15 ms·

Credit cards have a privacy problem

238 points by mlb_hn 7y ago

bradknowles 7y ago
While I do love me some privacy.com, unfortunately they only allow you to tie payments to bank accounts, not credit cards. So, it's a virtual debit card, not a virtual credit card. Now, they do let you set transaction limits, and daily/weekly/monthly limits, as well as either locking the card to the first merchant to use it or to make it a "burner" one-time only card. So, there's lots of additional controls there. They don't give you a good way to export any of that financial information, so if you want to use a budgeting program to try to help you track what is going where, then privacy.com doesn't help you there. Overall, I like privacy.com very much. I do want to be able to tie in multiple back-end payment sources, including credit cards, and I'd be fine taking the 2% or whatever fee on my end. And I do want more transparency in terms of being able to easily export my data where I want to use it. But those are both relatively minor problems, compared to the ones they do help you solve.
- danShumway 7y ago
  privacy.com comes up on HN a lot, and every time they do I try to take the time to point out they require a binding arbitration agreement with no opt-out. Arbitration agreements are bad in general, but not necessarily uncommon. What makes privacy.com different is that they have access to your bank account. They're in a position where they have direct access to your funds, and you can't bring them to court if they wrong you. I've had people suggest that I link privacy.com to a limited bank account and manually transfer money. That's a good suggestion, I'd probably do that no matter how they were set up. But that's not going to help if privacy.com takes you to arbitration over a bogus overdraft charge, or if they leak your credit card numbers, or if they start selling data behind your back. My bank doesn't have an arbitration agreement tied to my checking or savings account. I don't think it's justifiable for privacy.com to claim that they have more customer risk than my bank does. If a business includes an arbitration agreement in your terms of service, I immediately assume that they don't respect their customers. There are some businesses where I tolerate that, but I need a heck of a good reason -- especially if that business is going to be managing my bank account. Binding arbitration agreements are underhanded. The only reason to have one is because you want to make sure right from the start that you're not accountable to your customers.
  - drdaeman 7y ago
    > What makes privacy.com different is that they have access to your bank account. In my understanding, they have the account numbers and can do ACH withdrawals - just like someone who has your debit card number (but against a checking account, not a card). So I believe it's like every other transaction (or check) - there's an intentional (as I get it) processing period for a day or two, and you can always call your bank and request to not honor it. I could be wrong though. And actually, they can be associated with a debit card instead of a bank account - they've failed to associate with my bank, so I have had to go this route (and there's no way to switch it afterwards). Oh, and I totally agree that arbitration clauses without a way to opt out are disrespectful to say the least.
    - mindslight 7y ago
      One can't use the technical situation to escape the legal situation. If you dispute the ACH transaction, privacy.com could still claim you owe them that debt. They likely won't, being still subject to the court of public opinion. But it doesn't bode well that they're trying to escape the more direct avenue of accountability. (IMO the FAA is blatantly illogical and should be judicially nullified. But until that happens, we're stuck being on guard for these offensive customer-hostile terms)
  - m463 7y ago
    I believe you can opt-out of binding arbitration in california.
- jammygit 7y ago
  The privacy.com business promise is privacy, but their privacy policy (as of several years ago) did not actually promise much. I emailed them about it and they said they were surprised by the oversight. I wonder if they changed it
  - jammygit 7y ago
    > We may share data that is not personally identifiable with third parties > Cookies and Tracking Technologies: We and our partners use cookies or similar technologies to analyze trends, administer the website, track users’ movements around the website, and gather information about our user base, such as location information based on IP addresses They also transfer data in the case of a query about a sale. This would be a bit less awkward if the name of the company wasn’t “privacy”
- RcouF1uZ4gsC 7y ago
  In regards to privacy.com in my opinion, it would be very, very unwise to trust any venture capital funded startup to protect your privacy. What happens when their investors decide they aren't monetizing fast enough. They are sitting on a lot a private data that other companies would love to get their hands on. What is the downside to them of selling your information, and making a big exit, that left the founders wealthy? I would trust Apple a lot more since they already make money, and their reputation is something that they would be more likely to value more than a startup would be.
arfrank 7y ago
Will leave these here, just one small step to help you regain your privacy: * https://marketingreportoptout.visa.com/OPTOUT/request.do https://marketingreportoptout.visa.com/OPTOUT/request.do * https://www.mastercard.us/en-us/about-mastercard/what-we-do/privacy/data-analytics-opt-out.html https://www.mastercard.us/en-us/about-mastercard/what-we-do/...
- Naac 7y ago
  The Visa portal doesn't have very much information, can you explain what exactly I'm opting out of?
  - arfrank 7y ago
