Money can be stolen from an Uber account

https://unlikekinds.com/t/your-money-can-be-stolen-from-your-uber-account

by unlikekinds • 9 years ago

277 166 9 years ago

thinkMOAR• 9 years ago

And it seems that the banks are aware of this. Two weeks ago only used a credit card for a bunch of uber trips in eastern parts of europe*. Maybe 8 - 10 rides, max 20 euro total charge... bank found the charges/refunds of uber suspicious enough to block my card as security measure (for already total mount of less then 20 euro)

42fortytwo• 9 years ago

Chargeback? I believe all CC companies offer that, and it's pretty effective?

bkor• 9 years ago

Shouldn't any normal consumer/customer protection law ensure that the full amount should be refunded? Meaning if due to no fault of your own X amount was charged / taken from your bank account, then that exact amount should be refunded. No matter if the currency changed or not.. as it was never your fault.

jwr• 9 years ago

I've gotten used to this. If you live in a non-$ country and purchase things in $, if you get a refund, you always get less than what you paid, because of the spread, and because of extra charges that banks impose for "currency conversion".

I think some people are unaware of this and think that just refunding the money to a customer means things are back to square one.

jonlucc• 9 years ago

This is certainly the case for credit cards, and in my experience, with checking accounts. The bank or processor will manage the investigation and go after whomever stole the money to recover their loss after reimbursing you.

Interestingly, I had someone steal my debit card several years ago, and they went to CVS or Walgreens (can't quite remember). They purchased Visa gift cards, and had video of the transaction in which my card was used to purchase a Visa gift card, so they should be able to have Visa provide the information about the stolen card or at least void it, but they will not. For some reason, Visa et al have decided that it's better for them to just eat the several hundred dollar cost of the card.

mahyarm• 9 years ago

It's probably the same kind of calculation as fix vs. buy new. If it costs you $50 to just buy a new one or $150 to hire a repairman, you'll just buy a new one.

dx034• 9 years ago

He could probably get it refunded by the bank/credit card company. It was fraud so there's no problem getting a full refund incl FX fees.

mikeash4• 9 years ago

Definitely. The merchant isn't always cooperative, though, so sometimes you have to go to your card issuer instead. It sounds like the author hasn't done that for some reason.

vxNsr• 9 years ago

In general in these cases, if it's a credit card just do a charge back and let Uber deal with the fallout. no need to bother trying to get Uber to make it right, your credit card company will be much more interested in knowing that Uber failed to safeguard their clients card info. To many charge backs can result in higher processing fees so companies will do everything they can do avoid that.

ceejayoz• 9 years ago

In this case, that'd likely work well.

Just be careful if you intend to keep using Uber - many companies (Steam is notorious for this - folks have lost access to thousands of dollars of games for contesting a single one) will ban you from the service if you do a chargeback.

Simulacra2• 9 years ago

This is why I don't buy Steam games. In fact, I don't buy any game I can't control an independent copy of.

JohnTHaller2• 9 years ago

It's also worth noting that if you do a chargeback, a company like Uber will often block your account and phone from using their services. Doing a chargeback against Steam for instance and they will ban you, preventing you from playing games you've paid for ("leased" more accurately). So, it's important to be careful about doing chargebacks unless you're sure the company you're doing a chargeback against is one you never wish to do business with again.

voidmain0001• 9 years ago

I've never issued a charge back so I'm in unknown waters, but if I wanted to keep my account with Steam after a charge back, couldn't I just update my account to use a different credit card?

idbehold• 9 years ago

It seems like this behavior should also be reported to the credit card companies. In the case of Steam, it seems like what you should do is have the credit card company charge back ALL the purchases you made if they ban your account.

mikeash4• 9 years ago

It's a real problem with Steam or any other place where your account is tied to stuff you want to keep. But with Uber, what would prevent you from just making a new account and carrying on?

JumpCrisscross2• 9 years ago

Difference between this and Steam appears to be Uber losing control of the account. That's how the purportedly fraudulent charges were made. With the Steam stories I've heard, the card was usually lost and then used on Steam or otherwise the account password was lost by the user.

redm• 9 years ago

I'm not surprised, Chargebacks are inordinately expensive for the company. The initial cost is usually over $25 regardless of the size of the charge. [1] I can go up from there. If they fight it, which they will likely loose because CC companies stick behind card holders, it will cost more.

To ensure they don't get more chargebacks, they have little choice but to block your account. Most companies will do whatever they can to avoid a chargeback. It's better to start there if you want to maintain a relationship.

