Venmo app download screen on mobile. Image: FOOTAGE VECTOR PHOTO/Shutterstock
A recent study shows Venmo’s public API contains a lot of freely available user information.
Venmo is a popular money transfer app, which has about 7m active users on a monthly basis. According to a report released by coder and privacy researcher Hang Do Thi Duc, the app reveals a disturbing amount of private user details by default.
She said: “I used Venmo’s public API to download all public transactions of 2017, pulling in a total of 207,984,218 transactions. By looking through users and their transactions, I learned an alarming amount about them.”
Venmo, which is owned by payments giant Paypal, makes transactions viewable on a public feed unless users actively change preferences to make their histories visible only to friends or between two parties involved in a particular transaction.
The company’s API has been criticised before, as users have combed through the feed in the past to see if a partner is cheating on them, deducing this via the public transaction history.
Venmo history can reveal a lot about you
Do Thi Duc compiled the data she found into a series of stories, including that of a cannabis dealer in California. She was able to see 920 incoming payments for 2017, including messages referring to CBD (cannabidiol, an active ingredient in cannabis). She also found entire conversations between couples who had inadvertently made their arguments public.
The public-by-default feature was the subject of an investigation in 2017 by the US Federal Trade Commission (FTC), which accused the company of ‘misleading’ users about their requirement to change two privacy settings to make their transaction history completely private. Venmo now gives users three privacy options.
The company said its users have control over how much they share on the app. “The safety and privacy of Venmo users and their information is one of our highest priorities,” a spokesperson said. “Our users trust us with their money and personal information, and we take this responsibility and applicable privacy laws very seriously.”
Privacy by design
In Do Thi Duc’s view, a redesign should be considered. Addressing the firm, she wrote: “Why include all this information, when essentially the only interesting part is the message? If you – as a company – actually care about your users and their privacy, you would ask this [sic] kind of questions.”
While Venmo does provide these privacy options, they are finicky to change and are buried within the interface. Many other apps and platforms have been criticised for similarly poor privacy settings design and a lack of information about what is actually being shared. When firms assume all users are aware of what data is shared, some individuals who aren’t as tech-savvy may share intimate details of their lives without really knowing anything of the implications.
The rest of Do Thi Duc’s study can be viewed here.
Venmo app download screen on mobile. Image: FOOTAGE VECTOR PHOTO/Shutterstock
