A ride-hailing account is a payment account with a location history. Signup asks for a name, email address, phone number and payment method, and the app records every pickup, drop-off, date, time, distance and fare. It receives the receipts, trip confirmations, password resets and change notices. The practical protection is one alias per ride app, tied to a personal inbox, with no work or university address used at signup.
Data collected by ride-hailing apps#
Uber's privacy overview lists account information (name, email, phone number, payment method, profile picture) and trip information (payment details, amount charged, date and time, requested pickup and drop-off addresses, distance travelled). Location data is collected from ride request until completion, and while the app runs in the foreground. Precise location data from a driver's device during a trip is linked to the rider's account, even when the rider has not enabled precise location collection.
Lyft's privacy policy describes the same categories: account creation collects name, email address, phone number, birth date and payment information, and ride information includes date, time, destination, distance, route and payment. Lyft retains transactional information such as rides and payments for at least seven years, for accounting and tax purposes.
| Data | Examples |
|---|---|
| Account details | Name, email, phone number, payment method |
| Trip details | Date and time, pickup and drop-off addresses, distance, fare |
| Location | From ride request until completion |
The email address is the account key: the app uses it for receipts and trip summaries, account change confirmations, and password reset links. A rider who loses access to that address loses the main route back into the account, and the choice of address at signup carries more weight than it appears to carry at the time.
Ride-hailing breaches#
Ride-hailing email addresses have already been exposed at scale by two of the largest apps in the sector. The email address was among the first fields taken in both cases, because it sits in the account record next to the name and phone number. The trip data taken in the Careem case is the second risk: a ride account holds a record of where the account holder travels and when. An address exposed in either breach can be used for phishing mail naming the app, the city and the trip.
Uber breach of 2016#
In October 2016, two people outside Uber accessed user data stored on a third-party cloud service the company used, including the names, email addresses and mobile phone numbers of 57 million riders and drivers in total, including around 600,000 drivers in the United States whose licence numbers were also taken. Uber did not disclose the incident until November 2017, more than a year later, and paid the two people $100,000 in exchange for assurances that the data had been deleted.
Uber's chief executive at the time, Dara Khosrowshahi, stated in the disclosure that there was no indication trip location history, credit card numbers, bank account numbers or dates of birth had been downloaded. The disclosure is covered in detail by eWeek and by The Hacker News.
In September 2018, Uber agreed to pay $148 million to settle with the attorneys general of all 50 US states and the District of Columbia, the largest multi-state data breach settlement at the time. The settlement is described by the Jeffer Mangels Butler and Mitchell cybersecurity team and by the Business Times. The UK Information Commissioner's Office fined Uber £385,000 and the Dutch Data Protection Authority fined it €600,000, as reported by National Technology News.
Careem breach of 2018#
Careem, the ride-hailing service operating across the Middle East, North Africa and South Asia including Pakistan, disclosed a breach on 23 April 2018. Careem became aware on 14 January 2018 that criminals had gained access to its systems and took the names, email addresses, phone numbers and trip data of 14 million customers and 558,000 drivers. Careem stated that passwords and credit card details were held on a separate third-party server and were not taken. The disclosure is reported by Dawn and by Gulf News.
Signup address risks#
Most riders sign up with the address already used everywhere else, which creates three problems, the first being correlation: the same address on a ride app, a bank account, a shopping account and a social account lets any one breach connect the accounts together, and a list of addresses from a ride app breach is also a list of people who use that app in the cities where it operates. A separate address for every service breaks that link, because each service holds a different address.
The second problem is the work address. A work or university address belongs to the employer or the institution, not to the account holder. It is deactivated when employment ends or the course finishes, and later mail to it goes nowhere. A ride account registered to that address then has no working recovery address. Password resets, account change confirmations and support replies all fail, leaving the rider to prove ownership through support with a phone number and a payment method as the only remaining links. The same reasoning applies to banking and other long-lived accounts, so the question of whether a second email address is needed is best answered before signup, not after a lockout.
The third problem is volume. Ride apps send a receipt for every trip, plus promotions and service updates. On a main personal address that mail mixes with everything else, and a compromised address means the spam and phishing that follows a breach lands in the inbox that matters most. A dedicated address keeps that mail in one place, where it can be filtered, muted or cut off.
