4 ms·

A bit weird that my Monzo seems to be sending data to Facebook?

by m1 7y ago

Nextgrid 7y ago
Could you say more or provide a screenshot? I’m very curious and concerned about this.
- m1 7y ago
  It just says <number> interactions were received from Monzo.
- peteretep 7y ago
  For Revolut, I have many many entries like: ID 894103617218109 Event CUSTOM Received on 13 November 2019 at 09:51 The only event is "CUSTOM".
  - benhurmarcel 7y ago
    I use Revolut but my page is empty. I imagine it's because I don't have the Facebook nor Messenger apps installed on my phone.
    - petargyurov 7y ago
      Same here. I suspect most of the commenters on this post that are confused about how their data got acquired have the FB app and/or Messenger installed on their phones. I also suspect that soon Whatsapp will be doing the same sinister activity tracking once they go ahead with their plan to introduce ads later this year.
pirocks 7y ago
As far as I can tell almost every bank with an app is sending your email/advertising id/name/etc. to Facebook(+ other surveillance companies).
- m1 7y ago
  I have a couple of other bank accounts and none of the others seem to be sending data to Facebook.
threeseed 7y ago
Not really. They have the Facebook Pixel installed likely to do retargeting advertising when a person visits their website. It's one of the most effective methods so it's very common to see it everywhere.
- m1 7y ago
  This is related to their app not their website.
  - threeseed 7y ago
    Same applies to their app. Doing retargeting for when (a) someone downloads their app but doesn't signup and (b) someone is a customer but has low engagement i.e. is likely to churn.
    - djaychela 7y ago
      That may be true, but I still think it's a low-effort way for them to do it, and I expect better from Monzo than this. Plus it tracks people regardless of if they fit in a) or b) - neither of which is the case for me.
buro9 7y ago
Hmm, that feels incident worthy. My bank should send precisely zero things to advertising / marketing companies. Have you raised it with their Help team? You should. Unfortunately I cannot as I do not have a facebook account so cannot determine whether or not facebook hold data on me without creating an account.
- Nextgrid 7y ago
  Might be worth a post on their community.
  - ackshually 7y ago
    What do you mean by community? Like a Facebook community? Do you need an account to post on the facebook community?
    - Nextgrid 7y ago
      They have a Discourse forum: https://community.monzo.com https://community.monzo.com
- papln 7y ago
  You might (justifiably) not like it, and it might inspire you to boycott the business or plead for regulatory relief, but it's not an "incident" from their perspective to be intentionally doing what they do to run their business.
  - buro9 7y ago
    This is a bank, and they are regulated. Depending on the information shared, this may be a breach of that regulatory code. I do not have access to see what the data is, but would certainly in their shoes investigate with high priority, and Would raise a security incident to do so. If it turns out to be empty and of no concern, then great. But ignoring such things is seldom wise.
have_faith 7y ago
I saw HSBC
- djaychela 7y ago
  I didn't see HSBC, but I did see Monzo - which I was surprised and disappointed by. I see no legitimate reason for them to be connecting me to my (disused aside from messenger because of friends' network effects) facebook account. Not impressed.
rovek 7y ago
Relevant but not exhaustive: https://monzo.com/help/legal-stuff/information-facebook https://monzo.com/help/legal-stuff/information-facebook
oakesm9 7y ago
I have Monzo in my list too and downloaded the actual data. The only things listed are `ACTIVATE_APP` events. It doesn't seem to send any details to Facebook aside, from that you "activated" (opened) the app. Still not ideal, but not completely terrible.
- netsharc 7y ago
  When I used to have https://lua.xprivacy.eu/ https://lua.xprivacy.eu/ it used to prompt me a lot, saying "This app is calling this API, do you want to allow or deny? (or allow/deny for 1 minute or 10 minutes). The Facebook app would query what packages/apps are installed on the Android phone. Yeah, Android devs, why is that an accessible API call? For one thing this is how FB could figure out how popular their competitors like WhatsApp, Instagram or Snapchat were, and why they bought them, or tried to.
  - oakesm9 7y ago
    It's part of the Intent system in Android. It's a really nice system where you can say "someone open the file with this URL and mime type" and the system asks the user which app they want to use to open it (or use their default if they set one. It all works really well and lets app be loosely coupled to each other. It's also super flexible so you can use it for lots of different use cases. The API itself hasn't changed much since the first release of Android. The issue is that you can query the Intent system to see if there is an app installed that can open your Intent. On the face of it, this makes a lot of sense. You could then display an error message to the user asking them to install and app that can handle it. The problem is that you can create an Intent that you know can only be handled by a single app (using the package name) and then you'll know if it's installed or not. For what it's worth, iOS used to have exactly the same issue. You could query the phone could handle a specific "custom protocol scheme" (used for deep linking). You could then just query a scheme which you know is for a specific app and tell if the user had it installed. Apple fixed this by requireing you to include a predefined list of schemes which you can query for in your Info.plist (manifest file) and limiting the number you can have (30 I believe). All APIs with good intentions, but very easy to abuse. Apple is just more comfortable breaking backward compatibility to fix these sorts of issues.