[1] https://chargeback.com/chargeback-fees-processor-library/

nonamechicken• 9 years ago

I have heard similar stories about Sony's PlayStation store too. If you charge back, they ban your account. Now you cannot play online anymore. Even offline games may not work since the license is tied to your account.

benologist3• 9 years ago

Steam recently got fined for their deliberate, long-running, fraudulent, criminal behavior -

http://www.pcmag.com/news/350574/valve-fined-3m-in-australia...

They're estimated to have stolen from Australians 22,000 times out of ~25m population so you can imagine why they scrambled so hard to change their policies before justice was served in the EU or US.

paulgb• 9 years ago

Yes, I only skimmed the post so maybe I missed it but it struck me as odd that there was no mention of contacting the bank.

richardknop• 9 years ago

I often here about people using charge backs a lot. But I only have debit cards so for me once I spend money there is no recourse. I should get a credit card I guess.

creepydata3• 9 years ago

Credit card(s) are good to have unless they give you an impulse to spend. They have many other benefits too such as [depending on the card] purchase protection, price protection, free roadside assistance, extended warranty, rental car insurance, concierge service, cash back, points, miles, etc., etc., etc.

I've personally used price protection, roadside assistance, extended warranty, and concierge service. Plus many thousands of dollars worth of cash back, points, and miles (probably close to $10,000 total).

pmiller24• 9 years ago

You should check the terms of your debit card. My credit union offers $0 fraud liability on its debit cards.

OTOH, getting a credit card and paying the full balance every month is S good way to build your credit history and scores.

shkkmo• 9 years ago

Yep, I recently tried to cancel a refundable ticket I had bought through Avianca. Their only means of processing a refund is a crappy long web form that doesn't work properly and their support wouldn't do anything besides say "try again later" and refused to transfer me to a supervisor. So I called the credit card company and disputed ticket purchase with an explanation of exactly what happened. The credit card company's customer service was much more helpful and pleasant.

Chargebacks are super useful, but they aren't guaranteed and I try to avoid overusing them so that when you need them you know the credit card company will take you seriously.

drewmol2• 9 years ago

I feel the same. I recently used my cc companies customer service to get issued a chargeback for the first time (Amex). It was simple and painless and I was presently surprised. It was for a information lookup service that never delivered the login credentials, had a non working cancellation form, and an infinite hold support service phone number (clearly in effort to make it technically possible but incredibly difficult to cancel before recurring changes were billed). A soon as cc support contacted merchant on my behalf, they immediately issued a refund. Nice to know it's a PITA for the offending merchant, sucks it can be abused easily.

will_hughes• 9 years ago

Not all credit card companies are so forthcoming with handling chargebacks.

Mine, for instance, will let me lodge a dispute - however to do so, they cancel my card and re-issue a new one. This means in the N places where my card is in use, I now have to go and update it.

mstade• 9 years ago

And this is why you only ever use credit cards from reputable providers with a proven customer satisfaction track record. I had uber pulling all sorts of shenanigans against my Amex a few months ago, and instead of dealing with Uber's BS I just had Amex cancel the charges. Done. Zero risk to my personal accounts with actual real money on them.

Never use debit cards when credit cards are accepted, is my general tip.

isubkhankulov• 9 years ago

the main reason to used credit vs debit is the longer time window alloted to dispute charges. in some cases, debit cards only allow 48 hours.

jessriedel• 9 years ago

Or we could just move to a system where it was possible to pay for something electronically without giving a merchant the ability to charge arbitrary amounts into the indefinite future...

dllthomas• 9 years ago

One of these things is much easier to effect, as an individual.

JoshGlazebrook• 9 years ago

This is why I use http://privacy.com for some recurring services and one-off transactions. It pulls from your bank account via ACH a few days after a transaction but the ability to make one time use cards comes in handy.

jsudhams• 9 years ago

Use virtual card

johnbellone2• 9 years ago

I absolutely agree with you here. The only time I use my debit card is to get cash out of an ATM. And that's only because AmEx charges a fee for cash advance.

lr4444lr2• 9 years ago

Agreed. And I give an unsolicited thumbs-up to Capital One. My card has had fraudulent charges made against it multiple times (somewhere between 5 - 10 now), and they've always taken care of it with just one phone call where I get a capable human on the phone very fast to handle all of it, the entire charge reversed, no fees. They are prompt and professional about a replacement, which gets shipped express, they make helpful suggestions about recurring payment merchants I should probably reach out to based on my purchase history.

