’re accounts that I make.

DAMIANO: Ohhh–!

EDGAR: Yes, accounts that I make.

DAMIANO: Got it.

EDGAR: So, it’s better to make your profiles look real. You know they’re fake if they don’t have any retweets.

DAMIANO: So, now that I knew about the pizza plugs and the credit card hackers my theory was that one of these groups was behind Adam Pisces. They were ordering Cokes just to make sure that the credit cards that they had gotten access to actually worked. And a Coke was the cheapest thing that they could actually order. So, I took this theory to a Domino’s employee that I knew just to run it by him. His name’s Blake.

DAMIANO: So the- the–the main theory right now, the one that seems to make the most sense is basically that like someone was using the Domino’s ordering portal to test stolen credit cards.

BLAKE: Really?

DAMIANO: Yeah. Basically like, if you put a credit card into the order form online, and the credit card bounces back.

BLAKE: Mhm.

DAMIANO: It will automatically turn the order to cash.

BLAKE: Um.

DAMIANO: Do you know what I’m saying?

BLAKE: Yeah, I gue–I guess I kinda get it. Uh, it’s just, so at my store, if a credit card bounced (DAMIANO: Mhm), we would have a label that would print out and tell us that it, (DAMIANO: Huh.) that credit card bounced.

DAMIANO: So what–

BLAKE: So it would say–

DAMIANO: Interesting.

BLAKE: Yeah, it would say, “Hey, confirm this, this purchase.”

DAMIANO: Oh!

BLAKE: Or something to that effect.

PJ: And when he sees those Adam Pisces orders, he’s not seeing that code?

DAMIANO: He’s never seen that code before. So he was like, that theory doesn’t make any sense to me.

PJ: Huh.

ALEX: Oh.

DAMIANO: And I was like, “Shit.”

ALEX & PJ: (laugh)

DAMIANO: That sounds like a really good point.

[MUSIC]

DAMIANO: After the break, I get some answers from the Magic Johnson of Domino’s.

BREAK

DAMIANO: Welcome back to the show. Up until this point, I talked to people who basically did like everything that you can do inside of a Domino's store, so like delivered pizzas, made pizzas, uh, managed the store. But what I was not able to do was talk to someone who was like high up at Domino’s now. I finally made some headway when I got into contact with this guy named Aaron Nilsson.

[MUSIC]

AARON NIELSON: Hello, this is Aaron.

DAMIANO: Hey Aaron, what’s up? It’s Damiano from Reply All.

AARON: Yeah, how you doing man?

DAMIANO: Good. How are you?

AARON: Good. Good.

DAMIANO: Aaron worked on the software team at Domino’s corporate for almost seven years.

DAMIANO: Basically, I just wanted to run by you like the, the thing we’ve been looking into.

AARON: Okay.

DAMIANO: And, I was like getting halfway through my spiel, that I’d done a hundred times about what was going on here, these weird orders from Adam Pisces.

DAMIANO: It was just for a 20-ounce. Coke, like a personal-sized Coke.

AARON: Uh huh. Yeah.

DAMIANO: And the name on the order–I feel like the way you just said, “Uh huh,” it’s like you already know what this is about.

AARON: I already have a sneaking suspicion.

DAMIANO: Yes.

AARON: Because I’ve ordered my fair share of 20-ounce Cokes during a certain time.

DAMIANO: Oh!

DAMIANO: In 2009, Domino’s hired Aaron to help them build their like big new fancy online ordering system. Domino’s had never ever done anything like this before. And Aaron, he said it was like this very like long and arduous process and then they finally like got up and running.

AARON: And when you, you know, you get those things set up, at the end, you have to test, does it work, right? From the development.

DAMIANO: By “does it work,” you mean like–

AARON: Does it place an order down to a store? And inevitably, if you’re testing all the time, you don’t want to test with like actual production food that they have to make, because then they’re just wasting stuff. The very classic pattern was: you test with a Coke.

