You got an Uber verification code you didn't request

An Uber code you didn't ask for means someone entered a working password on your account and got as far as the second step.

The obvious risk is the saved payment card. The one people miss is that an Uber account is also a record of where you live, where you work, and where you've been.

What to do

1. Change your password before anything else

Open the app or type the address yourself. Don't use a link from the message. Pick a password that isn't in use anywhere else, because the attacker got this one from a breach of some other service and is replaying it across a list.

2. Check your trips, including the ones that look ordinary

Open your trip history and read it. You're looking for rides you didn't take, which sometimes appear in another city entirely. Report anything unfamiliar through the app's help section so it's on record with Uber, then check the card on file for charges that don't match.

3. Remove saved addresses you don't need

This is the step specific to Uber. Your account likely has Home and Work saved, plus a history of pickup and drop-off points that describes your routine in detail. Someone in the account can read all of it.

Delete the saved shortcuts. The convenience isn't worth leaving your home address in an account that just had a login attempt against it.

4. Review payment methods and Uber Cash

Look for cards you didn't add and check your Uber Cash balance. Attackers who get into a rides account sometimes add their own payment method to make the account look normal, or spend a stored balance quickly. Remove anything unfamiliar and tell your bank if a charge went through.

5. Secure the email address on the account

Password resets go to that inbox. Change its password and check for forwarding rules or filters that someone else set up, which is the usual way access survives a reset.

6. Check Uber Eats too

The same login covers both. Look at recent orders and any saved delivery addresses, since food delivery is a common way to test whether a stolen account works.

Why you

The password came from a breach somewhere unrelated. Bots replay leaked pairs against popular apps at scale, and rides and delivery accounts are attractive because they carry a stored card and get resold cheaply.

What makes an individual account worth pursuing beyond the automated pass is context. A current phone number, an email address, and a home address let someone answer a verification question, sound convincing on a support call, or write a message that reads like it came from the company.

Data brokers and people-search sites publish that combination openly, assembled from public records and commercial data. It's legal, it's cheap to buy, and it's why a years-old leaked password can still be aimed at you specifically.

Delist finds those listings, files the removals, and keeps checking them, since brokers routinely repost profiles after they come down. Run a free scan to see what's published about you right now.

The broader pattern is covered in why you're suddenly getting 2FA codes you didn't request.

Frequently asked questions

Does this mean someone has my Uber password?

Almost certainly. Uber sends the code after a password is accepted. Change it on Uber and anywhere else you used the same one.

Can someone order rides on my card without the code?

Not through a new login. The risk is an existing signed-in session or a card that gets added later. Changing the password ends other sessions in most cases, and checking your payment methods closes the rest.

Someone called saying they were an Uber driver and needed a code. Is that real?

No. Drivers never need a verification code from you, and neither does Uber support. That call is an attempt to complete a login. Hang up.

Why does my account show a trip in a city I've never visited?

That usually means someone got in before you saw the code, or a previous compromise you didn't notice. Report the trip in the app, change the password, and check your card statement carefully.

Should I delete my Uber account?

Not necessary in most cases. Changing the password, clearing saved addresses, and removing unused payment methods addresses the realistic risk. If you'd rather close it, request account deletion in the app's privacy settings.