Slashdot Mirror
Thousands of Uber Drivers Scammed Out of Millions of Dollars (cnet.com)
CNET reports on what happened when a new Uber driver received a call from Uber telling him to cancel the trip and verify his account:
The caller asked for his email. He gave it. The caller asked for his Uber account password. He gave him that, too, after a brief hesitation. Then the caller said to tell him the confirmation code he'd be receiving shortly via text. The driver told him the code once he got the text. This was the two-factor authentication needed to get into the driver's Uber account. "Nothing happened for the rest of the week," the driver says. "I didn't think anything of this again until Saturday." But in those following three days, the scammer had changed the driver's account settings and waited for the perfect time to withdraw money.... By Saturday night, his $653.88 in earnings from that week had been nabbed from his account...
Apparently the scam has hit thousands of ride-hail drivers, and millions of dollars have been diverted from their accounts, according to a lawsuit brought by the U.S. Attorney's Office in New York's federal court last November... [A] couple of key elements about Uber make it possible. When passengers hail a ride with Uber, they see the name of the driver and the car's make, model and license number, and they get an anonymized phone number to call the driver. All of this ensures passengers safely connect with the right driver. But it also makes it possible for the wrong people to see lots of information about drivers.
When one of the scam victims complained to Uber, he "was told he had to wait until Monday when he could talk to a representative in person at one of its driver hubs," although eventually Uber "agreed to credit the $653.88 back to his account as a 'one-time repayment courtesy.'"
Other scammers have gone after Uber directly, CNET reports, using GPS-spoofing apps to simulate long rides as "a way to pocket money via stolen credit cards, essentially using Uber as a makeshift money laundering service." Uber's data science manager spotted the fake rides because "weird" altitude coordinates indicated that the drivers were flying through the sky.
Apparently the scam has hit thousands of ride-hail drivers, and millions of dollars have been diverted from their accounts, according to a lawsuit brought by the U.S. Attorney's Office in New York's federal court last November... [A] couple of key elements about Uber make it possible. When passengers hail a ride with Uber, they see the name of the driver and the car's make, model and license number, and they get an anonymized phone number to call the driver. All of this ensures passengers safely connect with the right driver. But it also makes it possible for the wrong people to see lots of information about drivers.
When one of the scam victims complained to Uber, he "was told he had to wait until Monday when he could talk to a representative in person at one of its driver hubs," although eventually Uber "agreed to credit the $653.88 back to his account as a 'one-time repayment courtesy.'"
Other scammers have gone after Uber directly, CNET reports, using GPS-spoofing apps to simulate long rides as "a way to pocket money via stolen credit cards, essentially using Uber as a makeshift money laundering service." Uber's data science manager spotted the fake rides because "weird" altitude coordinates indicated that the drivers were flying through the sky.
You'd have to be a moron to be an uber driver so this seems to match up well
Some Uber drivers aren't particularly bright.
#DeleteChrome
It's all good in creating a society where everyone is out for themselves. From corporations to individuals one survives by figuratively eating each other.
...Really Should Burn
PHB: "So let's claim we invented the flying car!"
Table-ized A.I.
Requiem for the American Dream
..."weird" altitude coordinates indicated that the drivers were flying through the sky.
No, those are just the pedestrians they've been hitting.
... a fairy tale starts, "Once upon a time ..." and a sea story starts, "Hey, this ain't no shit:"
Hey, this ain't no shit: I was at the hangar at NAS Quonset Point, RI, working on an antisubmarine computer that lived on a P3 Orion and the goddam thing was nuts.
In self-test mode, it was tracking a sub at 3 feet above the surface going 60 knots.
HAhahaHAHahA
Seriously, folks; it's OK to mode me down but that memory (which was a hand-woven ferrite core, 64 bytes not Kb) is a hoot.
It little behooves the best of us to comment on the rest of us.
Some Uber drivers aren't particularly bright.
So... just to be clear, you're saying it's the victim's fault, and Uber shouldn't take a look at their security practices and maybe change things to prevent this in the future.
It's the victim's fault - right?
Uber needs to fix their shit security on their 2FA system.
Someone tried to get into my Uber account. I kept getting 2FA codes texted to my phone. I went to log into my account and check up on it and it sent me *the exact same 2FA code*. If I had entered that code and continued I have a feeling it would have also let in whoever was trying to get in at the same time.
