Ola Passcode Security Risk - Exposé
This happened to me today. I have an Ola S1 Pro (First Gen). I have enabled OS updates to download and install automatically. I leave the scooter's Wi-Fi turned ON at all times, and I park it within my home's Wi-Fi range every single night. Typical of Ola Electric, I received a major OS Update from MoveOS 4 to MoveOS 5 — exactly ONE full year after its release.
Want to guess how I found out?
I tried to unlock my scooter with my Passcode on the touch screen and to my surprise it said Wrong Passcode. I checked with all the users at my house and no one had changed it. I tried unlocking the vehicle through the Ola mobile app (that I regularly use), only to find that the system had logged me out entirely. When I tried logging back in - "Unable to Connect Error Code G000." Even a clean app reinstall did nothing. I was entirely locked out of my own vehicle and couldn't even log in to the app to either unlock or to book a service appointment.
Enter Customer Support over the phone...
I called them, I explained and as expected, their solution was for me to tow or somehow transport the vehicle to the nearest service center. Even though I live just 3 kms away, they generously offered the additional option to use Ola’s RSA for a cool ₹2,999. When I pointed out that this was due to the manufacturer's software issue and that I wasn't going to pay for the RSA, I got the ultimate corporate shield: "Sir, but that’s our policy..." Even better? They couldn't guarantee a same-day appointment even for an emergency lock-out situation.
Why I refuse to go to my local service center without an appointment:
For context, the last time I walked in at 4 PM for a repair, they flat-out refused to take my vehicle on a walk-in basis because:
- Their Visionary CEO enforced a "24-hour turnaround time" under the banner of Hyper Service. The service center technicians, under extreme duress, flat out refused to accept new vehicles after noon just to keep their TaT in good standing.
- The center is primarily a sales outlet whose ground floor parking lot is a makeshift service bay that’s overflowing with scooters collecting dust in a limited space.
- The staff for once "genuinely cared" for my vehicle by warning me that if I left it overnight, there was a high chance of rat bite damage.
- Mind you, I'm one of their extremely pissed-off customers who waited for 3 months just for a chassis replacement under warranty - which they replaced under "Good Will" while still charging me around 20% of the cost.
So there I was, stranded on the side of the road (thankfully near my house) with a locked handlebar so I couldn't even push-tow it, looking at the possibility of multiple tow truck trips all because of a zero-guarantee of an appointment (walk-in or over the phone), all because of a major software bug by the manufacturer.
The "Ffaaaahhhh" Moment:
In absolute desperation, I remembered I had the personal number of a service center technician from my prior innumerable visits. I called him and initially, he told me to bring it in too. But after I practically begged him to think of an alternative, his supervisor chimed in with a random suggestion: "Ask him to try the default Passcode: 000 000." I tried and Ffaaaahhhh! - I heard the delightful Unlock Click and the Welcome chime.
And what was the very first thing that flashed on the screen? "Welcome to MoveOS 5."
Silently resetting security credentials back to a factory default after an OTA update, logging the user out of the app and not notifying the user is a shocking security nightmare! If you're randomly locked out of your Ola like me, try six zeros before paying the Ola tax!
Dear Bhavish, every time I think it can't possibly get any worse, you consistently find a way to lower the bar and surprise me. Every single time!