Uber faces fraud challenges in industry it redefined

Estimates vary widely, but ridesharing pioneer Uber Technologies Inc., commonly known as Uber, could be valued anywhere from $50 billion to $100 billion. (See Benchmark says Uber could be ‘comfortably’ worth over $100 billion in next couple of years, by Megan Rose Dickey, TechCrunch, Aug. 7, 2017.) Few organizations reach this level of valuation before going public, and fewer still have faced as many allegations of improper, illegal or unethical behavior as Uber. Almost without exception there’s a weekly story about Uber that could, if confirmed, potentially ruin its high valuation.

Few companies have disrupted an industry like Uber since its founding in March 2009. In just eight years, Uber’s innovative technology, avant-garde business model and marketing prowess have helped make it an industry leader that boasts a presence in 674 cities across 83 countries worldwide, as of press time. (See Uber Revenue and Usage Statistics, by Artyom Dogtiev, Business of Apps, Sept. 26, 2017.)

Apart from drawing the scorn of industry regulators across the globe, Uber has been at the center of multiple fraud and workplace harassment allegations and numerous U.S. Department of Justice (DOJ) investigations. (See Uber reportedly cooperating with U.S. investigation on possible overseas bribes, by Paresh Dave, Los Angeles Times, Aug. 29, 2017.)

According to one Uber executive I talked to, who requested anonymity, the DOJ is conducting no less than six current investigations involving Uber.

Of course, living in San Francisco — the location of Uber’s global headquarters — has made this even more interesting for me. I have many connections in my business network who’ve worked for or are currently employed by Uber. I myself am a fan of Uber’s service because riders can easily order and pay, and the overall quality of the rides I’ve taken has been high. Uber has not only changed an industry but the underlying fraud profile of that industry.

Here in part one, I’ll look at various fraud risks created by Uber and its competitors. In part two, I’ll take a deeper dive into the various allegations raised against Uber. We’ll see, from a fraud examiner’s point of view, the lessons we can learn.

The start-up background

Garrett Camp, Oscar Salazar and Conrad Whelan built the first version of Uber, called UberCab, in 2009 as a way to use technology to open up the highly regulated industry of taxi and hired car services. Travis Kalanick served as a “mega adviser.” He’s also said his title back then was “chief incubator.” Kalanick became CEO in December 2010 when then-CEO Ryan Graves stepped down in favor of Kalanick. (See The story of how Travis Kalanick built Uber into the most feared and valuable startup in the world, by Avery Hartmans and Nathan McAlone, Business Insider, Aug. 1, 2016.)

Until that time, taxi service around the globe had been almost exclusively restricted to licensed vehicles with local municipalities. In major cities like New York and London, the number of these licenses, or “medallions,” were limited, and a secondary market developed to buy and sell them.

As recently as 2013, the going price for a single medallion in New York was $1.3 million. In March of 2017, it reached a decade low of a mere $241,000. (See How much is a NYC taxi medallion worth these days? by Theresa Agovino, CBS News, April 14, 2017.) However, as many of us can testify from our own experiences, the quality and service provided by taxis can vary. You might be in a new vehicle with a friendly and informative driver, or (more likely) you might end up in an older vehicle with a driver who has the personality and charm of a grim-faced statue. Uber saw an opportunity to use cellphone technology to provide easy transportation in a new way — an idea that sparked significant change in a more than century-old industry.

The new fraud landscape

Looking back at the modern-day origins of taxis and hired cars, in the early 20th century, cities and municipalities knew they needed to require that drivers: 1) were licensed and skilled 2) operated vehicles that were safe and drivable and 3) charged fair and reasonable prices. Their passenger proceeds were taxable revenue. (See A Historical Argument Against Uber: Taxi Regulations Are There for a Reason, by Sam Frizell, Time magazine, Nov. 19, 2014.)

Fare meters were invented so both passengers and drivers ostensibly knew the exact amount charged and to provide — for taxing purposes — a supposed true and correct record of total fares. You’ve probably seen the lead seals on meters for preventing and deterring alteration. Of course, drivers can tamper with meters to charge more than legally permitted or erase fares so they can reduce taxes they have to pay. Drivers can also pad fares by taking longer routes to destinations.

So, passengers were ready for a bit of innovation when Uber entered the scene against a backdrop of dubious taxi service and safety. According to the Time magazine article, Uber’s smartphone app provides estimated costs of rides and holds drivers accountable for their routes. Passengers pay via pre-entered credit card information (cash is entirely gone from transactions) and rate each ride for quality control. So, the new technology apparently provides a plethora of upsides. However, every new improvement creates many fraud opportunities.

