Millions of people have turned to mobile payments on their phones as a way of splitting pizzas, rents and the like, instead of having to pull out cash and pay the old-fashioned way.
Especially during this COVID-19 crisis, many are ditching the use of paper money, which can gather germs, and choosing to pay electronically. Peer-to-peer mobile payments is easier and cleaner than pulling out a credit card, instead, just open the app, choose the person and dollar figure, and click send.
The apps are all free, but some can come at a great cost.
What most people don’t realize is that when they pay their friends with them, in many instances they’re giving up valuable information about themselves that gets shared with a host of data companies, a process that happens in the background without the choice of opting in or out.
A review on behalf of USA TODAY has found that two of the most popular apps, Cash and Venmo routinely pass on personal information to third-party data firms.
Security researcher Patrick Jackson of security firm Disconnect, which makes apps to curb website tracking, monitored our phone as we made the transactions to find which apps were sharing.
Some 69.4 million U.S. people will use mobile pay this year, or 25.2% of shoppers, according to measurement firm eMarketer, growing to 80 million by 2023. People pay with apps linked to their debit cards and/or banking accounts.
Where our Venmo data went
Venmo, one of the leading payment apps with 52 million users, passes on user location (where you created the transaction) and the people we transact with to data firm Braze – even when transactions are made in “private” mode. Braze describes itself as a “customer engagement platform,” for “forging human connections between consumers and the brands they love.”
It also sent the contact information, per Jackson, to Emogi’s parent company, Holler.io, which creates animated stickers to accompany your payment and Pinpoint Secure Data Collector, and that rang some serious security bells to Jackson.
“Anti-fraud with your GPS coordinates? I don’t think that’s a fair trade-off,” says Jackson.
He’s not so sanguine on the stickers either. “Every time users send money with Venmo, whether or not they send an emoji or not (like in your case), Holler.io receives the user’s GPS coordinates. That doesn’t make sense at all.”
In response, Venmo-owned PayPal said in a statement, “We use personal data in order to provide our services, including to process transactions, resolve disputes, manage risk and protect against fraud, and we partner with select vendors on this work.”
Where our Cash data went
Meanwhile, the Cash app, which is owned by financial services company Square, sent data to firms that showed up in the transaction as app-measurement.com and mobileapptracking.com.
Cash is currently the most downloaded mobile pay app in both the Apple and Google app stores, way atop competitors like Venmo and PayPal Mobile Cash.
We asked Cash why it shared our data with other firms. Its response:
“Cash App sometimes use third-party services to analyze anonymous data about app usage to help us fix bugs, identify app crashes, understand marketing campaigns, and improve the customer experience. These services are common in the industry and we choose products that are designed with customer privacy in mind.”
Jackson says it’s not fair to consumers: “Allowing third-parties to keep track/attribute how a marketing campaign may or may have not succeeded in making a user download an app means all users now need to send their information to a third-party in order to make this determination.”
Where our PayPal data went
In our test with the PayPal app, it shared data with MParticle (a “customer data platform”), Crashlytics (a Google-owned firm for crash reports) and Deger.io, which received device info.
When we asked PayPal why it shared our information with these companies, it declined to answer, instead saying, “The Venmo and PayPal privacy policies describe the ways in which we are permitted to use personal data, which includes how we may share data with third parties to offer our services.”
How Facebook, Google and Apple did
Rivals Facebook and Google, which track us in the background routinely on a day to day basis, and Apple, which doesn’t, had clean person-to-person payments that didn’t send information to third parties, according to Jackson.
For Facebook and Google, “we really don’t know the full extent of how this data is going to be used,” says Jackson. “They know you pay these certain people, they know how much you paid, and that could generate certain kinds of offers or political targeting. We have to be mindful of what they collect from you, how it’s going to be used and whether it will be weaponized against you.”
Should we care about how public our transactions are?
A study of public Venmo transactions by Hang Do Thi Duc showed her the names, dates and transactions of users and she was able to learn a lot about them. “Did you know there is an app that makes it super easy to send money to your friends, your partner, your roommate or your drug dealer?” she says, in the study. “On Venmo, all transactions are public by default – anyone can see them, even if they don’t use the app.”
Venmo is all about promoting its platform as a different kind of social network. Instead of going on Facebook to see restaurant and movie recommendations from your friends, you use Venmo to see what friends are purchasing. Venmo’s two-word motto on its website: “Share payments.”
This form of “social sharing” is the future, a market many businesses want to be part of, says Richard Crone, who runs the Crone Consulting LLC firm, which advises firms on digital banking.
Indeed, on the screenshot offered on Venmo’s home screen to show what the app looks like, it touts public payments for such transactions as concert tickets, kayaking rental and splitting the rent.
So how do the apps make money? The person-to-person transactions are free, but they can take a few days for the money to get deposited from your bank. The apps charge fees, usually 25 cents, for faster access. Some also make money by offering unique credit cards or card payments that come with a merchant fee. In the case of Venmo, it’s also putting together merchant tie-ins to reach the sharing audience that let you pay at the register with Venmo.
“Word of mouth is the most powerful form of reference,” says Crone. So when a customer sees that their friend recently went to a restaurant and got a burrito, as noted in the Venmo app’s News Feed-like scroll of purchases by friends, “it incentivizes consumers to try that merchant out. People follow to see who’s buying what.”
Venmo spells it out to retailers on its website: “Behind every person who pays with Venmo is a network of friends who can view, like, and comment on a shared purchase, bringing your brand front and center in their conversations.”
But what most folks don’t necessarily sign on for is splitting an Uber ride and trading in their personal details to marketing companies.