Exclusive: New surge in Divvy bike thefts traced to credit card fraud and docking station flaws, sources say

Two years after a docking device malfunction caused Chicago to lose hundreds of its taxpayer-owned Divvy bikes to thieves, the popular program is again battling rampant theft of its inventory, according to multiple city sources. 

Lyft, which manages the bike share program, is scrambling to correct multiple shortcomings in the system’s physical and financial security structures, the sources said. The sources, who all have direct knowledge of the situation, declined to be identified by name for this story.

The sources said Divvy is trying to stop two kinds of credit card fraud and multiple physical security shortcomings that thieves exploit to steal bikes.

Pressure built to fix the security loopholes after CWBChicago published video of an 82-year-old man being carjacked in Streeterville by a dozen young Divvy bike riders on July 26.

Following that incident, leaders of the 18th (Near North) Police District asked downtown Aldermen Brendan Reilly and Brian Hopkins to pressure the Chicago Department of Transportation (CDOT) and Lyft to fix Divvy’s security problems, the sources said.

Just three days after the carjacking, Reilly tweeted, “unsecured Divvy’s are abetting crimes, again. If they can’t secure their bikes, they aren’t welcome in #Chicago.”

On Tuesday, Reilly said he asked a Divvy worker how many bikes were stolen during this week’s looting.

“He told me, ‘oh, a couple hundred,’” Reilly tweeted. “He was busy retrieving Divvy bikes strewn around a looted storefront at the time.”

Hopkins has been less public with his concerns about the Divvy program.

Fraud

Pressed by the aldermen and increasingly bad publicity, CDOT and Lyft this month identified three theft methods for immediate correction:

  • Fraudulent use of credit cards at docking stations
  • Theft of bikes rented on pay-as-you-go debit cards
  • Ineffective docking station locks

Divvy’s “Buy a Pass” option allows non-members to rent bikes at docking stations with a credit card. People who use this option are required to enter their ZIP code. But Divvy’s security system has not been correctly comparing the ZIP codes people enter on the kiosk with the ZIP code associated with the credit card, according to sources. As a result, thieves have been able to use stolen debit and credit cards to take up to five bikes out of a station at one time.

A significant number of Divvy thefts have been tracked to pay-as-you-go credit cards, too, a source said. Theft via pay-as-you-go cards is so substantial, Divvy managers were considering a freeze on that payment method, according to a source. Like the ZIP code loophole, the pay-as-you-go shortcoming allows thieves to steal up to five bikes at a time. 

Thieves who exploit the payment security flaws have been keeping the bikes, selling them to gullible buyers, and — like the carjacking crew — dumping them on the street, according to sources.

Information about current docking station flaws was not readily available. However, the 2018 Divvy theft surge was made possible by a Divvy manager’s decision to remove a critical piece of security hardware from docking stations. The removed device had been making it more difficult for users to dock bikes at the end of their rides, but it also made stealing docked bikes more difficult.

CDOT and police records show that at least 12% of Divvy’s bicycle inventory was stolen between April 2018 and April 2019, CWBChicago reported last year.

In a separate story last September, we reported that Divvy bikes were still being stolen in significant numbers even after program managers said the critical piece of security hardware had been reinstalled on docking stations.

Police reports that documented Divvy thefts after the docking stations were supposedly fixed show that inventory was being stolen from trucks that are used to shuttle bikes and to perform repairs in the field.

A Streeterville resident who attended a recent community meeting told CWBChicago that local aldermen were ready to demand a “theft-proof” docking station design if Divvy cannot get a handle on rampant theft.

Silence

Neither CDOT nor Lyft responded to multiple emails from CWBChicago seeking comment for this story since July 31. We’re not the only ones who’ve been denied answers.

“I am currently working to address the Divvy theft issue,” Ald. Reilly tweeted on August 3. “Divvy needs to step-up to be a part of the solution. So far I’m not impressed with the bureaucratic responses, so I’ve escalated the issue at CDOT.”

The next day, Reilly tweeted again. “Looking forward to @DivvyBikes, @lyft & @ChicagoDOT getting back to us on that ‘bike theft fix.’ Divvy theft is rampant & stolen bikes are being used to commit other crimes. This must be addressed.”

“Abandoned Divvy bikes outnumber pigeons downtown these days,” Reilly continued.

Facts first. 100% reader-funded. Click here to support CWBChicago today.

About CWBChicago 6321 Articles
CWBChicago was created in 2013 by five residents of Wrigleyville and Boystown who had grown disheartened with inaccurate information that was being provided at local Community Policing (CAPS) meetings. Our coverage area has expanded since then to cover Lincoln Park, River North, The Loop, Uptown, and other North Side Areas. But our mission remains unchanged: To provide original public safety reporting with better context and greater detail than mainstream media outlets. Our editorial email address is news@cwbchicago.com