[MUSIC]

AARON: Because it doesn’t cos–there’s no cost, there’s no food cost associated. They just, if no one picks it up, they just put it back in the cooler. There’s no- that’s why–that’s the hallmark of test order is, it’s a Coke.

[MUSIC]

DAMIANO: So is that software named Adam Pisces?

AARON: I don’t know who the heck Adam Pisces is. (DAMIANO laughs) It could be some–Adam Pisces could be totally a made up name. I’ll give you an example. Whenever I tested (DAMIANO: Uh huh.), I always used “Irving Johnson,” because I’m a big Michigan State and basketball fan.

DAMIANO: Oh okay.

AARON: So I knew my, my fake orders always came in under the name, “Irving Johnson.”

PJ: Like Magic Johnson?

DAMIANO: Yes.

ALEX: Mm.

DAMIANO: So Aaron’s theory is that whoever the software engineer that came after him was, they picked their own pseudonym, Adam Pisces, and they put it in like the testing software and whenever they ran it, some Domino’s in the country would get an order from Adam Pisces for a 20-ounce Coke.

PJ: Interesting.

DAMIANO: And so I was very happy to like finally, feel like have an answer. And then, uh, at ten o’clock last night, I got a text message from Aaron, that just said, “Hey. I got info. I’m really sorry to say, I was wrong.”

[MUSIC OUT]

PJ: Okay.

DAMIANO: So, uh we get on the phone with him this morning.

DAMIANO: And he’s acting very different than he had in the past. He was very tight lipped and choosing his words extremely carefully. He said he’d talked to people in his network and people who work at Domino’s and he’d been able to get information about what was happening with these orders.

AARON: Um, well, so here’s, here’s, um, what I found out. What I can say is that I still fully believe, and I talked to some other people, that it is a scripted in thing.

DAMIANO: Okay.

AARON: Um.

DAMIANO: So you–but wait, when you say scripted thing, you still think it’s like someone testing like the Domino’s system–  

AARON: Yes.

DAMIANO: With some script.

AARON: Yup–

DAMIANO: Some program.

AARON: But I- I don’t–I don’t know if it’s Domino’s, and um–

DAMIANO: You don’t know if it’s Domino’s–?

AARON: And, um, for obvi–for obvious reasons, I can’t tell you anything more.

[MUSIC]

DAMIANO: And can I ask, like do you think it’s the credit card thing?

AARON: I, no one told me anything in that, in that regard. Um, I- so- because–because no one told me anything in that regard, I’d, I’d guess no.

DAMIANO: You think that theory’s also wrong.

AARON: I think it’s, it’s probably, yeah, you’re right–but I don’t know. I don’t know. I just–at this point, it’s- it’s–to me, it’s a mystery. It’s kind of a mystery. It’s not really a mystery.

DAMIANO: Someone is testing something. The thing that they’re testing is top secret.

AARON: Um, or who–or who’s testing?

PJ: He’s not saying it’s necessarily an internal test. Like it’s not necessarily Domino’s testing their own system.

DAMIANO: Correct.

PJ: And he–that makes me think it’s not Domino’s testing its own system, if he’s suddenly saying, I can’t tell you if it’s (DAMIANO: Right.) Domino’s or not.

DAMIANO: Yes. That makes sense to me too.

PJ: But if it’s not Domino’s like who else would wanna test the Domino’s system?

DAMIANO: That’s my question.

PJ: Weird.

DAMIANO: And so I started to think…the only people who would want to test the Domino’s system besides Domino’s and who would be using this weird signature Adam Pisces had to be hackers. But maybe it was hackers doing it for some reason that I just hadn’t thought of yet. So I called an expert on hacking, we’ve had him on the show before. It’s, um, the guy who runs the website Have I Been Pwned, his name is Troy Hunt.

[Skype calling ring]

DAMIANO: Hello, Troy?

TROY HUNT: Yeah, hey, how’s it going?

DAMIANO: Good, how are you?

TROY: Good, man, very good.

DAMIANO: So I, I told Troy the story about the Adam Pisces thing, like I’d told many, many people before and it was really interesting just to see how differently he looked at it. Like he just started kinda inspecting it.   

