Man Steals Crypto Posing As Uber Driver

[Zoomic]

From Cointelegraph:

Once inside the car, police say Hussein asked to borrow the passenger’s phone because his device was broken. In the second case, Hussein offered to troubleshoot the Uber app after the passengers questioned why it indicated the driver hadn’t arrived yet.

It’s alleged Hussein then used his passenger’s phone to raid their Coinbase accounts with a phone-to-phone transfer of crypto and a phone transfer to cold storage.

https://cointelegraph.com/news/fake-uber-driver-arrested-stealing-thousands-from-unsuspecting-passengers

Does anyone have any idea how this guy was able to bypass login credentials, or did he simply open the Coinbase app and transfer coins to himself? I would think phone apps would have greater security than this, and again this points to a phone app vulnerability once someone physically possesses a phone. This could be an argument for not storing or accessing crypto in a phone.

So many things might have happened to make it very easy for the thief to steal. It might be that the phones have a weak security and the coinbase app session was still very active as at the time the phone was handed over to the thief. There's a lot the story didn't capture, anything might have happened, but all I can say is that the passengers are careless for moving around with a device that holds such huge amount of money.

[Marykeller]

Does anyone have any idea how this guy was able to bypass login credentials, or did he simply open the Coinbase app and transfer coins to himself? I would think phone apps would have greater security than this, and again this points to a phone app vulnerability once someone physically possesses a phone. This could be an argument for not storing or accessing crypto in a phone.

Most likely that was the case, he didn't have to bypass the login credentials as he could be holding the phone already and so all he has to do is to open Coinbase and most likely the owner had the password save in his account in the phone itself.

And with that, it's going to be very quick for him to do the transfer. So yes, perhaps one lesson learn is that we shouldn't save the password itself on the phone so just in case it's not compromised, it might take days for someone to steal your crypto. And by that time, you might have reported to Coinbase already, or change everything.

Even at that, how will someone forget not to be observant or not to be close to someone they gave their phone to, to make a call with it? Someone can't be that caress to forget that they have their crypto assets on their phone, that they are supposed to guide it and avoid giving their phone to strangers no matter what. There are a few precautions that are supposed to be taken on one side rather than falling victim to a simple mistake that is supposed to be avoided at first.

The issue is that the said guy was being careless. He forgets so quickly that he is supposed to be protective of his phone at all times. Nowadays, is not when to give out a phone to strangers or family members, when you have your crypto assets stored in it. You need to protect it by providing a separate app lock for it so that someone can't access it without unlocking it

[goldkingcoiner]

Does anyone have any idea how this guy was able to bypass login credentials, or did he simply open the Coinbase app and transfer coins to himself?

Many people do not guard their money well enough. They do not take security very seriously and because it has 'always worked out for them so far' they feel safe continuing these unsafe financial practices.

When you have decentralized money, you need to learn to take responsibility and be your own bank.

[coolcoinz]

It’s alleged Hussein then used his passenger’s phone to raid their Coinbase accounts with a phone-to-phone transfer of crypto and a phone transfer to cold storage.

I've never heard anything about a "phone-to-phone crypto transfer". The article author should elaborate more on this new technology.
I would never store my crypto in a mobile crypto wallet and I would never give my mobile device to strangers. I also don't use Uber or taxis, so I guess that I'm safe, when it comes to such scams.
How did this "Uber driver" know who has a crypto wallet on his phone and who doesn't? Did he ask all his passengers to give him their mobile devices? He probably did some initial research and preparation before he started doing this scam.
Criminals are getting way more innovative, when it comes to stealing crypto, but every criminal gets caught, sooner or later.

Most likely they meant a qr code transfer.

Phone to phone means he scanned his own wallet's qr code using the victim's Coinbase app and initiated transfer.
The phone probably had only a fingerprint lock and the user was logged in the Coinbase app.
The thief persuaded the victim to unlock their phones so he could check what was wrong with their Uber app and fix the problem, but instead he scrolled through their phoines looking for crypto apps and wallets. If they had an unlocked wallet he'd quickly scan his own wallet and send funds to himself.

