Scams that target Uber and Lyft drivers: how they work and what the companies say

Scammers often call and text drivers in the name of Uber or Lyft. They have one goal: to get into your account and take the money you earned. This page explains how these schemes work and what Uber, Lyft and US government agencies say about them, including about the case when the scam has already happened.

This is general information we found in official sources, not legal advice.

In short

The FTC says anyone who asks for an account verification code is a scammer. That includes someone who claims to be “support” or a “rider.”
Uber says it will never call, text or email to ask for a password, a verification code or banking details.
Lyft says it won’t contact you to ask for personal info unless you reach out to Lyft first.
Lyft’s advice for a suspicious phone call is to hang up right away. Uber says that when in doubt, you can reach its team directly through the Driver app or at help.uber.com.
The FCC says the number and name that show up on the screen can be faked.

What it looks like in real life

One driver described this case in a group. It is the driver’s own account, and we have not checked it.

A ride request came in. The driver went to the address, but the rider did not show up.
A little later, a call came from an unknown number. The caller said he was calling from Uber support, that the rider had filed a complaint and that the driver’s costs would be paid back.
Then he asked the driver to read out a code that had just arrived by SMS.
The driver understood it was a scam and hung up.

This scheme works because everything looks real: the ride request was real, and the caller may even know your name and the trip details.

Why they want the code

A verification code proves to the app that it is really you signing in to the account. The Federal Trade Commission (FTC) says that sharing a code makes it easier for a scammer to pretend to be you. Once the scammer is “you,” they have access to your accounts and can take your money.

Lyft says scammers use this kind of information to log into your account, pretend to be you and even steal your earnings. Uber lists cashing out to questionable cards among the risks.

The FTC warns against sharing a verification code with someone you did not contact first: a scammer with the code gets into accounts, poses as the account owner and takes the money. The FTC says anyone who asks for an account verification code is a scammer. Uber says it never asks for a password, a verification code or banking details by phone, text or email.

Common schemes

1. A call or text from “support.” Uber says phishing can be an unexpected call or text from someone who falsely claims to be Uber Support and asks for account information. Uber says scammers use refined techniques to sound like a real Uber employee.

2. A “bonus” or “credit” in return for your details. Uber warns drivers about messages that offer Uber credits in return for personal details. In Lyft’s example, a text message sends users to a fake website where their account information is stolen.

3. A link to a fake page. An email or text contains a link to a page that looks like an Uber or Lyft page but is not.

Uber says “uber.com” should show in the web address before anyone enters an Uber password. The part that matters is the part of the address from https:// to the first “/”.
Uber says it should be one of these: www.uber.com, login.uber.com, help.uber.com or auth.uber.com.
Lyft says the address should start with https:// and contain .lyft.com. What matters is that this part of the address ends in .lyft.com. For example, help.lyft.com.verify-login.net is fake.
One Lyft page says Lyft emails come only from these addresses: @lyft.com, @lyft-new.zendesk.com, @marketing.lyftmail.com, @business.lyftmail.com, @lyftmail.com and lyft@points-mail.com. A second Lyft page has a shorter list. Even a correct address does not mean an email is real. Lyft advises drivers not to open links in emails or download attachments.

4. A gift card or someone else’s card. Uber warns drivers about requests to add a gas gift card to their account. That is a way to move the driver’s earnings somewhere else. Uber also tells drivers never to add someone else’s credit or debit card to their account.

5. “Let me use your phone.” Uber says passengers should never handle or use the driver’s device during a trip.

6. A “free tablet” or a “refund.” The FTC describes a scheme aimed at delivery drivers. The scammer pretends to be support for a delivery service. In one version, the scammer promises a free tablet and asks the driver to “verify” a phone number, email, Social Security number and bank account. In another, the scammer says there is a problem with an order, or wants to refund money from a canceled order, and asks for an email or bank account. Then comes the request for a verification code.

7. A text about an unpaid toll. The FTC says a text about an unpaid toll is probably a scam. The link leads to a page that asks for card or bank details. The FTC’s advice is not to click links in unexpected texts and not to reply to them. To check for a debt, the FTC names a phone number or website of the toll agency that you know is real. More about E-ZPass: E-ZPass in New York.

8. “Move your money to keep it safe.” The FTC describes a scheme where a scammer pretends to be your bank, says there is a problem with the account and tells you step by step how to move money to a “new account.” That account belongs to the scammer. The FTC says your bank will never contact you to tell you to move money or to ask for personal information or passcodes.

9. Renting out or “sharing” an account. Someone offers to work under your account, or to rent you theirs. Uber says it does not allow sharing or renting an account. If someone reports this, Uber may block and remove the account. Lyft lists account sharing as one of the reasons for deactivation (removal of the account).

