The "unlucky" tariff: the Interior Ministry warned about fraud in taxi services
Fraudsters began to extort authorization codes from the account in the taxi ordering service from users. With their help, attackers steal money from bank cards linked to the profile. The scheme is not particularly profitable for criminals, but the number of victims has been growing recently, experts say. How to protect yourself from intruders and recognize fraudsters — in the Izvestia article.
How taxi customers are deceived
The scammers found a new scheme of deception, starting to lure authorization codes from accounts in the taxi ordering service. This was reported in the Department for the Organization of the fight against the Illegal use of information and Communication Technologies of the Ministry of Internal Affairs of Russia.
After gaining access to the taxi account, the attackers steal money from the linked card, creating fake applications. The department revealed a detailed scheme of deception.
First, criminals hack into the driver's account in the taxi ordering or delivery service, and then they look for a potential victim. After that, they lure the authorization code from the passenger and gain access to his account. Fraudsters place fictitious travel orders from the passenger's compromised account, and they make them from the driver's account. The money is debited from the bank card linked to the passenger's account and credited to the attackers' accounts, the cyber police said.
The Interior Ministry clarifies that so far such a scheme is rare. One of the major precedents was recorded in the Altai Territory: a resident of Barnaul reported the theft of 29 thousand rubles from a bank card. The Ministry of Internal Affairs of the region found out that the write-offs occurred at night for several operations, and the account to which the unknown transferred the money is linked to one of the service's applications for ordering a taxi. A criminal case was opened into the incident under paragraph "d" of Part 3 of Article 158 of the Criminal Code of the Russian Federation ("Theft committed from a bank account)".
Later, another victim in Barnaul reported a similar incident. She lost 11.4 thousand rubles as a result of the actions of the attackers. The money was debited in various amounts, the largest of which was 5,000 rubles.
A similar scheme was uncovered by police officers from the Kurgan region. They managed to detain a resident of Kazan who was engaged in stealing funds from victims from several regions of the Russian Federation at once. He registered in the taxi booking application as a driver, set the geolocation of various cities and accepted applications. When ordering, the victims switched to instant messaging, where the attacker tricked them into finding out the code that allowed them to log into the victim's personal account. After that, the criminal withdrew money to accounts controlled by him.
In May, a similar incident was recorded in Primorye, the cyber police added.
"The main advice that can protect you from such schemes is not to provide SMS codes. Never to anyone, even if it's a taxi driver who accepted your application," the experts summarize.
The Izvestia editorial board sent a request to the Russian Ministry of Internal Affairs and major taxi aggregators. No responses had been received at the time of publication.
What is the danger of victim psychology?
Large taxi and delivery services, which are part of the ecosystems of Russian IT companies, protect their customers by constantly improving security measures, the Popular Front expert notes. Analytics", coordinator of the Moshelovka platform Evgeniya Lazareva.
— The service's applications are designed in such a way that the customer and the contractor can only contact through an internal chat or receive each other's contacts along with a notification that they can only be used for emergency communication. In other cases, you can call through the chat in the service, — the interlocutor of Izvestia draws attention.
By staying strictly within the scope of the taxi application or the delivery of a large company, users receive security guarantees, and the service assumes responsibility for any failures.
"Local and regional taxi and delivery services do not have such large—scale resources, so their security systems are much more modest, which is what scammers use," the expert clarifies.
Attackers gain remote access to performers' devices on such platforms through phishing links with viruses and malicious software.
For this reason, compliance with digital security rules is not just a recommendation, but an important component of modern life, especially in the context of a growing number of cybercrimes, emphasizes Denis Tsyplakov, Chairman of the VM—Pravo Bar Association.
"The scheme of luring out codes for making fake trips in taxi applications is based on psychology, because it completely depends on the victim's trust," the expert believes.
Despite the isolated cases of such violations in the regions of Russia, the total number of victims continues to grow. And such crimes are particularly dangerous for those who are not well versed in the rules of digital security, says Denis Tsyplakov.
However, the new scheme is not particularly profitable for the criminals themselves, Evgenia Lazareva believes. The amounts for orders are relatively small, so you need to create a lot of requests, but this usually takes less than a day.
"In addition, any such interference leaves traces, which carries potential risks, so such fraud mechanics are not widely used," the expert notes.
Digital hygiene Rules
In order not to fall for the bait of intruders, it is necessary to carefully check all calls and messages, Denis Tsyplakov draws attention. If the "support service" or the driver is calling from an unofficial number, there is reason to be wary.
— True employees of the services never request additional information and act within the framework of the service. To protect your account, you should use two-factor authentication, as this will complicate hacking. At the same time, you should not click on suspicious links, even if they allegedly come from the driver," the expert urges.
In order to protect customers from attacks by intruders, performers need to use a separate device with a phone number, on which only the service's application for making orders will be installed, recommends Evgenia Lazareva.
— Of course, the security of this device should be carefully monitored — do not click on unknown third-party links from it, do not install applications for entertainment and communication. This device must be provided with security solutions such as pop—up ad blockers, antiviruses, and antispam. It is also important to ensure that security solutions are regularly updated and that you set strong, complex passwords," she advises.
Those who have been deceived in this way need to act decisively and quickly. First of all, it is urgently necessary to block the bank card, contact the bank and the taxi service support service, and write a statement to the police.
The sooner the victims of such fraud contact their bank, the service, and the law enforcement authorities, the higher the chances of blocking all debits, refunding the money, and finding and bringing the perpetrators to justice, Evgenia Lazareva agrees. Therefore, the degree of probability of returning stolen funds directly depends on the vigilance and speed of the victim's reaction.
Criminal liability is provided for such a crime under art. 159 of the Criminal Code of the Russian Federation ("Fraud"). Depending on the damage caused, the attackers face a fine of up to 1 million rubles, compulsory or forced labor. In case of actions of an organized group or major damage, a penalty of up to 10 years in prison is allowed.
The service itself may be responsible, warns Lazareva. If the client suffers losses and the contractor fails to prove that he is also a victim in this situation, this will become a serious problem for him. The client will be able to recover the stolen funds from the company through the court.
"Law enforcement officers can be held accountable for complicity in a crime, and the service of such a performer can be blacklisted as unreliable," she adds.
Переведено сервисом «Яндекс Переводчик»