    It's linked from here: https://bb.visa.com/legal/privacy-policy-opt-out.html https://bb.visa.com/legal/privacy-policy-opt-out.html
- adtac 7y ago
  Did anyone else notice Mastercard's easily breakable captcha? It's just unmodified text with the same noise filter added to all codes. Perhaps there's opportunity here for someone to be Robinhood here and improve the privacy of a lot of people...
  - tomglynch 7y ago
    Good spot. That system seems very clunky.
  - kbenson 7y ago
    I'm pretty sure that's a good way to get the endpoint flagged as a target of abuse, and the page pulled until they can figure out what's going on, resulting in anyone who wants to opt-out after that point either running into a temporary or permanent problem, depending if they ever bother to put it back online. How about instead of fraudulently providing someone else's credit card because "we know best", we just make sure to spread the pages as much as possible where appropriate, and let people make their own educated choices (and hopefully it opens their eyes to other places in their lives they can do so as well). I understand the impetus to help, but it's important to consider that what one person views as helping another might view as terribly invasive in itself.
mehrdadn 7y ago
I've always wondered: is the data the reason why credit card companies are willing to give cash back as high as 5% even to customers who carefully operate them at a clear loss for them?
- TylerE 7y ago
  No. They make money on the swipe, and more money on the interest, if people don’t pay them off every month, and most don’t.
  - mehrdadn 7y ago
    But that's only like 2%. Why still keep around people who are clearly taking advantage of higher rates of cash back like 5% and not paying anything in interest though? What's the benefit of keeping them as customers?
    - mandelbrotwurst 7y ago
      It's closer to 3%, and I don't think there's a way to beat that on the cash back except on a per category basis. Also, a lot of folks end up carrying a balance in spite of their best intentions. I suspect this happens relatively often even for folks with a long history of not doing so - e.g. maybe you get fired for the first time and start running up a balance, not long before you've run up some significant interest charges.
      - mehrdadn 7y ago
        It's around 2% https://www.valuepenguin.com/what-credit-card-processing-fees-costs https://www.valuepenguin.com/what-credit-card-processing-fee... And then there's huge credit card bonuses like $150 for Chase Freedom which is like $7.5k of spending's worth... But again, that doesn't really answer my question. I very much realize lots of people do pay interest. But there are also people who don't, and possibly never have, for many years. I'm asking why do they keep those people around as customers if they're literally losing money on them? To me the obvious answer is they're still bringing value, and the only realistic form that can take as I see it seems to be their transaction data.
burner6565 7y ago
Summary? Wapo appears pay walled.
- singron 7y ago
  https://outline.com/fMCL96 https://outline.com/fMCL96
  - rambojazz 7y ago
    This link doesn't work either on Firefox ESR. > Something went wrong > We're sorry. This page failed to Outline.
    - benplumley 7y ago
      And their 'report a problem' link goes to a 403 page on form submit...
- dredmorbius 7y ago
  Incognito mode w/ JS disabled.
mLuby 7y ago
>"We don't sell your data, we share it." -all the companies involved Am I the only one thinking there might be some Clapper-level double-speak going on here? Why would these company share admittedly valuable data without being compensated? A question for contract lawyers: can I sell something (say an API or quarterly report) that "incidentally" includes customer data and get away with saying I'm not "selling customer data"?
- mehrdadn 7y ago
  Definitely not a lawyer, but "sell" to me implies you lose ownership afterward, so as long as they're not doing that, they're not selling. Easy to see how they can give someone your data without doing that.
  - dkersten 7y ago
    Are you saying that every single SaaS startup is selling anything because they don’t lose ownership when they provide a service in return for money? I think typically the exchange of money for a good or service is what we refer to as “selling” even if the seller doesn’t lose said service after selling it.
    - mehrdadn 7y ago
      No, I was merely referring to "selling" as it pertains to products, not services. Your data would be a product, not a service. They may build services around your data that use it in some way, but it'd be the service they'd be selling, not your data. Just like how Uber would be selling a ridesharing service, not your car.
      - sokoloff 7y ago
        If I sell to you the knowledge that the derivative of ln(x) is 1/x, I still have that knowledge. No different than if I sell to you knowledge of the fact that cardholder XYZ lives at 123 Main St, has phone number 555-867-5309, and shopped at Giant Dildos, LLC 3 times in the summer of 2019.
kccqzy 7y ago
I've discovered this problem by finding out that you can sign up for additional cash back on apps like Yelp and Dosh. When you make a purchase these companies will automatically determine whether this purchase is eligible for cash back. I'm guessing they must be buying the data for all my transactions for the purpose of figuring out whether they would give me cash back. It immediately made me suspicious since I'm getting cash back from a third party instead of from a bank.
- larrybud 7y ago
  +1. I’ve often wondered how these cashback services like the ones you mentioned, or, for example, the restaurant ones like aadvantage dining work. Do the affiliates get all your transactions? (I really hope not). Or, do the affiliates have agreements with the cc processors to flag transactions on their side?
  - zaroth 7y ago
    There seems to be no non-terrifying answer to this question.
    - astura 7y ago
      Depends on your definition of "terrifying." I dont personally care that some marketer knowns I purchased toilet paper then went to the tacorita on Tuesday; I'll gladly give that information away for $4.
  - vageli 7y ago
    > +1. I’ve often wondered how these cashback services like the ones you mentioned, or, for example, the restaurant ones like aadvantage dining work. Do the affiliates get all your transactions? (I really hope not). Or, do the affiliates have agreements with the cc processors to flag transactions on their side? Banks and lenders are heavily regulated in this area and often times the financial institution has absolutely no insight into the line-item level of the purchase. That data is at the prerogative of the merchant to disclose. If $RESTAURANT offers cash back on certain purchases made with them on a certain card, the merchant already has the data of the purchase and can determine if purchase qualifies for some cash back and notify the lender (at the expense of $RESTAURANT). Cards also follow patterns in the number scheme which would allow a merchant to determine card type and map that to current incentive offerings. By card type I mean more than just credit provider, down to the specific type of card (i.e. Sapphire Reserved vs Sapphire Preferred, etc).
deleted 7y ago
[deleted]
smcleod 7y ago
I wonder how this applies in Australia and New Zealand, our privacy laws prevent the use of credit card “Address Verification” for example.
skybrian 7y ago
Headline not proven. He claimed to do an experiment and didn't find any security hole or any real results, but then blathered on about what might have happened. I can read privacy policies and make up scenarios and so can you, but so what? And more generally, credit cards have been around a long time. Shouldn't there be more evidence by now if anyone is being harmed by sharing data about consumer purchases?
- paulie_a 7y ago
  Every single purchase line by line is recorded by many companies. And the security is absolutely terrible over all. If you don't care if your spending habits are shared that is fine. I don't want my data hacked further
  - astura 7y ago
    Then use cash?
    - vageli 7y ago
      > Then use cash? This is typically infeasible for online transactions.
- moksly 7y ago
  Credit cards work a little different in Denmark because we have a national debit card called the Dankort which allows for cheap credit and can be combined with other cards like visa or MasterCard. Anyway, some years ago banks opened for the possibility to get your receipts electronically. I opted into that, not thinking about privacy at the time, and they certainly have the data to track us in ways we that make Facebook look harmless, because Facebook doesn’t know your pharmacy purchase history. I’ve never seen an impact of this that I was aware of, so maybe banks don’t actually use the data. It’s certainly not their business model to sell advertising, but who knows.
tempsy 7y ago
Plaid is the most terrifying company in SV. The fact so many people are comfortable sharing their online banking creds with a third party, and in turn authorizing Plaid to share years of transaction data, your balances, emails, phone numbers, addresses etc scraped from your bank account is insane.
- X-Istence 7y ago
  The worst part is that certain banks won't let you link an account that Plaid claims is supported based upon the routing number/account number. So for example when I attempted to link based upon routing/account number at Simple, it told me I can't continue because I should hand over my account information for the other bank to Plaid instead. I've done it, and then immediately changed my account info. So yes, technically Plaid has my historical data, but at least they won't get it going forward. It really sucks though, because it locks my money into a singular bank otherwise.
  - hispanic 7y ago
    I was able to get around this by typing in a junk/non-existent bank name, which dropped me into the manual routing/account number option.
    - X-Istence 7y ago
      Yeah, I tried that... and then when I entered the manual routing number it's like "Hey, you need to login instead because this bank is known to us"
  - mindslight 7y ago
    I'm not arguing against the general idiocy of this, but the net effect should be to keep money away from such banks. My understanding of the ACH system is that it's best used in a "pull" manner, as if you're writing a check. Link your Simple account from another bank and initiate the pull from there. (Then work on transitioning your activity to the better bank while you're at it).
dehrmann 7y ago
Yup, do-no-evil Google buys your credit card data for advertising purposes: https://www.bloomberg.com/news/articles/2018-08-30/google-and-mastercard-cut-a-secret-ad-deal-to-track-retail-sales https://www.bloomberg.com/news/articles/2018-08-30/google-an... Companies need to start thinking of this less in the lens of "evil" and more principle of least astonishment. Would users be surprised and angry to learn you do this? Then don't.
- avocado4 7y ago
  > Google buys your credit card data for advertising purposes How do they connect my credit card data to my Google activity? My Google account isn't connected to my personally identifiable information in any way. I.e. they don't have my phone number, nor do I use Google Pay.
  - prawn 7y ago
    If you bought things online, couldn't they make guesses based on internet activity and things showing on a statement? e.g., maybe thousands bought x on a specific day, but how many bought x on that day, y on another, and z on a third day, all with corresponding research/signals when browsing?
  - nordsieck 7y ago
    > How do they connect my credit card data to my Google activity? Most people have a phone number with google for gmail (you didn't need one in the beginning, but do now). There's also their wallet, app store, voice, broadband, phone plan, etc. Some people will dodge all of that, but most won't.
    - dehrmann 7y ago
      Don't forget location data.
      - avocado4 7y ago
        Even if they do (for Android users only), how would they connect location data to my credit card history? Are you claiming that Google reverse engineers PII by correlating Android location data with credit card purchase location history?
FabHK 7y ago
I know, I know, the editorial staff is separate from the advertising/sales staff etc, but still find it funny that when I try to access the article in incognito mode, as I habitually do (for privacy), I get > We noticed you’re browsing in private mode. Private browsing is permitted exclusively for our subscribers. Turn off private browsing to keep reading this story, or subscribe to use this feature, plus get unlimited digital access.
- dredmorbius 7y ago
  Beyond annoying. Disabling JS bypasses for now.
  - FabHK 7y ago
    Thanks, does indeed.
- johnisgood 7y ago
  Disgusting. I avoid those kind of places like plague.
  - hyperbovine 7y ago
    Yes, isn't it revolting that they try and get people to pay for the content they spend money to produce? How dare they.
    - FabHK 7y ago
      Oh, I wouldn't even mind if they served me ads. But what they're saying is: We won't let you read our stuff unless we can track you (and see exactly what you read how long from where using which device, etc.)
      - Infinitesimus 7y ago
        "... unless you are willing to pay us for reading this content. In which case you've already paid for it so browse however you like"
reilly3000 7y ago
Purchase data has been around for years. Marketers want to know if their ad dollars worked. “How did you hear about us?” provides scant and mostly unusable data. By matching purchase data with ad campaign data there can be more quantitative evaluation of an ad campaign’s performance. Additionally I imagine this data is available for marketers to target buyers of Product X with Accessory Y. Finally, marketers may use purchase data to build suppression lists; ie. Stop retargeting people that already purchased Product X. I don’t know if this happens very often in practice. It’s very hard to do well in general, and generally cheaper to spam people than buy data to shrink your list. None of this is well-disclosed to consumers, not one bit of it is right. It just is, and it has been for going on for 8+ years.
zipotm 7y ago
Good morning
t0astbread 7y ago
I'm sure this is a great article that highlights an real issue but without executing JS the page doesn't show anything besides the logo and upon inspection of the HTML delivered by the server you can see that it's almost exclusively tracking scripts (at least in the EU).
Multicomp 7y ago
I wish Mondex would try again. Mondex was a MasterCard idea tried in the UK that was basically 'digitized cash in a wallet which has the form of a smart card'. Approach ATM, insert Mondex card. Feed ATM bills and coins, Mondex card gets loaded. Spend card, swipe as normal. Works offline, no connection to a bank account necessary, the money is deducted from your local card's 'account' to the 'account' on the POS/business. Your card records a transaction date/time/merchant for debits, theirs records the same for a credits. You can transfer funds from one card to another, cash out the card offline at supporting ATMs, be used for building access/RFID cards, hold up to 5 digital wallets on one card, and more. It was tried in the UK back in the 90s and NYC right in 2000 and worked about as well as you'd imagine in that world. But today, it would probably work much better. HK has the Octopus card which is conceptually similar and works well. I'd certainly give either a shot so I don't have to carry physical cash but also aren't worried about having my money in someone else's hands who can lose it all due to bank fraud or have IT issues preventing payment processing. https://en.wikipedia.org/wiki/Mondex https://en.wikipedia.org/wiki/Mondex https://en.wikipedia.org/wiki/Octopus_card https://en.wikipedia.org/wiki/Octopus_card
- JoshuaRedmond 7y ago
  I would guess that the money laundering potential is why it isn't around now - most stores don't let you buy a gift card with another gift card for the same reason (I've implemented this restriction in an e-comm site before). I might be wrong, but that's a potentially big legal hurdle.
Uhrheber 7y ago
Says the pot to the kettle.
ibps965 7y ago
IBPS Check all information regarding IBPS 2019. You can easily take information of IBPS 2019 Application Form, Admit Card, Result here. http://www.ibpsexamguide.in/ http://www.ibpsexamguide.in/
ubermonkey 7y ago
How do privacy-forward payment methods like ApplePay change the math?
jiveturkey 7y ago
This article is severely deficient and written to draw clicks. It doesn't go far enough (or at all, really) to explain that the credit card issuer doesn't see the data. They see a transaction amount. There's no banana. The current top comment about Google linking online to B&M purchases isn't a leak of privacy: it's strictly private both to Google and the merchant. You are being tracked, but not in a privacy-revealing way, just in an uber-annoying I'm-still-being-targetted so-it's-creepy-and-annoying way. That retail merchants are tracking you is a huge, huge problem. The CC facilitates this by linking all your purchases into a single history, but it isn't the CC per se that is the problem. eg the store's own rewards card specifically does this. They don't even care if you give your actual PII up to signup for the rewards card, all they care about is that they can [even anonymously] identify the purchase stream tied to an individual. They should go to length to better distinguish this problem because then they can get to the fact that every Apple Pay transaction is tokenized and not linkable to prior or future Apple Pay transactions.

238 points by mlb_hn 7y ago

While I do love me some privacy.com, unfortunately they only allow you to tie payments to bank accounts, not credit cards. So, it's a virtual debit card, not a virtual credit card. Now, they do let you set transaction limits, and daily/weekly/monthly limits, as well as either locking the card to the first merchant to use it or to make it a "burner" one-time only card. So, there's lots of additional controls there. They don't give you a good way to export any of that financial information, so if you want to use a budgeting program to try to help you track what is going where, then privacy.com doesn't help you there. Overall, I like privacy.com very much. I do want to be able to tie in multiple back-end payment sources, including credit cards, and I'd be fine taking the 2% or whatever fee on my end. And I do want more transparency in terms of being able to easily export my data where I want to use it. But those are both relatively minor problems, compared to the ones they do help you solve.

danShumway 7y ago
privacy.com comes up on HN a lot, and every time they do I try to take the time to point out they require a binding arbitration agreement with no opt-out. Arbitration agreements are bad in general, but not necessarily uncommon. What makes privacy.com different is that they have access to your bank account. They're in a position where they have direct access to your funds, and you can't bring them to court if they wrong you. I've had people suggest that I link privacy.com to a limited bank account and manually transfer money. That's a good suggestion, I'd probably do that no matter how they were set up. But that's not going to help if privacy.com takes you to arbitration over a bogus overdraft charge, or if they leak your credit card numbers, or if they start selling data behind your back. My bank doesn't have an arbitration agreement tied to my checking or savings account. I don't think it's justifiable for privacy.com to claim that they have more customer risk than my bank does. If a business includes an arbitration agreement in your terms of service, I immediately assume that they don't respect their customers. There are some businesses where I tolerate that, but I need a heck of a good reason -- especially if that business is going to be managing my bank account. Binding arbitration agreements are underhanded. The only reason to have one is because you want to make sure right from the start that you're not accountable to your customers.
- drdaeman 7y ago
  > What makes privacy.com different is that they have access to your bank account. In my understanding, they have the account numbers and can do ACH withdrawals - just like someone who has your debit card number (but against a checking account, not a card). So I believe it's like every other transaction (or check) - there's an intentional (as I get it) processing period for a day or two, and you can always call your bank and request to not honor it. I could be wrong though. And actually, they can be associated with a debit card instead of a bank account - they've failed to associate with my bank, so I have had to go this route (and there's no way to switch it afterwards). Oh, and I totally agree that arbitration clauses without a way to opt out are disrespectful to say the least.
  - mindslight 7y ago
    One can't use the technical situation to escape the legal situation. If you dispute the ACH transaction, privacy.com could still claim you owe them that debt. They likely won't, being still subject to the court of public opinion. But it doesn't bode well that they're trying to escape the more direct avenue of accountability. (IMO the FAA is blatantly illogical and should be judicially nullified. But until that happens, we're stuck being on guard for these offensive customer-hostile terms)
- m463 7y ago
  I believe you can opt-out of binding arbitration in california.
jammygit 7y ago
The privacy.com business promise is privacy, but their privacy policy (as of several years ago) did not actually promise much. I emailed them about it and they said they were surprised by the oversight. I wonder if they changed it
- jammygit 7y ago
  > We may share data that is not personally identifiable with third parties > Cookies and Tracking Technologies: We and our partners use cookies or similar technologies to analyze trends, administer the website, track users’ movements around the website, and gather information about our user base, such as location information based on IP addresses They also transfer data in the case of a query about a sale. This would be a bit less awkward if the name of the company wasn’t “privacy”
RcouF1uZ4gsC 7y ago
In regards to privacy.com in my opinion, it would be very, very unwise to trust any venture capital funded startup to protect your privacy. What happens when their investors decide they aren't monetizing fast enough. They are sitting on a lot a private data that other companies would love to get their hands on. What is the downside to them of selling your information, and making a big exit, that left the founders wealthy? I would trust Apple a lot more since they already make money, and their reputation is something that they would be more likely to value more than a startup would be.

arfrank 7y ago

Will leave these here, just one small step to help you regain your privacy: * https://marketingreportoptout.visa.com/OPTOUT/request.do https://marketingreportoptout.visa.com/OPTOUT/request.do * https://www.mastercard.us/en-us/about-mastercard/what-we-do/privacy/data-analytics-opt-out.html https://www.mastercard.us/en-us/about-mastercard/what-we-do/...

