Menu
Lyft customers face potential hack from recycled phone numbers

Lyft customers face potential hack from recycled phone numbers

The problem involves Lyft's use of cell phone numbers to verify customers' identities

Giving up an old cell phone number for a new one may seem harmless. But for Lyft customers, it can potentially expose their accounts to complete strangers.

That's what happened to Lara Miller, a media relations specialist living in California. Earlier this month, she discovered two credit card charges made in Las Vegas, over 400 miles away.

"I thought it was legit fraud on my debit card," Miller said.  

But in reality, another woman had accidentally taken over her old Lyft account. It happened because the phone company had recycled the cell phone number Miller had canceled back in April -- opening the door to the hack.

The problem involves Lyft's login process. The ride-hailing app does away with the hassle of usernames and passwords, and instead signs up customers with their smartphone's cell number.

That phone number, however, can remain tied to the account, even if it changes subscribers. Miller eventually realized this and called Elysia, the woman who now owns her old cell phone number.

Elysia declined to have her last name published. But she too also realized that something was off with the Lyft account she thought was hers.

161024 lyft Martyn Williams

"I got this new number around the fourth of July," Elysia said. "So I was already getting so many text messages meant for her (Miller) from old friends. From Airbnb."

When Elysia signed up for Lyft, she also saw that a pre-existing payment card had been stored into the account. "The app wouldn't let me change the profile," she said. "There was no way to make a new account. They didn't have the option there."

Elysia tried to substitute her own credit card on the account. However, when she was in Las Vegas, she took two rides with Lyft, both of which still charged Miller's payment card.

Miller and Elysia said they find the whole case disturbing. "Now I hope no one is using my old Lyft account from my old phone number," Elysia said.   

However, Lyft said problems like this are rare. The company relies on a "variety of signals" including third-party sources, the Lyft account and the device to verify the user's identity.

"In cases where it appears the user may not be the same, we ask them to verify their identity or to create a new account," Lyft said. "In rare cases this process doesn’t work as intended, and we use those learnings to improve our algorithms going forward."

Nevertheless, other publications have also reported on the problem. Users on Hacker News have also complained.

"So there's a creepy guy taking Lyft rides in San Francisco with my account," wrote one user over a year ago. "The best part is that I can't remove the credit card from that account because I no longer have that phone number."

Lyft, however, has said that users can cancel accounts by contacting its customer support.

To prevent the problem, companies should offer customers stronger forms of two-factor authentication, and not merely rely on a phone number to confirm a user's identity, said Edward Amoroso, former chief security officer of AT&T and CEO of security consultancy TAG Cyber. .

"Unfortunately, however, the industry will probably not shift to improved validation methods unless users decide that they will no longer accept this kind of risk," he said.

Miller is concerned the ride-hailing app hasn't done more to fix this problem. Although Lyft has offered an apology, the company still hasn't refunded the charges from her bank account.

"I'm just annoyed and I want more people to know about this," she said. "I think it's a pretty big flaw in their security."

Although Lyft has suspended Miller's old account, that's left Elysia with no access to the ride-hailing service. 

"Now I can't even log on to Lyft," Elysia said. 


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments