Laurie N. had only been driving for Uber for three days when she was confronted with a female driver's nightmare scenario: a drunk and upset male passenger showed up at her doorstep, pounding on her door. Even worse, she hadn't given him the address. He'd gotten in touch, and then located her, using a combination of Uber's lost-and-found system and Apple's Find My iPhone. Yet while the passenger was able to track her down, she was unable to do the same with anyone at Uber, leaving her feeling exposed and vulnerable.
Typically, it's Uber's passengers' safety that both the media and the company itself have spent considerable time expressing concern over. Yet some of Uber's female drivers have complained about safety issues as well, specifically citing the company's lost-and-found feature, which connects riders directly to drivers when they believe they left behind their belongings. While Uber has previously claimed that those lost-and-found numbers, provided by a third party, are dynamic so as to only allow passengers to contact drivers shortly after a ride to retrieve lost items, BuzzFeed News has found that they in fact persist, and allow passengers to make contact with drivers long after a ride.
At 4:29 p.m. on Dec. 28, Laurie (who asked that BuzzFeed News not use her last name) picked up a passenger from the Apple Store where he worked, close to her home in the San Francisco Bay Area, and dropped him off a few miles away in Oakland. The ride, as most do, went off without a hitch. But about 30 minutes later, Laurie received a call from the passenger via Uber's lost-and-found feature, who said he lost his cell phone and needed it immediately.
Laurie initially offered to bring it to the Apple Store where he worked first thing in the morning. But he insisted that he needed it right away, so Laurie offered to bring it to his home, where she had dropped him off. She arrived at 7:30 p.m. and knocked several times, rang the bell, and asked other tenants in the building where he was, but there was no answer. The area, she told BuzzFeed News, was "dark" and "weird."
Before giving up, she emailed Uber seeking advice and guidance. Uber currently provides neither drivers nor riders a number to call, leaving both parties without any option but to interact directly or email the company. When no one answered right away, she returned to her home. Within an hour, the customer was back in touch again.
"About 8:30 p.m. he called me and he said, 'I thought you were coming to my home,'" Laurie told BuzzFeed News. "You could tell he had been drinking, but he was definitely slurring his words; it was not the careful speech I noticed during the ride. He said, 'I need my damn phone.' I said, 'I just left your house and I'm home now. I can bring your phone first thing in the morning.' He goes, 'I know where you live. I found my iPhone, I know everything.'"
She emailed Uber again at 8:52 p.m. with the following: "Passenger called me to say he is coming to my home to get his iPhone. I want to get him his iPhone but I am uneasy with this plan. Please advise. I have received no reply to my note below from you."
Frightened, Laurie eventually offered again to take the phone to the Apple Store first thing in the morning, but the passenger said he could not wait that long. Unsure of her options, Laurie relented and told the passenger that if he was going to pick it up from her home that night he had to come immediately. She also set ground rules for the transaction, telling him to be on time and to stay in his vehicle so that she could bring the phone out to him upon his arrival.
"He didn't come until quite a bit later and he pounded on the door. I got my husband and he stood behind the door with a Taser." When she at last opened the door, the passenger simply took the phone and walked away, she says.
Laurie told BuzzFeed News she suspects that her passenger had used Uber's lost-and-found service, which gives passengers an anonymized Twilio number that forwards to the driver's Uber phone. She then surmised that he used the Find My iPhone app on his phone to pinpoint her location.
Here are screenshots from Laurie's exchange with Uber:
Although unharmed, Laurie reported feeling threatened and uncomfortable and was bewildered by Uber's lack of response during this tense moment. She did not receive a response from the company to any of her emails until 9:21 p.m.
Here's the response:
Laurie responded and asked Nicole, the Uber support staffer who emailed her, whether she gave the driver her home address or her Twilio number, which is an anonymized phone number used by the company so that passengers can contact them in the event of a lost item or problem with service. This number is assigned to each driver. Drivers also use this same number — which acts as a switchboard — to contact a passenger once the driver accepts a ride request. Laurie received a response at noon the next day.
The email read:
In her first email to Uber, Laurie indicates that she gave the passenger her personal phone number after he called her on her Uber phone, because she wanted to assure him that she would return his phone. Nicole from Uber indicates that the passenger did not reach out to support for Laurie's number. But it is unclear how else a passenger could get ahold of a driver's number unless the driver called or texted the passenger before the ride — which Laurie said she didn't.
"I didn't know anything about Twilio numbers at the time, so I figured he already had my private number to call me (and text me for that matter), since he had already called," Laurie said. "One of the problems was that was the first time that I even knew that I was reachable. I was not told when I signed up for Uber that they were going to give my passengers a way to access me, really forever, because once they have that number they can call it whenever."