Naac 7y ago
The Visa portal doesn't have very much information, can you explain what exactly I'm opting out of?
- arfrank 7y ago
  It's linked from here: https://bb.visa.com/legal/privacy-policy-opt-out.html https://bb.visa.com/legal/privacy-policy-opt-out.html
adtac 7y ago
Did anyone else notice Mastercard's easily breakable captcha? It's just unmodified text with the same noise filter added to all codes. Perhaps there's opportunity here for someone to be Robinhood here and improve the privacy of a lot of people...
- tomglynch 7y ago
  Good spot. That system seems very clunky.
- kbenson 7y ago
  I'm pretty sure that's a good way to get the endpoint flagged as a target of abuse, and the page pulled until they can figure out what's going on, resulting in anyone who wants to opt-out after that point either running into a temporary or permanent problem, depending if they ever bother to put it back online. How about instead of fraudulently providing someone else's credit card because "we know best", we just make sure to spread the pages as much as possible where appropriate, and let people make their own educated choices (and hopefully it opens their eyes to other places in their lives they can do so as well). I understand the impetus to help, but it's important to consider that what one person views as helping another might view as terribly invasive in itself.

mehrdadn 7y ago

I've always wondered: is the data the reason why credit card companies are willing to give cash back as high as 5% even to customers who carefully operate them at a clear loss for them?

TylerE 7y ago
No. They make money on the swipe, and more money on the interest, if people don’t pay them off every month, and most don’t.
- mehrdadn 7y ago
  But that's only like 2%. Why still keep around people who are clearly taking advantage of higher rates of cash back like 5% and not paying anything in interest though? What's the benefit of keeping them as customers?
  - mandelbrotwurst 7y ago
    It's closer to 3%, and I don't think there's a way to beat that on the cash back except on a per category basis. Also, a lot of folks end up carrying a balance in spite of their best intentions. I suspect this happens relatively often even for folks with a long history of not doing so - e.g. maybe you get fired for the first time and start running up a balance, not long before you've run up some significant interest charges.
    - mehrdadn 7y ago
      It's around 2% https://www.valuepenguin.com/what-credit-card-processing-fees-costs https://www.valuepenguin.com/what-credit-card-processing-fee... And then there's huge credit card bonuses like $150 for Chase Freedom which is like $7.5k of spending's worth... But again, that doesn't really answer my question. I very much realize lots of people do pay interest. But there are also people who don't, and possibly never have, for many years. I'm asking why do they keep those people around as customers if they're literally losing money on them? To me the obvious answer is they're still bringing value, and the only realistic form that can take as I see it seems to be their transaction data.

burner6565 7y ago

Summary? Wapo appears pay walled.

singron 7y ago
https://outline.com/fMCL96 https://outline.com/fMCL96
- rambojazz 7y ago
  This link doesn't work either on Firefox ESR. > Something went wrong > We're sorry. This page failed to Outline.
  - benplumley 7y ago
    And their 'report a problem' link goes to a 403 page on form submit...
dredmorbius 7y ago
Incognito mode w/ JS disabled.

mLuby 7y ago

>"We don't sell your data, we share it." -all the companies involved Am I the only one thinking there might be some Clapper-level double-speak going on here? Why would these company share admittedly valuable data without being compensated? A question for contract lawyers: can I sell something (say an API or quarterly report) that "incidentally" includes customer data and get away with saying I'm not "selling customer data"?

mehrdadn 7y ago
Definitely not a lawyer, but "sell" to me implies you lose ownership afterward, so as long as they're not doing that, they're not selling. Easy to see how they can give someone your data without doing that.
- dkersten 7y ago
  Are you saying that every single SaaS startup is selling anything because they don’t lose ownership when they provide a service in return for money? I think typically the exchange of money for a good or service is what we refer to as “selling” even if the seller doesn’t lose said service after selling it.
  - mehrdadn 7y ago
    No, I was merely referring to "selling" as it pertains to products, not services. Your data would be a product, not a service. They may build services around your data that use it in some way, but it'd be the service they'd be selling, not your data. Just like how Uber would be selling a ridesharing service, not your car.
    - sokoloff 7y ago
      If I sell to you the knowledge that the derivative of ln(x) is 1/x, I still have that knowledge. No different than if I sell to you knowledge of the fact that cardholder XYZ lives at 123 Main St, has phone number 555-867-5309, and shopped at Giant Dildos, LLC 3 times in the summer of 2019.

kccqzy 7y ago

I've discovered this problem by finding out that you can sign up for additional cash back on apps like Yelp and Dosh. When you make a purchase these companies will automatically determine whether this purchase is eligible for cash back. I'm guessing they must be buying the data for all my transactions for the purpose of figuring out whether they would give me cash back. It immediately made me suspicious since I'm getting cash back from a third party instead of from a bank.