10. A fake QR code. The FTC says scammers cover real QR codes on parking meters with their own, or send QR codes by text and email. Such a code leads to a fake page. The FTC advises people not to scan a QR code in a text or email they were not expecting.

11. A “tax” text. The FTC says the real IRS and state tax agencies do not contact people by text, email or social media to get information. The FTC advises people not to click links in such texts.

Why the number on the screen cannot be trusted

The Federal Communications Commission (FCC) says a caller can deliberately fake the information that shows up on your caller ID screen. This is called spoofing. Scammers often fake the number of a company or government agency that you already know and trust.

The FCC’s advice: if someone says they are calling from a company, hang up and call the number on the company’s website or on your account statement.

This advice is about banks and other companies. Uber says its team can be reached through the Driver app or at help.uber.com. Lyft asks drivers to report suspicious contact through “Contact Support” on its help page. The FTC says scammers buy ads in search results, so a “support number” found on Google can be fake.

Reaching real support

Uber. Uber says that when in doubt, drivers can contact the Uber team directly through the Driver app or at help.uber.com.
Lyft. Lyft’s advice: hang up a suspicious phone call right away; do not open links in a text or reply to it; do not open links or download attachments in an email. Lyft takes reports of suspicious calls and texts through its help page.

Protecting the account

Uber advises drivers to have a password just for Uber that they do not use for any other account.
Uber asks drivers not to share their login information with anyone, even if someone asks for it.
The FTC advises turning on two-factor authentication for the account. The FTC says an authenticator app or a security key is safer than a code sent by SMS, if you have that choice.
The FTC also advises setting a PIN or password on the mobile phone account.
Lyft advises drivers to do two things: change the phone number in the account when they get a new one, and sign out of the app before selling the phone.
Lyft also advises signing out of the account when finishing work on a shared computer or someone else’s computer.

If the code was already given, or something looks wrong

Below is what Uber, Lyft and the FTC say about this case. The FTC’s advice is to tell the bank or payment service immediately.

The account. Uber’s advice in this case is to sign in and change the password. If signing in no longer works, Uber’s help page has a form, “I think my account has been hacked,” and Lyft takes reports through its help page.
Warning signs. Uber lists these: account changes you did not make, trips or orders you do not recognize, changes to your payment details, and a password or email change without your knowledge. Uber also lists cashing out earnings to questionable cards among the risks.
The FTC says that if the phone suddenly stops making calls and sending texts and the internet stops working, it may be a SIM swap: a scammer moved the phone number to another SIM card. In that case the FTC advises contacting the mobile phone company immediately.
If you paid money to a scammer, the FTC says who to tell, based on how you paid. A credit card: the card issuer, with a request to get the money back. A debit card, bank transfer or Zelle: the bank, with a request to reverse the payment and refund the money. Venmo, Cash App, PayPal and similar apps: the app itself, with a request to reverse the payment. An international money transfer (wire transfer): the money transfer company. A gift card: the company that issued the card, at the number on the back of the card. The FTC says to do this immediately.
If you gave out a Social Security number (SSN), the FTC points to IdentityTheft.gov.
Reporting. The FTC takes fraud reports at ReportFraud.ftc.gov. According to the FTC, you can forward a suspicious text to 7726 (SPAM).

The FTC also warns: if you were already scammed, a new scammer may contact you and promise to get the money back if you pay them first. If you pay, you lose even more.

Common mistakes

Reading out the code because the caller knows your name and the trip details. That proves nothing.
Trusting the number because the screen says “Uber Support.” The number and name can be faked.
Tapping a link in a text to “confirm the account” or “get a bonus.”
Calling back the same number that called. According to the FCC, the number can be faked. Uber and Lyft name the app and the help page as the way to reach their support.
Staying quiet out of shame. The sooner the company and the bank know, the better the chance of protecting the account and the money.

Key terms

Plain meanings. The Georgian word is in brackets.

scam: fraud, a trick to take money or information (თაღლითობა).
phishing: a fake call, email or text that tries to trick a person into giving out information (ფიშინგი).
verification code: a code that arrives by SMS to confirm who is signing in (დადასტურების კოდი).
support: a company’s help service (მხარდაჭერის სამსახური).
spoofing: faking the number or name shown on the screen (ნომრის გაყალბება).
cash out: moving earned money to a card or account (გამომუშავებული ფულის გატანა).
two-factor authentication, 2FA: two-step sign-in, where a code is needed in addition to the password (ორსაფეხურიანი დადასტურება).
gift card: a prepaid card (სასაჩუქრე ბარათი). The FTC says only scammers tell people to pay with a gift card.
hacked: an account that someone else broke into (გატეხილი ანგარიში).

All words on one page: glossary (in Georgian).

Official links

Looking for a passenger or a car?

Ride listings from Georgians: Rides. Posting a listing is free.

This is general information and not legal advice. Company rules change. The current rules are on the official pages.