TROY: And, and are they ordering online or by phone–?

DAMIANO: They’re ordering it online, yes, and they’re putting (TROY: Right. Okay.) the name Adam Pisces every time. It’s definitely through the online portal–

TROY: Alright, so they’ve got, they’ve got anonymity. They could be anywhere in the world.

DAMIANO: Exactly.

TROY: So that’s, that’s super strange. And what sort of rate are they doing this at,  how many orders a night?

DAMIANO: Um,well for each store it will be like once every couple of weeks, but like, over the totality it’s probably like hundreds, thousands, tens of thousands, all across the country, like in total–

TROY: Yes, so it’s not someone really trying to mess with the store oh one weird order a night it’s not like tying up resources or anything like that.

DAMIANO: No.

[MUSIC]

DAMIANO: And then Troy, he started to put together like all of these clues in a really interesting way. You guys know how like recently it feels like there's just been like all of these big hacks, like, like a couple years ago there was that big Target hack with all the credit card information. Around the same time I think there was another similar one from Home Depot.

PJ: Yeah, like companies that you're like, "Oh, I didn't even realize that they had my data."

DAMIANO: Yeah, so Troy, he started to wonder if one of these big hacks had actually happened to Domino's.

TROY: So I'm just checking on Have I Been Pwned because Domino's, it’s a massive global brand, they're online (DAMIANO: Mhm.) they're going to be the target of attacks.

DAMIANO: And sure enough, Troy found that in 2014 Domino’s was also hacked. The hackers got into the servers of a huge Domino’s franchisee, got a ton of customer’s personal information, and then actually held it ransom. So, they were like, “Domino’s if you do not pay us money, we will release all of this information–”

PJ: Woah.

DAMIANO: Yeah, Domino’s refused to pay them, and then they released it, like six months later.

ALEX: Hm.

DAMIANO: That hack in 2014 hack had actually been targeting this big franchisee in France And Belgium which had their like their own IT systems. What Troy thought was possible was that these Adam Pisces orders that they could be a prelude to a new, totally different attack that would be targeting Domino’s in the US.

PJ: How would this work?

DAMIANO: So, what he said is and at the beginning of the story, I would have never thought something this big as the most likely answer but what he said is that what the Adam Pisces orders might actually be doing is they might be checking to see if the Domino’s website has these like vulnerabilities, basically like testing locks. And what he thought that might look like in that case is that they would be checking for something called anti-automation.

ALEX: Ok.

DAMIANO: The way that a website is supposed to work, like when you go on and like fill a form on a website now, most of the time these days, like, there's like an anti-robot part where you have to fill in–

PJ: Oh–

ALEX: It says–

PJ: Pick like four pictures of a sign.

DAMIANO: Right. And–

ALEX: Mhm.

PJ: (whispers) So annoying.

DAMIANO: How many of these they stop on them?

PJ: Yeah.

ALEX: Weren't you telling me that you were like, I can never do this because I could never figure out which parts of this are actually the crosswalk (laughs).

PJ: I fail these tests constantly.

ALEX: (laughs)

DAMIANO: (laughs) Really?

PJ: Constantly. It's like I won't notice an edge of a sign or I won't notice a crosswalk or there’ll be like a tiny bus in the background. Like, I think a computer would pass more of these tests than I do. I've been locked out of my email so many times because I can't convince my computer that I'm not a robot.

PJ: Also, it's like, you're a robot!

DAMIANO & ALEX: (laugh)

PJ: Stop accusing me of being a robot!

DAMIANO: So–

PJ: Enough!

DAMIANO: Exactly. So looking at Adam Pisces, Troy thought maybe this is a little script that's running to test if on the Domino's website, there's any anti-automation software running.

TROY: Something like an ordering process really should have anti-automation on there because you could cause such an amount of havoc.