Bottom line, if you're so careless that you don't even have a wallet password, you're bound to lose your coins sooner or later.

[Salahmu]

From Cointelegraph:

Once inside the car, police say Hussein asked to borrow the passenger’s phone because his device was broken. In the second case, Hussein offered to troubleshoot the Uber app after the passengers questioned why it indicated the driver hadn’t arrived yet.

It’s alleged Hussein then used his passenger’s phone to raid their Coinbase accounts with a phone-to-phone transfer of crypto and a phone transfer to cold storage.

The passenger is also to be blame on this case because I believe that it wasn't his first time of entering Uber, so he should have checked to identify if the Uber profile picture matched with the face of this driver before starting the journey but it seems that the passenger did not care much about those things because an Uber driver whose his private information is recorded on the database will hardly do that because they can easily track him.

Also the passenger should have known that if the Uber drivers phone is broken or anything else, there is nothing the passengers phone will do for the Uber driver because Uber company program there drivers app in such a way that passenger can only order a ride and share only feedback, so every other things including clicking on arrival is done from the drivers end, so he shouldn't have allowed the Uber driver to have any contact with his phone, another part that deserve question is how the Uber driver transfer all his crypto without the passenger noticing when they were still on the car because to transfer crypto involves alot of code verification and there is no way to bypass it with the passenger beside him unless he was not close to the passenger to have perform all the bypassing he did.

[DaNNy001]

These articles rarely describe the technical issues well and some are misleading but why keep your coins in Coinbase and why use the same phone you use for  every day deals. The simplest advice would be to use cold storage or a separate phone for crypto/hardware wallet and Not your keys not your coins

I think saving coins in cold storage device or maybe PC hardware is practically one of the rampant advice given to anyone having Bitcoin but the thing is that not everyone will still adhere to this.

I think your everyday mobile phone shouldn't be the one carrying your Bitcoin asset as you are liable to face some weird situation although some cases are unavoidable but Saving your Bitcoin in a separate device would definitely save you some stress.

[icalical]

I'm surprised because Coinbase supposed to be secured, since a lot of people put crypto asset there, but still, if someone get access to the phone, the app is not so secure anymore. This goes to the risk of holding or using crypto on your phone and especially without additional security measures. While Coinbase is so far offering features for 2FA and security keys, physical access to an unlocked phone bypasses the afterthoughts. A reminder to keep phones locked and avoid unsafe settings when opening sensitive financial apps. While mobile access may be convenient, strong passwords and advanced 2FA, every feature available, should balance the scale between convenience and safety.

[Questat]

Does anyone have any idea how this guy was able to bypass login credentials, or did he simply open the Coinbase app and transfer coins to himself?

Many people do not guard their money well enough. They do not take security very seriously and because it has 'always worked out for them so far' they feel safe continuing these unsafe financial practices.

When you have decentralized money, you need to learn to take responsibility and be your own bank.

They think it's decentralized, no other person can access their account but only them. Unfortunately, if security measures aren't tight because people seem so confident that their crypto assets are well kept and secured, they will literally lost their assets. This should serves a lesson to everyone that no phone app is 100% safe, unless if the owner itself is well knowledgeable on how to secure his coins or funds so it won't be easily access by strangers.

[Pmalek]

This could be an argument for not storing or accessing crypto in a phone.

Better yet, don't give your phone to unknown people, and don't enter cars of fake Uber drivers. The app shows you what car will come to pick you up, including the registration number. Why would you enter a different car when you can see that the one you are waiting for is still on route to your destination? Another question: how did he even know that those people ordered an Uber?

So many people take the convenient way instead of the longer and safer way. He shouldn't have been able to access or send money from those crypto wallets without being asked for passwords, PINs, 2FA codes, etc. But people don't want to bother with that and want instant access. Who has time for security.

[Finestream]

He is not an uber driver, he was just pretending.

