According to new research by Trend Micro, Netflix and Uber customers are two of the more popular targets for hackers as the credentials for the accounts can be cheaply bought online, and the credit cards associated with the accounts are then used for fraud.
The cyber-security company has gone so far as to say that credentials for the popular online services “are now the sought-after Personally Identifiable Information in the deep web and underground markets”. Even more so, possibly, than stolen credit card details.
Bharat Mistry, a cyber security consultant at Trend Micro spoke to SCMagazineUK.com, saying that Trend Micro's researchers “are constantly monitoring forums, chat rooms and bulletin boards in multiple regions and countries around the world.” One of the latest findings as it happens is the popularity of buying stolen Uber and Netflix credentials
A stolen Netflix account sells for as low as £3.50 ($5) while an Uber account can cost £2.80 ($4), not much more than stolen credit card details which cost roughly 70p ($1) per card. Supposedly Uber has eight million users and Netflix has nearly 75 million global users as of late last year providing the ill intentioned with a great bounty of credentials to steal and customers to defraud.
That said, Trend Micro's report says, not as many users are credit card holders, driving the price of these cards up: “Netflix and Uber accounts are becoming more popular and possibly even more profitable than credit card information may be a case of the law of supply and demand.”
The report adds, “we have an over-abundance of stolen credit card details, the demand for which may have gone down given the security measures banks and financial institutions put in place to prevent credit card fraud.”
The accounts are being used, according to Mistry, “to create a fuller profile of a victim for identity theft or can be used for bogus transactions. In the case of Uber for example the stolen accounts could be used to charge for factious journeys whereby a criminal has set up a fake drive account and charges non-existent rides to stolen rides.”
Some Netflix accounts, Trend Micro researchers found, were being sold for only 17p (25 cents) and when advertised, came with the warning that illegitimate users should not attempt to change the account details of the legitimate users for fear of being found out by Netflix.
Last year, it came to light that Uber accounts were being sold freely on the dark web and legitimate customers were hit with large bills for rides that they didn't take. Fraudsters would often try and change the attached contact reference so customers wouldn't get prompted when one of these ‘phantom rides' was taken.
An Uber spokesperson told SC that they have since tried to fix that particular problem: “Last year we made some changes to the app which dramatically decreased the ability for criminals to fraudulently access accounts, including further account verification requirements. Uber has taken this issue very seriously and has refunded anyone who was charged for a ride they didn't book or take. We would still like to remind our users to use a unique password for their Uber account.”