How Brazilian scammers easily robbed millions from UBER, Door Dash, Lyft?

The U.S. Department of Justice (DOJ) confirmed that Brazilian citizen Gustavo De Avila Moreira Farinha has pleaded guilty to participating in a wire fraud scheme, accepting charges of money laundering, aggravated identity theft and conspiracy to commit fraud.

In 2021, the defendant and four other Brazilian citizens were charged with participating in a conspiracy to create fake driver accounts on various food delivery and ride-sharing platforms, employing illegally obtained information that even belonged to other users on the platform. All of the suspects, who resided in the U.S. illegally, have already pleaded guilty.

The indictment does not explicitly mention the name of the affected platforms, although it has been unofficially mentioned that these are services such as UBER, Door Dash and Lyft.

De Ávila acknowledged that, between 2018 and 2021, he and his accomplices devised a scheme to defraud these platforms, considerably increasing their activity during the most critical months of the pandemic, time in which the use of travel applications decreased considerably while food and grocery delivery services and orders increased significantly.

In this operation, the defendants exploited the increase in demand for these services, creating new driver accounts with stolen identities, collecting referral bonuses from the fraudulent accounts and using, renting and selling the accounts to other users on these platforms.

After they received payments from the defrauded companies, De Avila and his accomplices undertook a money laundering operation to hide the origin of these funds, in an attempt not to attract the attention of companies, banks and tax authorities. In total, the defendants allegedly stole the identity of about 100 people, buying this information on a dark web forum.

U.S. Attorney Randy Grossman said, “Identity theft can be a nightmare of frustration and anguish for victims struggling to regain their good name.” Grossman thanked the prosecution team and investigative agents for their work in dismantling this operation.

De Avila’s sentence will be issued at the end of August. For each count of conspiracy to commit fraud and money laundering, the defendant could be sentenced to up to 20 years in prison, while identity theft is punishable by at least two years in prison. De Avila will also have to pay about $500,000 USD as restitution.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.