A man posing as an Uber driver in Scottsdale, Arizona, was reportedly arrested after allegedly stealing a combined $300,000 of crypto from two unsuspecting passengers

I stand corrected, he was only "posing." But for a $300k asset accessible on a phone, the victim should have added more layers of security to ensure it couldn’t be tampered with. This was pure carelessness. Even though the suspect has been caught, there’s no mention of whether the money or even a portion of it was recovered. What if the suspect simply serves jail time, maybe a maximum of 5 years for a case like this? That’s not much of a consolation.

[Outhue]

This story isn't making much sense to me, the driver knew this person before? I asked this question because many people in today's world still don't have crypto, some don't even know about it, so how did the driver knew that his passenger is crypto investor?

Also is it that fast to log into someone's else Coinbase account and withdraw funds? Just like that? Because many crypto exchanges today will ask for your one time password or withdrawal code like Google Authenticator code etc.

Let's pretend this is possible, if you move fund from a crypto exchange to another in an act of stealing you just shoot yourself in your foot, because this is the most traceable act of stealing.

[Synchronice]

From Cointelegraph:

Once inside the car, police say Hussein asked to borrow the passenger’s phone because his device was broken. In the second case, Hussein offered to troubleshoot the Uber app after the passengers questioned why it indicated the driver hadn’t arrived yet.

It’s alleged Hussein then used his passenger’s phone to raid their Coinbase accounts with a phone-to-phone transfer of crypto and a phone transfer to cold storage.

https://cointelegraph.com/news/fake-uber-driver-arrested-stealing-thousands-from-unsuspecting-passengers

Does anyone have any idea how this guy was able to bypass login credentials, or did he simply open the Coinbase app and transfer coins to himself? I would think phone apps would have greater security than this, and again this points to a phone app vulnerability once someone physically possesses a phone. This could be an argument for not storing or accessing crypto in a phone.

I wonder, guys, from personal experience, is Uber more dangerous than regular Taxi? Taxis have more restrictions and regulations but as I know, Uber is handled way easier and anyone with a car can start working.
The second case is really a little funny because a guy who was in cryptos didn't know how to troubleshoot the Uber app problem and this scumbag driver was very lucky in that situation.

These kind of scams indicate that everyone should take the security of their devices seriously because criminals are adapting to the modern era. Everyone should hide crypto apps on their smartphone and set a high level security, people also should not keep more than they can afford to lose in their smartphones, i.e. they should use it as a hot wallet. People need to take many measurements and this accident proves again how hard we need a Cybersecurity board on Bitcointalk.

[Cookdata]

Does anyone have any idea how this guy was able to bypass login credentials, or did he simply open the Coinbase app and transfer coins to himself? I would think phone apps would have greater security than this, and again this points to a phone app vulnerability once someone physically possesses a phone. This could be an argument for not storing or accessing crypto in a phone.

This is possible but it's going to be under one condition, if the passenger has transaction with him couple of time in the past because there is no way the guy that stole the coins from the coinbase app. I have helped one guy settled transaction with one of my friend Bybit account, the transaction was internal transaction and it wasn't ones that I notice, what centralized exchanges does with internal transactions is that if a wallet is already white listed + plus done transactions in the past, no verification will be required in the subsequent transactions.

I'm not sure if coinbase exchange operate in that manner but it's likely that that's not the first time the guy must have done transaction with that account. He was only exposed because he used exchange to exchange transactions. This is why they said, any coins without your own private keys is never your coin. If he has used a hardware wallet and then used watch only address on the phone, such will never happened.

[Churchillvv]

Who has time for security.

This statement has caused a lot of people different things in their life including my friend. Not giving a F**k about your security is like Keeping cash on the street and expecting it not to be picked up.

OP, personal security matters alot and there is this thread that said something like you should be suspicious of everything untill they are proven otherwise, I believe that is the highest method of security cause you will rarely run out of luck when you're being careful.

[Die_empty]

This story isn't making much sense to me, the driver knew this person before? I asked this question because many people in today's world still don't have crypto, some don't even know about it, so how did the driver knew that his passenger is crypto investor?