I ended up having to wait a while until Uber flipped to a new 2FA code then logged in and changed my login info. Since I never really use Uber I tried to remove my only payment method on file--Paypal. It won't let you. Your uber account isn't allowed to exist without a payment method. So I went into Paypal and de-authorized Uber.
Uber really needs to fix this. A 2FA code should be 100% unique to that browser session and IP. It shouldn't be getting re-used.
Anyone can be a victim of a scammer and we really should not be creating systems that people either of modest training, intellect, or experience can't operate safely. Uber hires drivers not people savvy on internet safety. The internet safety should be baked in. It should be that the whole point of working for uber is that they are taking care of that kind of shit and you just drive and get paid.
Now as for scammers. I don't really like any robbers. They do something that makes you feel violated and foolish and unsafe afterwards. They can do also sorts of other damage when they rob someone who can't afford it. But at least breaking and Entering takes some skin in the game. And a larger crossection of people can evaluate the safety of their own physical possession protections more than they can their on-line possessions. In addition we have things like Neighbors and villages that also put a layer of safety into protection against theives.
Online scammers therefore are special. They are anonymous and so remote that police forces can't handle them. And interstate and international police forces can't be bothered with thousand dollar scale crimes with no real leads to follow.
These people will rob anyone because they don't really know who they are robbing. The last scammer that I encountered on-line I made up a story about just getting out of prison and needing to sell something so I could buy my kid a present and hope he wouldn't hate me for being in prison while he was growing up. The guy went right ahead pressuring me to send him the Money Order.
I wish there was a vigilante network that could give people like that the punishment they deserve. They are parasites.
Morons=/, readers who claim they were better than these guys. You morons are obviously better educated and paid and would not wanna be Uber drivers, so why the fuck take it out on those poor guys ?? Get a life already.
This is sheer human stupidity on a whole new level.
The caller asked for his email. He gave it. The caller asked for his Uber account password. He gave him that, too, after a brief hesitation. Then the caller said to tell him the confirmation code he'd be receiving shortly via text. The driver told him the code once he got the text.
Who does all that? THOUSANDS of these drivers are this stupid? Wow. I never knew.
Scammers should have went for the driver's bank info instead, sounds like these drivers will give anyone on the phone anything they ask for. Without question.
Comment removed based on user account deletion
make poor decisions. Given what Uber pays (I've heard it called a Payday Loan on the value of your car) most of their drivers are already under stress.
The reason you don't blame victims is that most of them aren't in a position to defend themselves. We have a phrase for it even: kick 'em when they're down.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
when we have stuff like this in America? Seriously, If I didn't know for a fact that that link is real and that somebody in a position of power made an argument against teaching critical thinking I'd have chalked it up to Poe's law.
What I'm saying is our education system and our society's values (at least in regards to critical thinking skills) failed these people. These aren't like climate change deniers for flat earthers or some such. They aren't choosing to be ignorant and dumb. They were either born that way or made that way.
The correct response isn't to laugh at them, it's to take pity and try to lift them out of their ignorance. Hell, you should do that even if it wasn't the right thing to do. These guys are dumb, yeah, but if you can talk them into giving up their Uber passwords imagine what a demagogue can talk them into. Where do you think dictatorships come from?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
It is about taking responsibility for your mistakes and learning from it. If they never get blamed for it and always have people defending them and blaming others then they will NEVER learn from their mistakes. It isn't kicking someone while they're down when you are pointing out what they did wrong, NOT telling them is kicking them while they are down as they are destined to do it all again.
Did Uber tell their employees what the procedure is when a trip is canceled? Most companies I've worked for explain procedures you need to know.
If someone cold calls, you take down their info, look up the number for their company, and call them back.
If you don't then I guess you just don't give a fuck (about your money).
The reason you don't blame victims is that most of them aren't in a position to defend themselves.
But in this case, to "defend themselves" is as easy as not telling a stranger over the phone every single piece of their login credentials.
If he doesn't learn from this, he'll lose tens of thousands of dollars when he encounters his first Nigerian prince.
I guess these people are not fit for the online business.
Hi, I'm from technical support. I'm verifying passwords, can you tell me yours? Dumbass.
Chewbacon
The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
OTP here means one-time password.
"The caller asked for his email. He gave it. The caller asked for his Uber account password. He gave him that, too, after a brief hesitation. Then the caller said to tell him the confirmation code he'd be receiving shortly via text."
Should have tried for his banking details as well and this fucking retard would have supplied those too.