(No, I don't work for them or have any real love for banks, but credit where credit is due - pun intended.)

mikeash4• 9 years ago

Any credit card should be safe, at least in a reasonable country. In the US, for example, you have zero liability for fraudulent transactions that don't use your physical card, by law. A bad company might make things a bit more difficult, but you will get your money back.

Totally agree on debit cards. In theory they have similar protections, but the fact that they remove your money immediately can cause a lot of trouble.

tjoff• 9 years ago

Correction: this is why you never use debit or credit cards on the internet.

In a sane world it would be considered insane to use something as insecure. Frankly, they should be considered illegal.

I don't give my wallet to the guy I'm purchasing something from and let him extract the necessary funds - why should it be ok to do so on the internet?

That the banks reimburses me for invalid transactions is not a valid approach - that is directly funding criminals.

Generate one-time cards for every purchase, anything less ought to be considered negligence.

jamra2• 9 years ago

Citibank offers generated credit card numbers that can have a limit in money and time.

rachkovsky• 9 years ago

I had an opposite (BAD) experience with Amex. I switched my internet provider, called the old one and cancelled the service. They didn't give me any cancellation number, but kept charging me monthly via Amex. They were going out of business (no wonder), so they stopped picking up the phone and had PO Box for the address, but kept charging!

When I asked Amex to cancel or prevent further charges, they refused to do anything without a cancellation number, which I didn't have and couldn't get.

So, your mileage may vary.

wolfgang42• 9 years ago

I received an SMS saying “Enter Uber code 5483 to confirm your number”. Thinking someone entered their number incorrectly or similar, and assuming - as I had my phone with me - that my account was safe, I ignored the message.

This sounds like yet another example of why SMS is not a good second factor. The Uber rep's responses seem to ignore the question of how this account was compromised (instead providing suggestions for good password hygiene), so it's not clear to me whether they even think that the SMS PIN is supposed to provide any security at all.

accountyaccount• 9 years ago

Seems like it's possible that the user's phone number was hijacked? In that case SMS verification actually makes their account less secure because it can become a single point of failure.

phonon• 9 years ago

Wouldn't he know if his phone number was hijacked though? I found Uber's silence on how the 2FA was defeated the biggest issue here.

marcosdumay3• 9 years ago

This sounds like yet another example of why SMS is not a good second factor.

You know, that name is becoming customary, but this is not two factor authentication.

Two factor authentication requires that you successfully authenticate on both of two separated channels to gain access. That SMS crap companies keep doing require that you authenticate on any one of two channels to gain access.

i336_• 9 years ago

I think it's because I'm tired, but I'm not following.

I login to $app with my password. $app bounces me to SMS. I then go back to $app with the SMS code.

So I needed my password with $app and the code from the SMS.

Bartweiss5• 9 years ago

This actually seemed way worse than the monetary details. Uber offered TFA via SMS, and then apparently failed to require it. That's really bad, and sparks concern about all of their other security practices.

Assuming this is accurate, I guess it's time to assume there's an unexplained failure in Uber's security/login rules?

URSpider945• 9 years ago

I assume that the attacker did one of two things: either they were somehow cloning the SMS messages so they came to both the customer's phone and to them, or they jumped the gun on an SMS redirect they had set up and the first TFA got sent to the customer; they then retried later and got the message on their channel.

The logical fallacy in your answer is in assuming that, just because the customer got an SMS with a TFA code, an attacker did not get the same or subsequent code and use it. We don't know that.

Of course, it's also possible that Uber's TFA is broken ...

nix0n• 9 years ago

If I get an SMS like this one day, what can I do to stop someone from hijacking my account?

lnx01• 9 years ago

Immediately cancel /close/delete your Uber account. As in the linked article, Uber does not allow you to remove a payment method only change it to another card or to Paypal.

You could also immediately cancel/freeze your credit card until you've resolved the issue with your stolen Uber account.

naturalgradient• 9 years ago

I have noticed that with any type of money processing service (stock broker, bank, ..), whenever any irregularity happens, I end up losing money no matter whether I was at fault.

The asymmetry between me as a customer and a large organisation with a faceless customer service is just so big that complaints take too much effort to reach someone that could do something about it (if they were willing to own up to problems, which they usually are not).

Having the legal right to get any fee refunded and getting it are just so far removed that I would wager all money handling services make non-trivial amounts of profits from unjust fees because they can exploit this asymmetry.