Also is it that fast to log into someone's else Coinbase account and withdraw funds? Just like that? Because many crypto exchanges today will ask for your one time password or withdrawal code like Google Authenticator code etc.

Let's pretend this is possible, if you move fund from a crypto exchange to another in an act of stealing you just shoot yourself in your foot, because this is the most traceable act of stealing.

There are some information that is lacking from the story. If not that the OP added a source, I wouldn't have believed the story. How would someone give his phone to a stranger and the driver was able to log in his wallet and withdraw funds. The criminal is not smart that was why he was easily tracked and caught. Some people will not learn until they have a bad experience. How can someone have thousands of dollars in a centralized wallet? How will someone also be moving around with such an amount on his phone?

A friend told me how some corrupt police officers forced a crypto owner to transfer some amount to them because they saw a crypto wallet in his phone. It is better to keep any device that contains any crypto app at home.

[Hewlet]

And with that, it's going to be very quick for him to do the transfer. So yes, perhaps one lesson learn is that we shouldn't save the password itself on the phone so just in case it's not compromised, it might take days for someone to steal your crypto. And by that time, you might have reported to Coinbase already, or change everything.

unfortunately, a lot of us are guilty of saving most of our passwords on our device just because of the ease of access it gives us but never considers that an event as this can happen to anyone at time he least expect. allowing a stranger access to your device is something you shouldn't let happen any how especially if you know that your funds can easily get compromised if the stealer makes such an attempt. the simple crack the suspected urber driver used could just be to try opening any exchange app on the device and see one that lacks security check. it could even be that the passenger had his wallet secured but used it recently and the app was still unlocked.

it is getting really unsafe out there, we just have to be more careful with the way we expose ourselves to certain risk. imagine he only had access to opening the wallet and knowing that you have a certain worth of coin? he could attempt to waste you just to get access to those coin. it is even best to hide some of our sensitive apps on a vault so it get to at least pass through some security check before anyone get access to it.
 

[freedomgo]

This story isn't making much sense to me, the driver knew this person before? I asked this question because many people in today's world still don't have crypto, some don't even know about it, so how did the driver knew that his passenger is crypto investor?

Also is it that fast to log into someone's else Coinbase account and withdraw funds? Just like that? Because many crypto exchanges today will ask for your one time password or withdrawal code like Google Authenticator code etc.

Let's pretend this is possible, if you move fund from a crypto exchange to another in an act of stealing you just shoot yourself in your foot, because this is the most traceable act of stealing.

There are some information that is lacking from the story. If not that the OP added a source, I wouldn't have believed the story. How would someone give his phone to a stranger and the driver was able to log in his wallet and withdraw funds. The criminal is not smart that was why he was easily tracked and caught. Some people will not learn until they have a bad experience. How can someone have thousands of dollars in a centralized wallet? How will someone also be moving around with such an amount on his phone?

A friend told me how some corrupt police officers forced a crypto owner to transfer some amount to them because they saw a crypto wallet in his phone. It is better to keep any device that contains any crypto app at home.

While this story is not as clearer as it should be, but it certainly leaves a big lesson for all of us, most particularly for those who are keeping virtual assets in their phone. This is really a big no for us, bringing our device everywhere we go which contains our hard-earned assets. No matter how seriously we try to safeguard it, there are actually some instances that will put it at a danger zone. Even being cautious would not help either.

The best solution for that is just to leave it at your safety place. Find a safe spot at home that would keep it secured. Rather than bringing it everywhere and risk your hard-earned assets, that would lead to an instant loss.

[fikrett]

Who has time for security.

This statement has caused a lot of people different things in their life including my friend. Not giving a F**k about your security is like Keeping cash on the street and expecting it not to be picked up.

OP, personal security matters alot and there is this thread that said something like you should be suspicious of everything untill they are proven otherwise, I believe that is the highest method of security cause you will rarely run out of luck when you're being careful.

Agreed.
You either spot things on or they pass by, but then again - you never know when the misfortune will strike for real.
So in the best case it is vital to be vigilant all the time, especially with strangers.