MIAMI – James Carvalho said he was in a rush on Monday to get to the Miami International Airport to catch a flight for a business trip. He was waiting for an Uber driver when he received a text message that appeared to come from the sharing service.
Carvalho said he assumed it was a new Uber security feature and entered his code. It was a trick and the hackers took over his account. The Uber driver never arrived and they stole $200.
“I always said I would never fall for it, and you know, of course, I’m running last minute to the airport, I’m trying to get there, I just want the car to get there,” Carvalho said.
At first, the driver who accepted his trip sent him a message asking for his phone number. He didn’t think much of it and disclosed it because finding his high-rise building on Biscayne Boulevard can be challenging. He received a text message with a 4-digit security code that appeared to be from Uber and another message from the driver through the app.
“There’s a message saying ‘I need your security code, your 4-digit code.’ Thinking Uber installed a new security feature, I sent them the 4-digit code,” Carvalho said.
He also received another code via e-mail and he passed that along as well, but that was when he knew something fishy was happening.
“I couldn’t believe I fell for it, I knew something was up. Went to try to open the Uber app, couldn’t get anything,” Carvalho said.
The scammer had already changed his password and the e-mail address on the account and used a two-factor authentication, so Carvalho was totally locked out of his account.
The scammer used Carvalho’s American Express to give the driver a $200 tip on what was supposed to be a $6 ride — that Carvalho didn’t even get. By Tuesday, Uber had refunded his money, but Carvalho wanted Uber to do more. He also wants all Uber users to be aware of the risks and take precautions to protect themselves.
“You see the ride, it says it’s 5 minutes away, but you know it’s 10 and I just wanted the ride to get there, so I just didn’t think it through.”
It remains unclear if the driver was the scammer or if the driver’s account was also compromised and the scammer was a third person. Uber said the incident is still under investigation.
Tips to avoid becoming a victim
- Use the app’s two-factor authentication
- Don’t share your passwords or verification codes
- Uber will never call or text users asking them to provide personal information
- Only speak to drivers through the app; don’t give your phone number or email