Sadly, for me as an individual the right decision is almost always to let it go because my time is more expensive.

mi100hael• 9 years ago

The one company that hasn't totally sucked for me in this regard is AmEx. Every time I've called I've gotten a native English speaker located in the US who actually has the power to reverse charges within a matter of minutes.

phil213• 9 years ago

This used to be the case - until I talked to them last time. Definitely not a US-based CSR, and completely unwilling to help in a very frustrating situation I had done almost everything right on. I don't charge back often (first time on this card ever, after close to a decade) - so it's not like I have a flag on my account for "shitty customer" or anything.

Basically they utterly refused to chargeback, or even block future charges to a specific vendor that had been charging me monthly for a service I could not use due to moving. The vendor said their policy was I had to cancel in person, and refused to do anything else.

Amex absolutely did not have my back, and I have one of their higher-tier cards. Absolutely have been looking around at alternatives now though, after basically being told they'll let a vendor continue charging me against my will forever and there was nothing they would do about it. They said take the vendor to court.

I ended up canceling the card entirely and having it re-issued, since even changing the number on your card these days isn't enough to stop monthly recurring billing - of course that feature is for your "convenience".

All in all it was a pretty horrible experience that they resolved in the favor of a vendor that was quite obviously playing the "make cancelation super hard so we can collect monthly payments from people who continue to put it off" game - Amex literally could not have cared less one of their merchants was essentially engaging in barely-legal consumer fraud.

Utterly horrible customer service, and this was via many reps and a couple low-tier CSR managers. It's quite obvious to me why Chase and the like are eating steadily away at the once-stalwart Amex customer base. Prior to that experience I would not have remotely considered a different card due to them always being stellar whenever I needed them, and they usually went above and beyond any expectations I had for customer service. That trust built over the decades with me is now completely gone, and it's obvious they are simply yet another card issuer these days.

kingnothing• 9 years ago

Counterpoint: I haven't received a native English speaker in years from Amex. Chase, on the other hand, has always provided support in English and without the need to navigate a phone tree. I'll probably move most of my purchases to them once I spend my stockpile of Amex MR points.

mooman219• 9 years ago

I completely agree with you that this is the normal case and too many people really brush this off as business as usual. Just anecdotal, but Amazon actually has been extremely forthcoming with their service and has made right of every issue I've had with them.

caseysoftware3• 9 years ago

I suspect the argument here is simply "we refunded the exact amount we received!" and that they bear no responsibility for the foreign transaction fees, which were probably from the owners' bank.

It sucks but it makes sense for the merchant. The bank should return the fees but the exchange rate difference is likely lost.

Also another good reason not to use a debit card for any online transaction. At least with a credit card, no one can take your money while they're settling the dispute.

doughj3• 9 years ago

It sucks but it makes sense for the merchant.

It's the merchant fault the card was not protected, we shouldn't really be concerned with what makes sense for the merchant.

boredpudding• 9 years ago

The merchant can't 'return' things it never got. The fees are billed by the bank to the user. That's none of Uber's business, and (more importantly): Uber has no way to verify if the user had those fees, and if the users screenshots are correct.

As Uber said: They have no control of this. The user should go to their bank, because they provided the service of currency conversion.

thaumasiotes3• 9 years ago

That's not really how torts work. If I cause you a loss, your recovery from me is not limited to the amount I gained by so doing.

Compare, say, a suit for wrongful death. The principle you describe would in general cap damages at $0. Similarly, if Uber is responsible for stealing $430 from my bank account, that fact that they gave $20 of it away is not a reason for them to return only $410.

caseysoftware3• 9 years ago

Yes, but a "tort" is not a "refund."

Should they make the person whole? Absolutely.

Do they have to? Probably not based on their merchant/banking agreements.

tlb• 9 years ago

The fact that the charges were in a foreign currency isn't the author's fault. He wasn't traveling.

Currency exchange to RU is relatively stable, but you could imagine being scammed from a country with hyperinflation, where a refund 3 months later denominated in the local currency is worth much less. So in general, it's not adequate to be compensated for international fraud in the fraudster's currency.

caseysoftware3• 9 years ago

Yes, that's probably the exact scenario their merchant/banking agreements are protecting them from.

ajaimk• 9 years ago

Uber has no way of accounting for the exchange rate changes from their end. A charge back will fix the problem for the OP.

whalabi• 9 years ago

Surely uber could just look up the exchange rate

creepydata3• 9 years ago

I assume different card issuers/card processors will charge slightly different exchange rates and they will all have different FOREX fees and associated charges.

gambiting• 9 years ago

>Uber quickly agreed to refund the money. Problem is, the value of the currency had changed, so the money refunded was less than the money stolen: $406.70

I'd just like to point out that if the currency value changed the other way, he would be refunded more money.

