- PayPal-owned app settles with FTC
- Privacy problems concerning auto-friending and public transactions
- Transaction speeds also criticised
PayPal’s peer-to-peer money transfers app Venmo has agreed to settle with the US Federal Trade Commission (FTC) over its failure to disclose accurately how quickly it grants customers access to funds and its neglect of customer privacy.
The FTC began investigating Venmo in Spring 2016 after complaints about its handling of privacy issues and the speed of its money transfers. The privacy issue arose in connection with Venmo’s auto-friending feature, which used a feed allowing customers to see what their “friends” had been up to, as well as another setting that made all customer transactions public by default.
The FTC also found that Venmo had not accurately disclosed to customers the true speed of money transfers. The platform connects to bank accounts and credit cards, allowing people to send money to each other via their smartphones, but Venmo failed to disclose that many of these are not instantaneous and are subject to review.
Customers who had attempted to transfer funds from the app to their bank accounts found that money they were relying on for immediate purposes to pay bills had been delayed due to the review process. On other occasions, people who sold items such as concert tickets had delivered them to their purchasers, believing that they’d been paid for via Venmo, only to find that the latter had in fact held or removed the payments, causing “real financial harm” in the FTC’s judgement.
Commenting on the Commission’s findings, its Acting Chairman Maureen K. Ohlhausen said: “The payment service also misled consumers about how to keep their transaction information private. This case sends a strong message that financial institutions like Venmo need to focus on privacy and security from day one.”
Venmo’s security came under heavy fire. The Commission found that the company didn’t have a written security policy until August 2014 (it launched in 2009 and was acquired by PayPal in 2015). Neither did it begin informing its customers that their email or password had been changed or that a new device had been added until March 2015. Unauthorised users were thereby able to extract funds before customers became aware that their accounts had been hacked. The FTC concluded that Venmo’s statements about offering “bank-grade security” were therefore misleading.
Customers were simply not properly informed about Venmo’s privacy settings. The app publishes customer transactions to their news feeds, but users were not clearly instructed how they could alter its settings to either ‘Private’ or ‘Friends Only’ instead of the default ‘Public’ setting. The FTC found that the company was in breach of the Gramm-Leach-Bliley Act’s Safeguards Rule which obliges finance organisations to put in place robust safeguards for protecting the “security, confidentiality and integrity of customer information”.
Venmo has agreed with the Commission’s verdicts and has 150 days to establish full compliance, including informing all customers – existing as well as new – how to limit the visibility of their money transfers using the app’s privacy settings.
Venmo issued a statement clarifying that the issues identified by the FTC predated its acquisition by PayPal.
It continued: “Since then, as a core part of PayPal’s and Venmo’s business and operations, we’ve taken steps to significantly strengthen our privacy and data security practices. The company will continue to invest heavily in programs designed to create better user understanding and to enhance privacy.”
