What ‘The Queen of the Rideshare Mafia’ Can Tell Us About Onboarding Securely

• So-called ‘Rideshare Queen’ scammed numerous apps
• Used illegally copied driving licences to create new accounts
• Drivers would ‘rent’ her fake identities – earning her a fortune
• She could have been stopped with this simple check

Priscila Barbosa arrived at JFK, New York on a tourist visa from Brazil, on 24 April 2018, aged 32, with just 117 dollars to her name – and immediately spent much of that on a bus ticket to Boston.

Three years later she had made hundreds of thousands of dollars as the architect of an elaborate identity scam that would eventually see her dubbed ‘The Queen of the Rideshare Mafia’.

Barbosa achieved this astonishing rise after discovering how to create fake driver accounts which allowed fellow immigrants with no Green Card – so no legal right to work – immediate access to what’s called the gig economy.

Her scam meant she was able to get such people working accounts as drivers for taxi apps like Lyft and Uber so they could bypass immigration work restrictions and make a wage.

Created fake accounts then ‘rented’ them to illegal drivers

Once she’d managed to scam the employing company’s onboarding security checks she’d then ‘rent’ the account she’d created to a migrant – usually a fellow Brazilian, like her on a tourist visa. They’d pay her a weekly cut from their wages for the access she provided to that platform and the paid work that came with it.

When the pandemic killed the taxi trade-off almost overnight there was conversely a boom in demand for takeout food – and resourceful Barbosa was able to pivot her business model to create the same scenario for apps offering home-delivered food and needing a steady flow of drivers.

Now the companies she was hoodwinking would include Instacart, DoorDash, Uber Eats and Grubhub.

The scam also allowed her to pocket hundreds of sign-up bonuses.

Stolen licences were the gateway to vast scam

So how did Barbosa manage to deceive all these platforms and create her empire? If you’re interested in more detail than my precis here affords then Wired published a very good long read on the whole story the other day that will tell you a whole lot more.

But for my purposes, a summary of her fake ID crime spree will suffice – because I’m more interested in the lessons we can draw from her story than her colourful career itself.

Barbosa had minimal resources, at least initially, but she was very gifted at tech, particularly at working out ways to bypass system security. She was also a natural networker, able to form relationships quickly and sustain hundreds at a time. These two skills took her a long way in a very short time.

Where did she source so many driver identities?

Her trade began with her trying to work out how to become a driver herself. She used someone else’s licence – and it worked. So she started helping others to do the same.

Initially, she begged friends for misappropriated IDs. The first she got her hands on came from a doorstep scam: legitimate consumers receiving parcels would be asked to produce ID in order to have their parcel handed over. The driver would distract the customer and quickly take a close-up of their driving licence and that image would end up making its way to Barbosa who could clone it.

When this source couldn’t deliver licences in sufficient quantities she went onto the dark web – where very private material like this is traded freely – and began purchasing misappropriated licence images in greater numbers.

Then, once she had uploaded a licence, the rest was easy.  Because there was little if any attempt to cross-check the details on the stolen licence against the rest of the account holder’s added information.

She exploited a systemic weakness – they were checking the wrong thing

The apps often quickly realised they were being spoofed and would shut down the new accounts quite quickly – but Barbosa would simply open new ones in response.

So how could such massive brands with such enormous turnovers be scammed by a chancer who started out equipped with just an iPhone and $50?

The main problem stemmed from that initial reliance on uploading a driving licence as the backbone of their verification processes. I suppose it seemed natural – logical even – for companies wanting drivers to reach for this method when setting up. They wouldn’t want unqualified drivers working under their brand name so this must have seemed the best way to ensure that they weren’t.  But, counterintuitively, it wasn’t then and it isn’t now.

As this story amply demonstrates, fake ID is easy to get hold of and is out there in vast quantities. So a document upload is a poor starting point for verification.

Here’s what they should have done: checked their phones, not licences

In fact, the best place to start is with the phone number of the applicant. The vast majority of bone fide people will have had the same number for some years. By checking both a number’s current status and history we can see at a stroke whether it shows any warning signs of being associated with fraud: is its behaviour consistent, is it physically where you would expect it to be, is it newly registered, and so on.

Once you have established the credibility of the new user’s number, then document upload as an optional secondary screening tier is fine – but they should never be the starting point.

As if to prove my point, it was the fact that so much of her scam work was carried out from or linked to a single mobile phone which would eventually allow Barbosa to be identified and apprehended by the FBI after a lengthy and costly investigation which led to 17 criminal cases.

She protested at trial that she had believed her faking had been a victimless crime.

In fact, the thousands of people whose identities had been abused no doubt suffered many indignities, inconveniences and probably financial losses. She was jailed for three years.

But if that phone number the FBI sourced had been checked when she made her first application six years ago, none of this would have happened.