Earlier this month Angie Bird woke up at her home in London to discover she had been billed for a series of minicab journeys she had allegedly made the previous evening … in the Mexican cities of Guadalajara and Aguascalientes, more than 5,500 miles away.
While she was having dinner with friends, someone – or more than one person – in Mexico had apparently hacked into her Uber account and “went a bit crazy” ordering cabs at her expense. They made five journeys that were all charged to Bird’s credit card, and ordered a further 11 cabs that evening which, for whatever reason, they didn’t take.
The receipts for the journeys make for odd reading: in one case, in Guadalajara, someone took a cab driven by “Jose Antonio” to an address just 790 metres away, and then 50 minutes later they hailed an Uber cab driven by “Gustavo” to take them back to where they started.
Meanwhile, Londoner Franki Cookney was in Australia when she discovered she had been charged around $600 (£420) for three Uber cab rides in New York. Once she had got over the shock of being billed hundreds of dollars for journeys she hadn’t made, what struck her was that some looked like trips that no one in their right mind would make. One, costing $198 (£140), involved an epic 95-minute, 24-mile circuit of Manhattan island that ended up almost exactly where it started.
It has also emerged that it is possible to be billed for other people’s Uber trips even if you have never signed up for the on-demand ride-hailing service. That is what happened to Neil Gallagher, who last month found three unauthorised transactions relating to Uber on his credit card statement.
Bird, Cookney and Gallagher are certainly not the first people to be charged for Uber journeys they didn’t book or make, but what is alarming is that this problem appears to be ongoing. In May last year the Guardian reported that US authorities were looking into how British users of the service had been charged for “phantom trips”. A number of people had reported that their accounts had been hacked, including TV presenter Anthea Turner who tweeted to Uber: “Account has been hacked nothing to HELP me on website this is ridiculous”. The company said it had investigated and “found no evidence of a breach at Uber”, adding: “Anyone who is charged for a trip they didn’t book or take will get a refund.”
In April 2015 tech news website Motherboard reported that active Uber account details had been found for sale on the “dark web”, a collection of thousands of websites that use anonymity tools to hide their internet provider address to enable them to carry out criminal activity. Motherboard said it had found evidence of people selling “hacked” Uber accounts in quantities of 20 for $16.50, 50 for $32, or 100 for $54.
Bird, who works in IT and describes herself as an Uber fan, told Guardian Money how one evening earlier this month she took an Uber cab home, and then at 3am the next morning she received a couple of messages in Spanish which appeared to be saying “good evening” and asking where she was. When she checked in the morning she realised her account had been hacked.
She emailed Uber customer support but initially received no response other than an email telling her to reset her password. “I was even more surprised to find, when logging into my account, that I could not delete my credit card details from the app. And I had no way of shutting down my account. So I changed my password, making use of the ‘password reset email’, in the hope that nothing else would occur.”
Bird says it was several hours before she received a response from Uber, and then a little later that day an email arrived confirming she had been refunded the money for the Mexico trips, all of which were made on 6 April. There were two cab rides in Guadalajara and three in Aguascalientes, for which she was charged a total of 156 Mexican pesos. Because the cost of living in Mexico is relatively low, it is not a big bill once converted into sterling: about £6.30. “But that’s really not the point,” Bird points out. “They could have driven from one side of Mexico to the other!” She adds: “I do take cabs fairly regularly and I still want to use Uber, but I do feel insecure about the fact there is no one to talk to in the event of an emergency – there’s no number you can call.”
Cookney’s bill was a lot bigger, as her phantom trips involved some lengthy rides around Manhattan. The 32-year-old freelance journalist told Money: “I was travelling with my boyfriend and happened to check my email and saw three receipts from Uber. I hadn’t used the app in months – in fact, I’d deleted it from my phone to free up space, so when I saw these email notifications I immediately freaked out.
“They all detailed taxi rides in New York costing around $200 each. And because Uber sends you a map of your journey, I could see exactly where they’d travelled (see below).”
Cookney, who lives in north London, says her Uber account was connected to PayPal rather than her credit card, “so I quickly disconnected it, and it’s lucky I did, because later that day three more attempted journeys popped up on my account but were cancelled, presumably due to the lack of payment method. I contacted Uber and, to be fair, it refunded me straightaway.”
Meanwhile Gallagher, who lives in Warwickshire, contacted Money last month to say he had spotted three unauthorised payments on his credit card statement to “Uber bv” – for £10.80, £21.59 and £43.86. “I have never used Uber, never had the app on my tablet or phone, and never had an account,” he says.
Gallagher cancelled his card immediately and told Money this week that he had been compensated for the phantom trips by his bank, Smile/Co-op Bank. But he adds: “I’ve not found out where the journeys were made or anything else about the matter.”
Uber says that when this sort of thing happens, users are refunded straightaway. It also says it doesn’t store anyone’s credit card details – this is run through a third party – and that it is impossible to obtain these from the app. The company reckons the problem is that some people are using the same log-in details across different websites.
It said in a statement: “While there has been no breach of Uber’s systems, we would like to remind our users to always use unique passwords for different online accounts. As has been highlighted before, when people use the same password on more than one site, and one of those accounts is compromised, then anywhere else with the same log-in details can also be accessed.
“It is not possible for anybody who logs into an Uber account to access credit card details, and we have already made significant changes to reduce the ability for criminals to take trips on compromised accounts. We are always enhancing the ways we protect users.” A spokesman confirms there is no customer services phone number, “but you can request a call-back”.
So who exactly are these scammers who are taking some Uber customers for a ride? The suggestion is that they are typically young, tech-savvy individuals keen to show off to their friends by booking a nice car and taking a ride around town at someone else’s expense – which might explain the nature of some of the journeys. But others would say that the answer is more simple: they are criminals, and this is fraud.
Comments (…)
Sign in or create your Guardian account to join the discussion