lyft driver app can detect fake app location on my phone

Conversely, with high precision detection algorithms, security engineers can use challenges that add more friction but more cleanly stop malicious users. But in practice, neither is perfect, so we use both to correct for mistakes in the other.Ī low friction challenge enables security engineers to be more aggressive in their detection algorithm because they know that it will adversely affect fewer good users. If you have the perfect detection algorithm or the perfect user challenge, you don’t need both. An idealized, perfect user challenge identifies humans precisely, without adding friction to the flow. An idealized, perfect detection algorithm detects all of the bad actors every time. In this type of architecture, the detection algorithm and user challenge are complementary. If we can’t, then we give them an escape hatch where as a last resort they have the option to create a new account. If we can confirm that this person is who we think they are, then we log them in. Examples of identity challenges include retyping their email address or by entering their driver’s license number. If our detection algorithm determines that this login attempt is suspicious, we put the user through a login challenge to allow them to prove their identity. In the client, before the user logs in, we pass back to the server a number of signals to try to confirm that the login attempt is coming from the same human that we encountered previously. This figure shows how we collect additional information to decide if a login attempt is suspicious. In our architecture, there are three key components: client instrumentation to collect more data silently, a server-side algorithm that decides if an action in the product is suspicious, and a user challenge to collect more information in cases where the algorithm decides that the action (signup, login, or ride request) is suspicious.

Establishing individual ownership over payment instruments.Īll signals that we collect are an approximation of one of these fundamental properties, and when we’re looking for new signals, we cross-reference them against this list.

Identifying a returning human - that is, detecting the same human we have seen on our app previously.

Identifying automation or non-human traffic.

We focused our efforts on identifying three fundamental properties:

Our overall goal is to prevent account takeover, stop scripts and automated apps from accessing our servers, and minimize financial loss due to fraud.

Key contributors include Sam King, Will Megson, Steven Liu, Mike Ross, Ryan Choi, Ryan McGowan, Glen Robertson, Adam Wushensky, Donald Chen, Helen Lau, and Siwei Shen. This medium post is on joint work from the Fraud and Identity teams Lyft.

Lyft driver app can detect fake app location on my phone