Fraudsters are flogging an 'unlimited' number of stolen Uber accounts containing personal details and limited credit card data for less than $5.
The accounts are being flogged on Tor hidden service AlphaBay and have forced the taxi company to investigate a possible breach. Credit cards in the stolen accounts thankfully only show the last four digits.
Uber told Motherboard there is no evidence of a breach.
Crim vendor Courvoisier has sold 144 accouts since March 18 and more than 3,000 in total.
Purchasing one of the accounts will provide a username and password, which in at least some cases had not been changed, according to some victims.
For another $1.87 punters can buy a guide to avoid being caught. "In a few simple steps you'll be cabbing around in no time, and so far, this hasn't failed," the vendor listing claims.
Other vendors selling Uber accounts are also claiming 100 percent validity for the supplied email address and password, and still others offer to supply accounts for specific geographies.
It is unknown how the accounts are stolen but vendor Courvoisier is an accomplished carder having acquired the skills to steal credit cards en masse.
Courvoisier is also selling stolen Netflix accounts for 50c and Vodafone UK account upgrades in what appears to be a bid to recoup losses when the owners of the Evolution drug marketplace on the Tor network cut and run with cash. ®