I actually wondered where is that money technically going in this case. I rented a car abroad once, a block of 3000 Euro was put on my card, then when it was released I got less money back than it blocked originally since the currency rate has changed. So someone made money on just blocking that money for a few days, but who? The bank?

lucaspiller• 9 years ago

The rates are not set by your bank, but by your card issuer, e.g. VISA. However it's not the exchange rate differing, it's that they have different exchange rates for charges vs refunds.

When a currency exchange happens, say from EUR to USD, it has a different exchange rate from USD to EUR. When the retailer 'refunds' you, the transaction isn't just cancelled or reversed, you are credited the amount of the original charge (in the retailer's currency), so there is a different exchange rate.

For example, on the VISA Europe [0] site you can see the exchange rate for EUR to USD yesterday was 1 EUR = 1.11661 USD, but the other way around it is 1 EUR = 1.12399 USD.

[0] https://www.visaeurope.com/making-payments/exchange-rates

marcosdumay3• 9 years ago

This is not a normal commercial transaction. Since it only happened by negligence of Uber, there's nothing wrong in principle to make it asymmetric against them.

jefferson123• 9 years ago

Can someone shed light on how this sort of attack might have been carried out?

mkolodny2• 9 years ago

The title of this article isn't accurate. Personally I think it's just meant to scare people.

Money can't be "stolen" from your Uber account.

Someone can find out your password to your Uber account the same way they could get your password for any website. Then they log in as you, and take trips using your account. Your card would then be charged for the trips.

It's OP's fault that someone found out their password. Uber was nice and refunded them for the trips.

Bartweiss5• 9 years ago

Then they log in as you

Except the account in the article had two factor auth enabled. Someone triggered the second factor (a text message) then logged in without access to it. That's the question at the heart of "how did this attack happen?"

Procrastes2• 9 years ago

To offer one alternative explanation. It could be that the victim had some app on their phone which was logging SMS. The exploit may have involved sending the SMS code to the phone and forwarding it to the attacker. It's possible there was no exploit on Uber's side at all. We don't have enough information to know one way or the other.

camoby• 9 years ago

Indeed. I think the story here, isn't so much about the loss in transaction fees, but how an attacker in Russia ordered and paid for a user in Australia's account.

I notice the victim uses Android: Is it rooted? What other random stuff do they have installed? etc. etc. - because that will make a huge difference.

codedokode2• 9 years ago

There are many possible attack vectors. For example, password could be bruteforced by botnet, Android phone could be infected using some Linux kernel vulnerability, SMS could be intercepted because of vulnerabilities in cellular networks. And of course there could be vulnerabilities on Uber's side.

lr4444lr2• 9 years ago

Why would you fight Uber for these charges in the face of such obvious fraud? Just dispute them with your credit card.

Cakez0r• 9 years ago

So how did they get access to the account without the SMS pin? The question was never answered!

marvel_boy• 9 years ago

Newbie here. Any guess on how this account was compromised?

Procrastes2• 9 years ago

See my comment above, but it could be that there was a compromised app on the phone snagging SMS messages and forwarding them to the attacker.

datasage• 9 years ago

In my experience dealing with this, it depends on who initiates the refund.

If the consumer initiates the chargeback, it will be handled in the consumer's currency. Which will result in a fun reconciliation problem for the business.

If the company initiates it will be done in the currency it was originally charged in. Which will give the consumer more or less money depending on exchange rates.

morrow• 9 years ago

The exact same thing happened to Alex Blumberg in this episode of Reply All: https://gimletmedia.com/episode/91-the-russian-passenger/. They investigate and try to find out how his account could have possibly been hijacked with 2FA enabled.

benmmurphy• 9 years ago

does anyone know how they are breaking 2FA here? it doesn't sound like SS7 hijack because the message is still going to the correct handset and presumably if you are carrying out the SS7 hijack you wouldn't proxy the traffic. was/is uber allowing people to brute force pins? or are the PINs being leaked through whoever is doing bulk SMS messaging for them?

huac• 9 years ago

If the biggest cost was the foreign transaction fees, then the author should get a credit card without foreign transaction fees. Which seems like decent advice in general.