A bit weird that my Monzo seems to be sending data to Facebook?

by m1 7y ago

A bit weird that my Monzo seems to be sending data to Facebook?

Nextgrid 7y ago

Could you say more or provide a screenshot? I’m very curious and concerned about this.

m1 7y ago
It just says <number> interactions were received from Monzo.
peteretep 7y ago
For Revolut, I have many many entries like: ID 894103617218109 Event CUSTOM Received on 13 November 2019 at 09:51 The only event is "CUSTOM".
- benhurmarcel 7y ago
  I use Revolut but my page is empty. I imagine it's because I don't have the Facebook nor Messenger apps installed on my phone.
  - petargyurov 7y ago
    Same here. I suspect most of the commenters on this post that are confused about how their data got acquired have the FB app and/or Messenger installed on their phones. I also suspect that soon Whatsapp will be doing the same sinister activity tracking once they go ahead with their plan to introduce ads later this year.

pirocks 7y ago

As far as I can tell almost every bank with an app is sending your email/advertising id/name/etc. to Facebook(+ other surveillance companies).

m1 7y ago
I have a couple of other bank accounts and none of the others seem to be sending data to Facebook.

threeseed 7y ago

Not really. They have the Facebook Pixel installed likely to do retargeting advertising when a person visits their website. It's one of the most effective methods so it's very common to see it everywhere.

m1 7y ago
This is related to their app not their website.
- threeseed 7y ago
  Same applies to their app. Doing retargeting for when (a) someone downloads their app but doesn't signup and (b) someone is a customer but has low engagement i.e. is likely to churn.
  - djaychela 7y ago
    That may be true, but I still think it's a low-effort way for them to do it, and I expect better from Monzo than this. Plus it tracks people regardless of if they fit in a) or b) - neither of which is the case for me.

buro9 7y ago

Hmm, that feels incident worthy. My bank should send precisely zero things to advertising / marketing companies. Have you raised it with their Help team? You should. Unfortunately I cannot as I do not have a facebook account so cannot determine whether or not facebook hold data on me without creating an account.

Nextgrid 7y ago
Might be worth a post on their community.
- ackshually 7y ago
  What do you mean by community? Like a Facebook community? Do you need an account to post on the facebook community?
  - Nextgrid 7y ago
    They have a Discourse forum: https://community.monzo.com https://community.monzo.com
papln 7y ago
You might (justifiably) not like it, and it might inspire you to boycott the business or plead for regulatory relief, but it's not an "incident" from their perspective to be intentionally doing what they do to run their business.
- buro9 7y ago
  This is a bank, and they are regulated. Depending on the information shared, this may be a breach of that regulatory code. I do not have access to see what the data is, but would certainly in their shoes investigate with high priority, and Would raise a security incident to do so. If it turns out to be empty and of no concern, then great. But ignoring such things is seldom wise.

have_faith 7y ago

I saw HSBC

djaychela 7y ago
I didn't see HSBC, but I did see Monzo - which I was surprised and disappointed by. I see no legitimate reason for them to be connecting me to my (disused aside from messenger because of friends' network effects) facebook account. Not impressed.

rovek 7y ago

Relevant but not exhaustive: https://monzo.com/help/legal-stuff/information-facebook https://monzo.com/help/legal-stuff/information-facebook

oakesm9 7y ago

I have Monzo in my list too and downloaded the actual data. The only things listed are `ACTIVATE_APP` events. It doesn't seem to send any details to Facebook aside, from that you "activated" (opened) the app. Still not ideal, but not completely terrible.

netsharc 7y ago
When I used to have https://lua.xprivacy.eu/ https://lua.xprivacy.eu/ it used to prompt me a lot, saying "This app is calling this API, do you want to allow or deny? (or allow/deny for 1 minute or 10 minutes). The Facebook app would query what packages/apps are installed on the Android phone. Yeah, Android devs, why is that an accessible API call? For one thing this is how FB could figure out how popular their competitors like WhatsApp, Instagram or Snapchat were, and why they bought them, or tried to.
- oakesm9 7y ago
  It's part of the Intent system in Android. It's a really nice system where you can say "someone open the file with this URL and mime type" and the system asks the user which app they want to use to open it (or use their default if they set one. It all works really well and lets app be loosely coupled to each other. It's also super flexible so you can use it for lots of different use cases. The API itself hasn't changed much since the first release of Android. The issue is that you can query the Intent system to see if there is an app installed that can open your Intent. On the face of it, this makes a lot of sense. You could then display an error message to the user asking them to install and app that can handle it. The problem is that you can create an Intent that you know can only be handled by a single app (using the package name) and then you'll know if it's installed or not. For what it's worth, iOS used to have exactly the same issue. You could query the phone could handle a specific "custom protocol scheme" (used for deep linking). You could then just query a scheme which you know is for a specific app and tell if the user had it installed. Apple fixed this by requireing you to include a predefined list of schemes which you can query for in your Info.plist (manifest file) and limiting the number you can have (30 I believe). All APIs with good intentions, but very easy to abuse. Apple is just more comfortable breaking backward compatibility to fix these sorts of issues.