Caller ID spoofing is easy and you can't rely on your phone to tell you who a call or message is from. This scam is a great example of things that can help you spot a scam, and the things that you might hope would help you, but actually work against you. Plausible-looking credit card numbers are easy to generate, so we fed the scammers some fake details and continued on. Which means Uber already has our credit card details and there is no reason for us to tell them again. And remember that the scammers contacted us pretending to be Uber and we "fell" for their scam because we are Uber users. It goes without saying that this isn't how you verify your identity. The scammers are presumably hoping that we will simply respond to the cues on the page-the familiar title "Billing details" and the the usual set of credit card input fields-and won't think about how we got here. Now we are being asked for "billing details" and there is no mention of verifying our identity. This, presumably, is the whole point of the scam.Īt this stage it's worth recalling that the scammers originally told us we needed to change our password, and later changed the story, telling us we needed to verify our identity. Page four of the scam site asked us for both our credit card details and our bank account details. It isn't broken, it's just window dressing that was never designed to work. The "Or connect using a social account" link looks convincing but it's fake.We entered a temporary SMS number instead of our real number, but it also worked without one, because the scammers don't actually care about capturing your phone number.It looks good but under the hood the scammers have done as little work as possible: A useful reminder that the padlock tells us our connection to the site is secure, but says nothing whatsoever about how secure or trustworthy a site is. The scam site had borrowed enough Uber branding to look convincing, and like all good scam sites it had a valid security certificate and a padlock icon. There's nothing wrong with hosting websites in Russia, but it isn't where Uber keeps its websites.Ĭonfident that we were looking at a scam, we created some fake personal details, fired up a Tor browser and jumped into the rabbit hole. Most company's domain names have been around a while, so a very recent creation date is a big red flag.Īnother quick check revealed that this absolutely brand new website was hosted in Russia. We looked it up and discovered the domain name had only been created today.īecause scam sites get shut down very quickly, scammers get through a lot of "burner" website names that live and die within days. Although it contained the word "uber" it wasn't the official Uber domain name,. We noticed that the message was a scam because the domain name (the part of the address that ends in. The fake alert appears alongside real security messages from Uber.
0 kommentar(er)