And to be fair to Uber, they don't have control over foreign transaction fees or changing forex rates. This just as well might have worked out in the author's favor. Uber could curry some goodwill by covering the forex losses and transaction fees in this case, especially since it came out to about $20, but God knows that that's not their MO.

lxe• 9 years ago

Ah yes, the "if you are not [blank], just be/do [blank]!" argument. Also, it's not the fees on transactions made by the attacker that the problem, it's ANY money withdrawn from the author's card resulting from the attacker's activity.

bradyat• 9 years ago

Anyone else notice that they gave the driver one star? I get that you don't like uber but it's hardly the drivers fault.

ViViDboarder• 9 years ago

Most likely, the driver is fake or complicit. The ride is just a way to "launder" the money out from Uber. Get access to an account, fake a long ride, get that money.

aidenn0• 9 years ago

Money can be stolen. From pretty much anywhere.

taormina• 9 years ago

I had this happen to me. Since I wasn't in Amsterdam, it was pretty clear that it was fraud of some sort. My credit card company handled everything and I canceled the card.

paul7986• 9 years ago

And Uber does not give a damn!

In 2015 my Uber account was hacked and 1k was taken from my bank account. Uber knew/knows about their users getting hacked and their PR was it's the users fault for using a bad password. Also then I tried to cancel my Uber account via their site but there is no option that lets the user do so only can be done by contacting/waiting for a support person to do so. It took them a few days to cancel my account.

Needless to say I loathe then for this reason followed by all their other horrid behavior!

mkolodny2• 9 years ago

I don't see how it's Uber's fault if someone finds out your password.

I think it's nice of Uber that they refunded OP's trips even though it wasn't their fault that OP's account was compromised. And it makes sense that they just suggested using a strong password. What else could they do?

Bartweiss5• 9 years ago

even though it wasn't their fault that OP's account was compromised

The article strongly suggests this isn't the case, though. OP had TFA active, but Uber allowed access to his account without without requiring the passcode they texted him. We don't know exactly what happened, because the support rep dodged the TFA question every time, but it doesn't appear to be a proper outcome.

deckar01• 9 years ago

They could fix the security vulnerability that allowed authentication of a new device without the 2nd factor of authentication.

nstj• 9 years ago

Interesting post, but the title is quite misleading - something closer would be “Someone can hijack your Uber account and charge you for their rides”.

The title gives the impression that your credit card can be used for transactions outside of Uber by attackers.

gkya• 9 years ago

Uber is like the Kardashians of the tech industry, every other news is a scandal. It's interesting to watch pure human vile turn a big success and a bigger potential into nil.

nate_robo• 9 years ago

The same thing happened to me last week. Noticed a number of Uber charges being hailed from Moscow, Russia which was brought to my attention by Chase's fraud prevention. They recognized the charges as suspicious and denied to let any of them through so I ended up not losing anything besides my debit card which I had to cancel. Changed my password and ordered a new debit card and everything is resolved. However, I was very surprised to see a hacking effort towards an Uber account versus something like an Amazon account...

stevenh• 9 years ago

Have any white hats ever audited Uber's ride management protocols? One would hope Uber would combine the ride request, GPS data, etc. from both the rider and driver apps to doubly ensure that the ride really was requested and took place, but now I sense the possibility that they cut corners on development, mostly ignoring data from the rider's app and instead forwarding it directly to a driver's account which has an undocumented God mode of sorts, allowing the driver's app to handle every step of ride management from one blindly trusted data source. If so, then everything could be forged from the driver's side if the protocol were ever to be reverse engineered, and maybe the bad guys finally figured this out.

URSpider945• 9 years ago

I have a friend who works for Uber. They care about this DEEPLY. In emerging countries, there are large-scale fraud rings that involve driving around with dozens of phones in a car that are automated to request and complete rides. The driver just toodles around town all day. The botnet operators collect large numbers of stolen cards and cycle them through the funnel.

If Uber can't find and plug the hole for fraud pathways before the criminals scale them, they will lose their shirts on chargebacks.

welly• 9 years ago

Uber customer support staff are certainly very understanding and sympathetic...

I'm so sorry to hear for any alarm this may have caused
I'm sorry to hear about such a frustrating experience
and I can totally understand your frustration here.
My pleasure to get this sorted out for you. I'm sorry to hear this wasn't the 5-star experience
I certainly understand your concern

Knock that shit off, please? We all know it's bullshit.

nullpage• 9 years ago

Perhaps this has some clues as to how the SMS code was intercepted:

https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...

cosinetau• 9 years ago

Not properly safeguarding data AND HR problems? Why do you still have an Uber account?

https://help.uber.com/h/24010fe7-7a67-4ee5-9938-c734000b144a

Money can be stolen from an Uber account

Related Stories