Has anyone wire-analyzed the McDonalds app? It seems likely they're trusting the app to provide "customer ID" and people are just using a mitmproxy to hack in random customer IDs, based on classical failures in this space. (I haven't been to a McDonalds in years, nor am I in Canada, so this isn't something I can analyze.)