It was business as usual for an Uber driver who'd been picking up and dropping off riders in Los Angeles on a Wednesday afternoon in early June.
He'd just accepted a new trip in Beverly Hills and was driving to get the passenger when he got a strange phone call. It was from San Francisco's 415 area code. The caller, with a heavy Spanish-sounding accent, said he was from Uber.
"They tell me to pull over and cancel the trip," says the driver, 31, who asked us not to use his name. "They tell me I need to verify my account. They sound very professional and very poised and say things like, 'We really appreciate how good a job you're doing for Uber.'"
The caller told him the passenger requesting the trip was disabled, so Uber wanted to send an SUV instead to accommodate a large service animal.
That sounded reasonable to the driver, who'd been working for Uber for only two months. What he didn't know was that he'd just become the victim of an elaborate con job that drained all of the money from his account by week's end.
"When you're a new driver and you get a call like that, it's hard to put on your logic hat and say, 'I'm just going to guess you're a scam artist,'" the driver says. "But recounting the story now, it's very clear to me that that was a red flag."
Uber is no stranger to scams. Fraudsters have signed up as drivers to get fees on fake cancellations and cheated passengers with bogus discount rides offered on message boards and chat rooms. It's why Uber has started using machine-learning tools over the past year to weed out scammers. The company says it's spotted and stopped hundreds of these frauds.
But this scam is different. Its specific purpose is to fleece drivers. CNET spoke to three victims of this scam: one happened nine months ago, another three weeks ago and the third occurred last week. All three victims tell similar stories.
Apparently, the scam has hit thousands of ride-hail drivers, and millions of dollars have been diverted from their accounts, according to a lawsuit brought by the US Attorney's Office in New York's federal court last November.
An Uber spokeswoman says the company has worked with law enforcement officials to help track down and prosecute these scammers. She says Uber has also increased protections and security measures on drivers' accounts.
"Overall the effectiveness of these scams has dramatically reduced since last year as a result of additional fraud rules instituted by our security teams," she says.
But Harry Campbell, an LA-based driver who runs the popular Rideshare Guy blog, disagrees.
"The volume has increased on this, as opposed to decreased," he says, based on feedback he's heard from drivers. Also, based on that feedback, he says "Uber hasn't done anything to warn drivers."
The scam
On that Wednesday, the LA driver did what that caller told him to do.
He pulled over and canceled the trip.
The caller asked for his email. He gave it.
The caller asked for his Uber account password. He gave him that, too, after a brief hesitation.
Then the caller said to tell him the confirmation code he'd be receiving shortly via text. The driver told him the code once he got the text. This was the two-factor authentication needed to get into the driver's Uber account.
"Nothing happened for the rest of the week," the driver says. "I didn't think anything of this again until Saturday."
But in those following three days, the scammer had changed the driver's account settings and waited for the perfect time to withdraw money. Uber automatically transfers drivers' earnings to their bank accounts every Sunday. Some drivers cash out at the end of the day, while others just wait for Sunday.
"When these people were able to get into my account, they would've seen my transaction history," the driver says. "They could've looked at it and said, 'Oh this guy isn't going to cash out before Sunday.' They seemed pretty sophisticated. They seemed to understand how the system works."
By Saturday night, his $653.88 in earnings from that week had been nabbed from his account.
Former Uber driver Tatasi Lauofo tells a nearly identical story. When he was driving for the company in the Bay Area about nine months ago, he got a call from someone saying they were from Uber. The caller was polite and professional, he says. And, unaware of the scam, he gave them all of his account information. By the week's end, he was out nearly $1,000.
This fraud is simpler than it seems. And a couple of key elements about Uber make it possible.
When passengers hail a ride with Uber, they see the name of the driver and the car's make, model and license number, and they get an anonymized phone number to call the driver. All of this ensures passengers safely connect with the right driver. But it also makes it possible for the wrong people to see lots of information about drivers.
On top of that, riders' phone numbers are also anonymized, so that the caller ID drivers see has a 415 area code. That's the area code for Uber's headquarters.
So how did the scammer know the LA driver was picking up a passenger in Beverly Hills? Because he was the one who made the ride request. By doing that he was able to get the driver's name, call him and make up the story about the disabled passenger and large service animal.
"Drivers, in this case, are especially vulnerable. They don't realize these scammers are requesting rides as passengers," Campbell says. "These drivers aren't suckers -- it's quite a robust scam that's happening."
Uber says it started sending "phone prompts" and "periodic communications" to drivers to warn them about these scams. The three drivers we spoke to said they never received any communications about this from Uber. Uber also says it's done a lot to safeguard drivers' accounts.
"Accounts are protected by two-factor authentication as well as multiple security checkpoints when logging in or making account changes," the Uber spokeswoman says. This "protects against unauthorized access or changes by scammers."
But some con artists have found ways around these security measures, she adds.
"They've adopted these phishing techniques to trick drivers into making these changes on their behalf."
The aftermath
That Saturday night, the LA driver was home relaxing when he got an unexpected text from Uber about his earnings. He opened the app and saw that his weekly pay had been transferred to a debit card that wasn't his.
"I see the debit card number is not the four digits that I recognize," he says. "Automatically I realize this is what happened on Wednesday."
Besides the debit card number, the scammers also changed his phone number, email and bank account number, and locked him out of his account. He immediately called Uber and was told he had to wait until Monday when he could talk to a representative in person at one of its driver hubs.
"I just kinda stressed out and hoped they couldn't get any more personal information from my account," he says.
That Monday, an Uber rep at the hub helped the driver set things right. The rep said this scam had been popular in Los Angeles over the past few months and that he shouldn't have given the caller his information. He said Uber would never ask for account details. The driver said that since he was new to Uber and hadn't heard of the scam, he hadn't known what to do.
Finally, after some convincing, Uber agreed to credit the $653.88 back to his account as a "one-time repayment courtesy," according to an email seen by CNET.
Paul Valdez, another Los Angeles-based Uber driver, was fortunate enough to find out he'd been scammed before money was stolen from his account. As with the LA driver and Lauofo, Valdez gave the scammer all of his information during the call. But shortly after he hung up, he got a text from Uber saying it detected illegal activity on his account.
"Thank god I could access my password," Valdez says. "But Uber never really addressed the fraud thing. … If they did send that word out, drivers like me would be like, 'Oh shoot, who's this?' when we got that call."
Lyft drivers have also been victims of this con, says Campbell, although it seems Uber is the preferred target. Lyft says it's taken steps to thwart the scammers. Phone calls to Lyft drivers begin with a recorded message saying a passenger is calling, for instance, so that imposters can't claim to be calling from headquarters.
"As soon as we became aware of these attempts we worked to identify and prevent them in real time and took immediate action against the perpetrating users," a Lyft spokesman says. "We have communicated to drivers about these scams and steps they can take to best recognize them and protect themselves."
That's one thing the Uber drivers say they would appreciate, for sure.
"The drivers feel all alone out there," Campbell says. "There's always going to be scammers when there's a financial transaction, but Uber can do a lot more on this."
BY Dara Kerr June 28, 2018
Comments
Post a Comment