A ride account on a work address should be moved to a personal address or a dedicated alias while the work address still works, because recovery then depends on the phone number and the support process.
One alias per ride app#
The setup is one alias for each ride app, each forwarding to the same personal inbox: Uber gets one alias, Lyft gets another, Careem gets a third. The addresses differ, the inbox is the same, and the rider reads all of the mail in one place.
If Uber is breached, the exposed address is the Uber alias, which no other service holds, so it reveals nothing about the rider's other accounts. The alias can be paused or replaced, and the Uber account can be moved to a fresh alias. The recovery path stays open as long as the alias forwards to an inbox the rider controls.
Receipts and trip confirmations arrive at the ride alias, and a filter there sorts them into a folder or labels them without any rule touching the main inbox. If one app starts sending unwanted mail, that alias can be paused while the others keep working. The guide to what to do when an alias starts getting spam covers the steps for an alias that starts attracting spam.
Email two-factor codes also work through an alias, forwarding to the destination inbox like any other message. The guide to receiving two-factor codes at an email alias covers the timing and the cases where an app insists on SMS. An alias does not replace a password or a second factor; it limits what a breach exposes. Credential stuffing still works when a password is reused across services, whatever address is on the account, so a unique password for the ride account matters as much as the address does.
Some apps reject alias addresses at signup, usually targeting the domain rather than the alias itself. The guide to services that refuse alias addresses explains the common causes and the workarounds. When an app refuses the alias, the fallback is a dedicated personal address used only for that app, kept separate from the main address.
Changing the address on an existing account#
A rider who already signed up with a personal or work address can change it in the app's account settings without creating a new account, and the app verifies the new address before the change takes effect.
Uber's help pages describe the process: the rider opens the app menu, taps Settings, taps the bar showing name, phone number and email, chooses the information to change, makes the change and saves. Uber sends a confirmation code to the new email address for entry in the app. A notification email goes to the old address, as described on Uber's help page for updating a phone number or email.
The order of steps matters. The new alias is created and tested before the change, with a test message confirming the forwarding works, so the verification code arrives somewhere the rider can read it. Only then is the address on the ride account changed, with the old address left in place until the new address is confirmed, because the confirmation code goes to the new address and the notification goes to the old one.
Account recovery and two-factor codes#
The email address on a ride account is also the recovery address: a forgotten password is reset through a link sent to that address, and a changed phone number is confirmed through a code sent to it. A rider who can no longer read mail at that address has lost the simplest recovery route. The account then depends on support verification.
The guide to email aliases and account recovery covers the general rules. The alias must forward to an inbox the account holder controls, and the destination inbox must stay accessible. The alias is only as reliable as the inbox behind it, so a destination inbox with its own two-factor authentication and a recovery method is part of the setup.
A rider who suspects the address on a ride account has appeared in a breach can check it against Have I Been Pwned, which lists the Uber 2016 breach. A match does not mean the ride account was taken over, but it does mean the address is in circulation, and it is a reason to change the password and move the account to a fresh alias. The guide to email breaches and password breaches covers the difference between the two.
Aliases from AliasFleet#
AliasFleet provides managed, persistent email aliases that forward to a verified destination inbox. A rider creates one alias per ride app, for example one for Uber and one for Careem, each forwarding receipts, trip confirmations and password resets to the same inbox. An alias that starts receiving spam can be paused without affecting the others, and a breached alias can be replaced while the account moves to a fresh address. AliasFleet does not store the rider's password, does not replace two-factor authentication, and does not prevent a ride app itself from being breached. It keeps the address on each account separate. A breach of one app does not expose the address used for the others. Pricing starts with a free tier of 10 active aliases.
Limits of the approach#
An alias is not a complete protection for a ride account. The app still holds the phone number, the payment details, the location history and the trip record, and none of that changes when the email address changes. A breach of the app exposes the trip data regardless of which address is on the account, as the Careem case showed. The alias limits the exposure of the email address itself and keeps the rider's accounts from being linked through a single shared address. It does not stop the app collecting the data, or phishing mail that uses details from a breach. The remaining controls are a unique password, two-factor authentication where the app offers it, and a check of known breaches. The guide to whether email aliases are safe covers what aliases do and do not protect against.