Potential frauds and Uber’s anti-fraud programs

The easiest way to perpetrate fraud with Uber is to use someone else’s account for free rides. The scheme is like credit card fraud, but the fraudster doesn’t need card numbers because they’re linked in the background of the victim’s Uber account. (See Stolen Uber accounts worth more than stolen credit cards, by Harriet Taylor, CNBC, Jan. 19, 2016.)

Uber realizes that users have to trust the security of their accounts and that the company has to quickly handle any illegitimate charges. The company must be a prime target because of its size and the potential value of the accounts. (At press time, new allegations were emerging in the media that Uber attempted to cover up a data breach involving about 57 million user accounts. I’ll address the breach and alleged cover up in Part 2 of this two-part series.)

Uber allows its drivers to quickly cash in on accounts. The company pays drivers weekly, which is faster and more frequent than they could expect to be paid directly by credit card companies if they were working as independent contractors or merchants. An Uber driver fraudster can be tempted to run up hundreds — perhaps thousands — of illegitimate rides. Of course, Uber isn’t sitting still in its anti-fraud efforts. The company has safeguards in place to try to prevent driver manipulation. Uber emails receipts to riders soon after rides. Also, Uber and credit card companies monitor transactions for potential fraud. (See Uber Community Guidelines, Uber.com.)

Uber says it’s trying to employ innovative anti-fraud measures. According to a recent article in The Washington Post, Uber has employed both cellphone tracking and facial recognition measures to attempt to prevent and detect certain types of fraudulent transactions. However, even this hasn’t been without controversy. According to the article, Uber didn’t inform its customers that their movements would be recorded from their phones and stored on an Uber server. (See To improve safety, Uber turns to an unconventional measure: selfies, by Faiz Siddiqui, The Washington Post, Sept. 23, 2016.)

As detailed in an article in The New York Times, Uber also engaged in what is known as iPhone “fingerprinting,” which enables Uber to identify individual iPhones even after users have deleted the Uber app. This practice violates Apple’s rules for app developers. Apparently, Uber tried to bypass the rule by hiding its fingerprinting actions from Apple by geo-fencing Apple’s headquarters in Cupertino, California. (Geo-fencing is a way to digitally ID people within a geographic area — essentially creating a virtual geographic boundary. Uber used geo-fencing, in this case, to conceal its fingerprinting efforts from those within the boundary.)

Apple found out what Uber was doing, and Apple CEO Tim Cook demanded a face-to-face meeting with Kalanick, Uber’s CEO at the time. As reported in The New York Times article, Cook threatened to remove the Uber app from the Apple store if Uber didn’t cease this practice.

Regardless, even by most standards, Uber has been surprisingly open about the types of anti-fraud programs it’s developed. In fact, it has a dedicated webpage for its Uber Engineering Fraud Prevention Team that includes member profiles. (See Mastermind: Using Uber Engineering to Combat Fraud in Real Time, by Yifu Diao & Isabel Geracioti, Uber.com, March 8, 2017.)

Uber highlights its “Mastermind” tool. According to the Uber article, “Because we don’t want to interrupt Uber’s seamless experience for riders and driver partners, our algorithm must deduce a rider’s ability to pay — and detect any fraud — in a fraction of a second. The fraud prevention scope covers payment fraud, account takeover, driver-partner/rider collusion, and promotion abuse. Mastermind helps us fulfill this charter, all while maintaining a seamless customer experience.”

It seems that Uber has identified many of the potential ways that fraud could be perpetrated in this new business model, which is similar to how cities identified risk factors in the early days of taxicabs and riders’ initial credit card use. Could this be just the beginning of a new fraud frontier? Only time will tell.

In part two, in the March/April issue, I’ll examine Uber’s founder and former CEO Kalanik, and his reputation as a “bad boy” who was willing to bend the rules to succeed. Is this the reason for Uber’s extreme success or just a coincidence? If Uber is willing to use any means to get ahead, what’s the matter with fudging the financial results for its benefit? Could Uber’s alleged ethical issues eventually lead to the rideshare giant’s downfall?

Steve C. Morang, CFE, CIA, CRMA, is a senior manager at a Northern California-based CPA firm and president of the ACFE’s San Francisco Chapter. His email address is: steve.morang@yahoo.com.