FBI Warns of FaceStealer Video-Call Thefts, and Uber Reports a Driver-License Incident

Sunday, November 15, 2026 · 3:33 episode

This is Scams and Breaches Daily, a weekday briefing on consumer scam alerts and data-breach notices, with one concrete action.

The Justice Department and the FBI say a scheme called FaceStealer uses fake video meetings and a phony technical "fix" to install malware, and that it has stolen more than $400 million in cryptocurrency in the last 18 months. A notice Uber Technologies filed with state attorneys general, including a November 10 filing on the California Attorney General's public list, says driver's-license images and related personal information were involved after a service provider's credentials were used to reach Uber data.

No new FTC or FBI IC3 alerts were dated November 14 or 15. This edition features the FaceStealer action announced November 12, the Uber notice reported November 10, and two still-active FTC alerts published November 10.

Official alert: FaceStealer video-meeting scheme

On November 12, 2026, the Justice Department announced coordinated action against cryptocurrency theft attributed to North Korea, including the seizure of infrastructure used in a social-engineering scheme the FBI calls FaceStealer.

The Justice Department and an FBI Internet Crime Complaint Center FLASH dated November 12 say FaceStealer has stolen more than $400 million in cryptocurrency over the past 18 months. According to those official documents, invitations to video meetings arrive from accounts taken over from earlier victims. Once a target joins, the hosts play a recorded webcam video of someone the target knows, or a deepfake of a well-known person, so the call looks familiar. They then invent a technical problem — for example, claiming the target cannot be heard — and offer a link or prompt to "fix" it. That "fix," the agencies say, installs malware. The FBI says it has seized more than 900 webcam videos used to impersonate victims later, and that in some cases money or accounts were taken months or more than a year after the first infection.

The FBI attributes the scheme to North Korean state-sponsored hackers and says it has mainly targeted people in cryptocurrency and web3, and is also being used against people who maintain open-source software.

The FBI's advice, in that FLASH, includes joining the meeting in the official Zoom or Teams app with an invite code rather than clicking a link to a web version, especially if the invitation comes from someone you do not hear from often; leaving your camera off until you can see, hear, and talk with the person who invited you; and not running a script or pasting code because a prompt told you to "update" the app. If you think you were tricked, the Internet Crime Complaint Center says to file a report at IC3.gov with the keyword FaceStealer. The Justice Department also points to fbi.gov/facestealer.

Also this week: two FTC alerts still in effect

On November 10, 2026, the FTC published How to spot fake FTC websites and FTC impersonators. Real FTC websites, it said, always end in .gov, including ReportFraud.ftc.gov.

The same day, the FTC published A Veterans Day reminder on how to spot scams on social media (8:40 a.m. New York time). The agency said scammers use details in a veteran's social-media profile to pitch fake grant programs or to pose as the U.S. Department of Veterans Affairs, and that the VA will never message you on social media. The FTC says to verify VA-benefits offers at VA.gov and to report scams that target veterans at VSAFE.gov or by calling 833-38V-SAFE.

Breach notice: Uber and driver's-license information

On November 10, 2026, Uber Technologies, Inc., appeared on the California Attorney General's public data-breach list, with a listed breach date of October 7, 2026. The submitted notification page is on the Attorney General's site.

In an official November 10 letter to the Iowa Attorney General, Uber said a service provider told it on October 9, 2026, that an unauthorized third party had compromised the provider's internal credentials and used them to access Uber's account with that provider. Uber said it severed those data connections and that, on October 13, its investigation determined the credentials had been used on October 7 to access Uber data containing personal information. According to that letter, the information involved included images of driver's licenses and extracted text data, including name, address, date of birth, and driver's license number. Uber said the provider's credentials did not provide access to other Uber systems, that it has not identified any misuse of the data to date, and that the investigation remains ongoing. Notifications to affected people were set to begin on November 10, 2026. The official letters say "a service provider"; they do not name the provider.

One action

If you received Uber's letter, review your account statements and free credit reports, and report suspicious activity to the companies that issued those accounts. Uber is offering free credit monitoring and fraud assistance through Cyberscout. The letter says to enroll at mytrueidentity.com within 90 days of the date of the letter, using the activation code printed there. Questions can go to the number in the notice, 1-866-317-7961, Monday through Friday, 8 a.m. to 8 p.m. Eastern Time, excluding holidays. If you think your information has been misused, start at IdentityTheft.gov. Free annual credit reports are at AnnualCreditReport.com.

Sources

That's Scams and Breaches Daily. Links to every source are in this episode's description, in the list above. For all of it in your inbox, sign up for the free daily email at scamsandbreachesdaily.com/subscribe.