SINGAPORE - Several Uber users in Singapore have claimed that they were charged for "phantom" rides they did not take, while others said they were fraudulently billed for food deliveries under the company's other app, UberEats.
Mr Sherwin Loh, 41, a public relations associate director, shared with The Straits Times that he was billed for three food delivery orders in June (2017) - two of which were between S$40 and S$50 each, and another about S$120 - which he did not make.
The charges to his credit card were made by a restaurant in Russia in June this year (2017), while he was then on vacation in the United States with his family, Mr Loh told ST on Friday (Nov 24).
Uber said it is investigating Mr Loh's case.
The ride-hailing firm has recently been hit by a string of cyber-security breaches. On Tuesday (Nov 21), it was also reported that Uber had covered up a global security breach in October 2016 on its platform, which exposed the personal information of about 57 million accounts.
Besides Mr Loh, several Uber users in Singapore have taken to Facebook to complain that they were charged for "phantom" rides.
Ms Jenna Lim claimed that $1,300 worth of Uber rides she did not take were billed to her in a period of five days in November.
Uber, however, maintained Ms Lim's case is not linked to the cyber-security breach.
A spokesman said: "The incident in 2016 did not breach our corporate systems or infrastructure, and our outside forensics experts have not seen any indication that trip location history, credit card numbers, bank account numbers, NRIC or dates of birth were downloaded."
Uber said it is working with Ms Lim to refund the charges.
Mr Loh, who has been using Uber for about 1½ to two years, has stopped using its apps and switched to its rival firm Grab.
"My data (on Uber) must had fallen into the wrong hands. I have downloaded the UberEats app, but have not used it before," he said.
Mr Loh said that when he was in the US on June 21, he received an e-mail alert from UberEats about a food order. He logged into his UberEats app to find out what had happened, and shortly after, another transaction came in.
Mr Loh said he immediately called the bank to halt the credit card transactions. It was then that he was informed by the bank that a third transaction was being made. He then cancelled the card.
While Uber has agreed to reverse the charges, Mr Loh said that he incurred $45 in phone charges, for calling his bank in Singapore to resolve the issues.
"I'll take it as a $45 lesson. I can't possibly send a $45 invoice to Uber, right?"
When asked, Uber declined to reveal how many users in Singapore had been billed for "phantom" rides or food deliveries on UberEats.
Uber said that payment information is encrypted when users enter it into the Uber app.
Ms Emily Orton, director and co-founder of cyber-security firm Darktrace, said of the cases: "This is about the security of Uber's infrastructure, and also the security of their third-party suppliers and service providers.
"The reality is that there are multiple ways to breach a network today - cloud services, customer networks and third-parties are all part of that," she added.