The lost-and-found feature that Uber provides is certainly a convenience for passengers who leave behind their belongings. If a passenger loses an item, they can go back to their electronic receipt of the ride they believe they lost their item during and click the link that reads "Lost something?" This will then direct them to a form which Uber responds to via email and includes the driver's Twilio number. Both Uber and Lyft use Twilio to provide a means to contact drivers through an anonymized number.
However, Laurie provided BuzzFeed News her Twilio number that she saved to her phone on Jan. 2. BuzzFeed News called that number on Jan. 31. Laurie picked up the call.
"[Lyft and Uber] use Twilio numbers to make the communications anonymous," Twilio spokesperson Kay Kinton told BuzzFeed News. "Each company decides when to deactivate the number associated with any given ride."
Earlier this month, Uber released a review of its privacy program conducted by a partner at Hogan Lovells, Harriet Pearson. In it, Pearson states: "Uber has dedicated significantly more resources to privacy than we have observed of other companies of its age, sector, and size." The study only assesses the company's privacy policy as it relates to consumers and does not mention drivers.
"Our commitment to protecting rider and driver privacy is fundamentally the same so while the report focuses on consumer privacy we just have different sets of data for consumers versus drivers," Katherine Tassi, Uber managing counsel of data privacy, told BuzzFeed News.
When BuzzFeed News asked about the Twilio numbers specifically, Tassi stressed that the numbers disappear after a short window of time. "I just want to be perfectly clear it's always an anonymized number; it shouldn't be that you could continue to be able to reach the same driver two weeks later," Tassi said.
However, when BuzzFeed News cited complaints that numerous drivers' numbers did not disappear, the company said it would look into the situation. However, following this BuzzFeed News investigation, Uber now states that the anonymized number remains static and is in fact not deactivated.
"Our riders greatly appreciate being able to call their drivers before or after a trip to coordinate a pickup or track down lost items," Uber spokesperson Kristin Carvell told BuzzFeed News. "Driver numbers are anonymized. If a rider chooses to contact their driver, they will continue to have access to the anonymized number. In the event that a rider abuses this functionality and a driver complains, we will of course reset the driver's anonymized number — meaning no prior riders would be able to contact them anymore."
Laurie's experience doesn't appear to be an anomaly. Marty McCall, a female Uber driver in Dallas, told BuzzFeed News a male passenger called her six or seven times long after she had dropped him off using the number that Uber provided to the passenger.
"After midnight, I was driving down the freeway and got a phone call from a number that I didn't recognize," McCall told BuzzFeed News. "It was a guy that was kind of drunk, and he said, 'I just wanted to see if you made it home OK. What are you doing? Do you want to come by my house?' I said, 'I appreciate the call, but you know our transaction is over. But thanks for calling and have a nice evening.'"
He continued to call her several more times that night, McCall said. The last time he called, he left McCall a voicemail calling her an "asshole." "I was really scared. I have little faith in Uber's safety practices," McCall said. "I really do. Unfortunately that guy could call me back again on that same number. That number does not go away. Uber tells you it ceases 24 or 48 hours after. He could call me a week from now and if you didn't answer your phone it [gets redirected] to your personal phone." McCall's number is also still active.
Unnerved, McCall went to her nearby Uber office and showed them the calls and the voicemail the passenger left her. "They said they were very sorry that happened, but I said what they need to do is deactivate that passenger." As a policy, Uber did not say whether they'd deactivated the passenger.
Another female Uber driver who goes by Raquel on the driver forum Uberpeople.net has also claimed to have been subject to harassment via the lost-and-found feature. In screenshots she posted to the public forum, Raquel shows texts from a passenger who admits to using the feature to get her number for personal reasons.
BuzzFeed News did not have direct contact information for Raquel but reached out to her through other drivers who knew her, but Raquel has not responded to interview requests.
A passenger admits to Raquel that he used the lost-and-found feature to get her number.
According to Raquel, she reached out to Uber regarding the incident and reported receiving this response:
Shauna from Uber (Uber)
Hello Raquel,
I'm very sorry to hear that you had this type of experience while driving on the Uber platform. It is strictly against our policy to release personal contact details for any reason, outside of a judical order. If this was done it was most certainly in error. I have rerouted your ticket to our Incident Response Team. As part of their investigation, they will be contacting you along with the account holder. Thank you for your patience while we work to resolve this issue for you! Due to our privacy policy, we cannot share with you the outcome of this investigation, however, please know that Uber takes issues like this very seriously and based on the team's findings, appropriate action will be taken.
Sincerely,
Shauna
The privacy assessment Uber hired Hogan Lovells to conduct was done in response to a flurry of consumer-privacy-related incidents late last year, and Tassi told BuzzFeed News she could not project whether the company will commission an audit of driver privacy policy in the future.