DAMIANO: Right–

TROY: I mean if you think about it, right, like this is just one Coke at a time and it's, it’s a frivolous kind of thing. But what if it was 10 pizzas and you were doing it 10 times a minute and you were doing it from different IP addresses and you were randomizing the user agent string and you were doing all these sorts of things to make each order legitimate enough in appearance that Domino's couldn't manually pick it up. And then they just started making all these pizzas.

PJ: So it's just like the robot tries to place a bunch of orders and–

ALEX: If they get blocked–

PJ: If they get blocked then they know that a human would have to do it.

ALEX: That's smart.

DAMIANO: Right. And if it is the case that the hackers behind Adam Pisces are just like going up to Domino's to like check the locks, like to make sure can we still get in here, Troy said, it's very likely that they'd be doing that in order to attempt a kind of hack, called a sequel injection.

ALEX: Okay.

DAMIANO: Here’s how sequel injection works. So, if you go to the Domino's website and you're like on the order page (PJ: Mhm.) and just click on like the pepperoni pizza, like a 12-inch pepperoni pizza, when you click on a 12-inch pepperoni pizza, it sends like a little request to Domino's being like just pull up the 12-inch pepperoni pizza, right–?

PJ: Mhm.

TROY: And if you look at the URL, you might see something like product equals pepperoni pizza and (DAMIANO: Mhm.) that literally has information in the URL.

DAMIANO: Right.

TROY: So someone comes along and they modify that URL such that it changes the query and instead of pulling back a pepperoni pizza, it pulls back a pepperoni pizza and everyone's passwords.

DAMIANO: (laughing) What? Wow!

[MUSIC]

DAMIANO: So, Troy can't say for sure. But with the information that he has he thinks that this is the most likely answer for what is going on here.

PJ: Hhm.

DAMIANO: And actually felt pretty satisfied by that. But actually what made me feel even more confident about this was that after weeks of back and forth with Domino's I finally got a comment from them. It was really interesting what they said. They told me that they've- are aware of Adam Pisces like actually very aware and they said that Adam has his orders have been coming in for two or three years and the security team has been actively monitoring them.

PJ: Which makes it sound like it lends credence to Troy's theory that this is serious.

Like it sounds like it matters to them.

DAMIANO: What I feel confident about at this point is that Adam Pisces is a threat to Domino’s a threat who’s like little shark fin has been circling them for years now and so while I don’t know who Adam Pisces is I do know that this story has like two possible endings.  

In one, Adam Pisces is completely screwed. Like the security team has squarely in their sights and it just like any day now.

Or Adam Pisces is obviously completely untouchable. I mean despite knowing about these tests on their system that have been happening for years, the security team has not been unable to stop them.

So, someday we’ll find out. We’ll find out. Either Adam Pisces is led away in handcuffs, or completely disappear off the face of the earth. Or Domino’s will be cracked wide open.

ALEX: I just keep thinking about Michael Myers from the Halloween series strangely. It's like every time you think you've stopped him- I imagine the security team being like, all right, we've got him we figured out a way to lock him out. And then like every time you think you've stopped him his head slightly like rises up. It appears in the window.

PJ: He's like, "hey, can I get a Coke for two dollars?"

ALEX & DAMIANO: (laughs)

[MUSIC]

ALEX: Reply All producer Damiano Marchetti.

CREDITS

Reply All is hosted by me PJ Vogt and Alex Goldman. We’re produced by Sruthi Pinnamaneni, Phia Bennin, Damiano Marchetti, Anna Foley, Jessica Yung, and Emmanuel Dzotsi. Our editor is Tim Howard. We’re mixed by Rick Kwan. Fact-checking by Michelle Harris. Our intern is Christina Ayele Djossa. Special thanks this week to Dan DeFellipi, François-Xavier Desmarais, Iain Paterson, Paul Price, Arman Rahman, and all the current and former Dominos employees who spoke with Damiano for this story.

Our theme song is by the mysterious Breakmaster Cylinder. Our ad music is by Build Buildings. Matt Lieber is drinking coffee on the front steps in the morning. You can listen to our show on Spotify or wherever you get your podcasts. Thanks for listening, we’ll see you in two weeks.