larrybud 7y ago
+1. I’ve often wondered how these cashback services like the ones you mentioned, or, for example, the restaurant ones like aadvantage dining work. Do the affiliates get all your transactions? (I really hope not). Or, do the affiliates have agreements with the cc processors to flag transactions on their side?
- zaroth 7y ago
  There seems to be no non-terrifying answer to this question.
  - astura 7y ago
    Depends on your definition of "terrifying." I dont personally care that some marketer knowns I purchased toilet paper then went to the tacorita on Tuesday; I'll gladly give that information away for $4.
- vageli 7y ago
  > +1. I’ve often wondered how these cashback services like the ones you mentioned, or, for example, the restaurant ones like aadvantage dining work. Do the affiliates get all your transactions? (I really hope not). Or, do the affiliates have agreements with the cc processors to flag transactions on their side? Banks and lenders are heavily regulated in this area and often times the financial institution has absolutely no insight into the line-item level of the purchase. That data is at the prerogative of the merchant to disclose. If $RESTAURANT offers cash back on certain purchases made with them on a certain card, the merchant already has the data of the purchase and can determine if purchase qualifies for some cash back and notify the lender (at the expense of $RESTAURANT). Cards also follow patterns in the number scheme which would allow a merchant to determine card type and map that to current incentive offerings. By card type I mean more than just credit provider, down to the specific type of card (i.e. Sapphire Reserved vs Sapphire Preferred, etc).

deleted 7y ago

[deleted]

smcleod 7y ago

I wonder how this applies in Australia and New Zealand, our privacy laws prevent the use of credit card “Address Verification” for example.

skybrian 7y ago

Headline not proven. He claimed to do an experiment and didn't find any security hole or any real results, but then blathered on about what might have happened. I can read privacy policies and make up scenarios and so can you, but so what? And more generally, credit cards have been around a long time. Shouldn't there be more evidence by now if anyone is being harmed by sharing data about consumer purchases?

paulie_a 7y ago
Every single purchase line by line is recorded by many companies. And the security is absolutely terrible over all. If you don't care if your spending habits are shared that is fine. I don't want my data hacked further
- astura 7y ago
  Then use cash?
  - vageli 7y ago
    > Then use cash? This is typically infeasible for online transactions.
moksly 7y ago
Credit cards work a little different in Denmark because we have a national debit card called the Dankort which allows for cheap credit and can be combined with other cards like visa or MasterCard. Anyway, some years ago banks opened for the possibility to get your receipts electronically. I opted into that, not thinking about privacy at the time, and they certainly have the data to track us in ways we that make Facebook look harmless, because Facebook doesn’t know your pharmacy purchase history. I’ve never seen an impact of this that I was aware of, so maybe banks don’t actually use the data. It’s certainly not their business model to sell advertising, but who knows.

tempsy 7y ago

Plaid is the most terrifying company in SV. The fact so many people are comfortable sharing their online banking creds with a third party, and in turn authorizing Plaid to share years of transaction data, your balances, emails, phone numbers, addresses etc scraped from your bank account is insane.

X-Istence 7y ago
The worst part is that certain banks won't let you link an account that Plaid claims is supported based upon the routing number/account number. So for example when I attempted to link based upon routing/account number at Simple, it told me I can't continue because I should hand over my account information for the other bank to Plaid instead. I've done it, and then immediately changed my account info. So yes, technically Plaid has my historical data, but at least they won't get it going forward. It really sucks though, because it locks my money into a singular bank otherwise.
- hispanic 7y ago
  I was able to get around this by typing in a junk/non-existent bank name, which dropped me into the manual routing/account number option.
  - X-Istence 7y ago
    Yeah, I tried that... and then when I entered the manual routing number it's like "Hey, you need to login instead because this bank is known to us"
- mindslight 7y ago
  I'm not arguing against the general idiocy of this, but the net effect should be to keep money away from such banks. My understanding of the ACH system is that it's best used in a "pull" manner, as if you're writing a check. Link your Simple account from another bank and initiate the pull from there. (Then work on transitioning your activity to the better bank while you're at it).

dehrmann 7y ago

Yup, do-no-evil Google buys your credit card data for advertising purposes: https://www.bloomberg.com/news/articles/2018-08-30/google-and-mastercard-cut-a-secret-ad-deal-to-track-retail-sales https://www.bloomberg.com/news/articles/2018-08-30/google-an... Companies need to start thinking of this less in the lens of "evil" and more principle of least astonishment. Would users be surprised and angry to learn you do this? Then don't.

avocado4 7y ago
> Google buys your credit card data for advertising purposes How do they connect my credit card data to my Google activity? My Google account isn't connected to my personally identifiable information in any way. I.e. they don't have my phone number, nor do I use Google Pay.
- prawn 7y ago
  If you bought things online, couldn't they make guesses based on internet activity and things showing on a statement? e.g., maybe thousands bought x on a specific day, but how many bought x on that day, y on another, and z on a third day, all with corresponding research/signals when browsing?
- nordsieck 7y ago
  > How do they connect my credit card data to my Google activity? Most people have a phone number with google for gmail (you didn't need one in the beginning, but do now). There's also their wallet, app store, voice, broadband, phone plan, etc. Some people will dodge all of that, but most won't.
  - dehrmann 7y ago
    Don't forget location data.
    - avocado4 7y ago
      Even if they do (for Android users only), how would they connect location data to my credit card history? Are you claiming that Google reverse engineers PII by correlating Android location data with credit card purchase location history?

