> Recently, Uber announced that another layer of security would be added. Users who want to pay in cash must also provide their date of birth and CPF.
Uber is under pressure to do something, so they did something that is both ineffective and frustrating!
Name + CPF + birthdate is not an effective security measure in Brazil because anyone can find a valid combination on the web. And visitors to Brazil obviously won't have CPF numbers, so this security measure is going to be a hassle for them.
I'll explain a little bit more about why the CPF is so easy to discover and misappropriate:
Brazilians are asked for their CPF number everywhere. (The CPF is the Brazilian equivalent of the U.S. social security number.) You're asked for it when taking an inter-city bus, special ordering a book at a bookstore, or signing the register in a building lobby. Birthdate is asked less often but still much more commonly than in the U.S. The reason is often not for security but to disambiguate people.
In Brazil, 10% of the population has Silva as a last name[1]. An incredibly large percentage of people have Maria, Ana, Jose, Joao as first names. If you're American, a name like "John Smith" sounds so common that it's the subject of jokes ("you made up that name?"), yet you might not actually know any John Smith's. But a Brazilian probably knows a bunch of Maria Silva's, Jose Da Silva's, and Ana DaSilva's.
You need a way to reliably differentiate between two Maria Silva's, so Brazilians ask for the CPF (and sometimes birthdate). And universities and governments regularly publish lists with peoples' full names and their CPF numbers to show graduations, admissions, fines, licensing info, whatever. All you need to do is google for <any name> + CPF, and you can find thousands of PDFs files with thousands of CPF numbers and birthdates (examples: [2][3]).
Furthermore, this is terrible for law-abiding visitors to Brazil because it becomes impossible to use services that demand a CPF number. For instance, as a visitor, you can't buy a ticket on any of the Brazilian airlines through the web[4]. The only exception is TAM (now LATAM) that has a portal for foreigners that charges 50-100% more than a Brazilian would pay for the same flight. I don't know how Uber has implemented their new security procedure, but I'm betting that it won't be convenient for visitors!
If your a tourist, you probably can pay via card in the app anyway. These cash options are for people where they don't have any kind of digital payment.
I've easily bought flights Rio-SP and to Iguaza with Expedia. Using airline's website is always a bad idea, anywhere. From broken JS to 500 web server, they just suck. Always use proper aggregator.
Oh, I beg to differ. Although airline websites are frequently awful, I always prefer to avoid a middleman if I can. There are things that can go wrong between an aggregator and the merchant. More than once in Brazil I've seen a guest arguing at the check-in counter of a hotel -- he's showing a printout of his payment through an aggregator and the hotel manager is saying that they never got the payment and that if he wants to stay, he'll have to pay again and take up the problem with the aggregator himself.
Airlines aren't like hotels. Aggregation systems are very mature and I never ever heard someone booking and not being able to fly. Plus the price is nearly the same. Plus you don't need to expose your CC to local airline website full of holes.
Uber is under pressure to do something, so they did something that is both ineffective and frustrating!
Name + CPF + birthdate is not an effective security measure in Brazil because anyone can find a valid combination on the web. And visitors to Brazil obviously won't have CPF numbers, so this security measure is going to be a hassle for them.
I'll explain a little bit more about why the CPF is so easy to discover and misappropriate:
Brazilians are asked for their CPF number everywhere. (The CPF is the Brazilian equivalent of the U.S. social security number.) You're asked for it when taking an inter-city bus, special ordering a book at a bookstore, or signing the register in a building lobby. Birthdate is asked less often but still much more commonly than in the U.S. The reason is often not for security but to disambiguate people.
In Brazil, 10% of the population has Silva as a last name[1]. An incredibly large percentage of people have Maria, Ana, Jose, Joao as first names. If you're American, a name like "John Smith" sounds so common that it's the subject of jokes ("you made up that name?"), yet you might not actually know any John Smith's. But a Brazilian probably knows a bunch of Maria Silva's, Jose Da Silva's, and Ana DaSilva's.
You need a way to reliably differentiate between two Maria Silva's, so Brazilians ask for the CPF (and sometimes birthdate). And universities and governments regularly publish lists with peoples' full names and their CPF numbers to show graduations, admissions, fines, licensing info, whatever. All you need to do is google for <any name> + CPF, and you can find thousands of PDFs files with thousands of CPF numbers and birthdates (examples: [2][3]).
Furthermore, this is terrible for law-abiding visitors to Brazil because it becomes impossible to use services that demand a CPF number. For instance, as a visitor, you can't buy a ticket on any of the Brazilian airlines through the web[4]. The only exception is TAM (now LATAM) that has a portal for foreigners that charges 50-100% more than a Brazilian would pay for the same flight. I don't know how Uber has implemented their new security procedure, but I'm betting that it won't be convenient for visitors!
[1] https://en.wikipedia.org/wiki/List_of_most_common_surnames_i...
[2] https://www10.trf2.jus.br/ai/wp-content/uploads/sites/3/2015...
[3] https://www.esteio.rs.gov.br/documents/Editais/secretaria/SM...
[4] http://brazilsense.com/index.php?title=Booking_a_domestic_fl...