FabHK 7y ago

I know, I know, the editorial staff is separate from the advertising/sales staff etc, but still find it funny that when I try to access the article in incognito mode, as I habitually do (for privacy), I get > We noticed you’re browsing in private mode. Private browsing is permitted exclusively for our subscribers. Turn off private browsing to keep reading this story, or subscribe to use this feature, plus get unlimited digital access.

dredmorbius 7y ago
Beyond annoying. Disabling JS bypasses for now.
- FabHK 7y ago
  Thanks, does indeed.
johnisgood 7y ago
Disgusting. I avoid those kind of places like plague.
- hyperbovine 7y ago
  Yes, isn't it revolting that they try and get people to pay for the content they spend money to produce? How dare they.
  - FabHK 7y ago
    Oh, I wouldn't even mind if they served me ads. But what they're saying is: We won't let you read our stuff unless we can track you (and see exactly what you read how long from where using which device, etc.)
    - Infinitesimus 7y ago
      "... unless you are willing to pay us for reading this content. In which case you've already paid for it so browse however you like"

reilly3000 7y ago

Purchase data has been around for years. Marketers want to know if their ad dollars worked. “How did you hear about us?” provides scant and mostly unusable data. By matching purchase data with ad campaign data there can be more quantitative evaluation of an ad campaign’s performance. Additionally I imagine this data is available for marketers to target buyers of Product X with Accessory Y. Finally, marketers may use purchase data to build suppression lists; ie. Stop retargeting people that already purchased Product X. I don’t know if this happens very often in practice. It’s very hard to do well in general, and generally cheaper to spam people than buy data to shrink your list. None of this is well-disclosed to consumers, not one bit of it is right. It just is, and it has been for going on for 8+ years.

zipotm 7y ago

Good morning

t0astbread 7y ago

I'm sure this is a great article that highlights an real issue but without executing JS the page doesn't show anything besides the logo and upon inspection of the HTML delivered by the server you can see that it's almost exclusively tracking scripts (at least in the EU).

Multicomp 7y ago

I wish Mondex would try again. Mondex was a MasterCard idea tried in the UK that was basically 'digitized cash in a wallet which has the form of a smart card'. Approach ATM, insert Mondex card. Feed ATM bills and coins, Mondex card gets loaded. Spend card, swipe as normal. Works offline, no connection to a bank account necessary, the money is deducted from your local card's 'account' to the 'account' on the POS/business. Your card records a transaction date/time/merchant for debits, theirs records the same for a credits. You can transfer funds from one card to another, cash out the card offline at supporting ATMs, be used for building access/RFID cards, hold up to 5 digital wallets on one card, and more. It was tried in the UK back in the 90s and NYC right in 2000 and worked about as well as you'd imagine in that world. But today, it would probably work much better. HK has the Octopus card which is conceptually similar and works well. I'd certainly give either a shot so I don't have to carry physical cash but also aren't worried about having my money in someone else's hands who can lose it all due to bank fraud or have IT issues preventing payment processing. https://en.wikipedia.org/wiki/Mondex https://en.wikipedia.org/wiki/Mondex https://en.wikipedia.org/wiki/Octopus_card https://en.wikipedia.org/wiki/Octopus_card

JoshuaRedmond 7y ago
I would guess that the money laundering potential is why it isn't around now - most stores don't let you buy a gift card with another gift card for the same reason (I've implemented this restriction in an e-comm site before). I might be wrong, but that's a potentially big legal hurdle.

Uhrheber 7y ago

Says the pot to the kettle.

ibps965 7y ago

IBPS Check all information regarding IBPS 2019. You can easily take information of IBPS 2019 Application Form, Admit Card, Result here. http://www.ibpsexamguide.in/ http://www.ibpsexamguide.in/

ubermonkey 7y ago

How do privacy-forward payment methods like ApplePay change the math?

jiveturkey 7y ago

This article is severely deficient and written to draw clicks. It doesn't go far enough (or at all, really) to explain that the credit card issuer doesn't see the data. They see a transaction amount. There's no banana. The current top comment about Google linking online to B&M purchases isn't a leak of privacy: it's strictly private both to Google and the merchant. You are being tracked, but not in a privacy-revealing way, just in an uber-annoying I'm-still-being-targetted so-it's-creepy-and-annoying way. That retail merchants are tracking you is a huge, huge problem. The CC facilitates this by linking all your purchases into a single history, but it isn't the CC per se that is the problem. eg the store's own rewards card specifically does this. They don't even care if you give your actual PII up to signup for the rewards card, all they care about is that they can [even anonymously] identify the purchase stream tied to an individual. They should go to length to better distinguish this problem because then they can get to the fact that every Apple Pay transaction is tokenized and not linkable to prior or future Apple Pay transactions.