8 ms·

I am not surprised. Recently I had an issue with Instacart when somehow one of my order was charged back. The Trust team at Instacart insisted that I pay up and

by iamyi 6y ago

I am not surprised. Recently I had an issue with Instacart when somehow one of my order was charged back. The Trust team at Instacart insisted that I pay up and refused to investigate their system, after I provided a lot of evidence of how their system is mixing up my account with somebody else’s and there is a bug in their integration with Costco. After more than a week of back and force they closed my account. I decided to reopen it by paying the charged back amount because without it I can shop at Costco. Guess what, after the account was reopened, the other transaction delivered to another person living in another state is still showing up in my account, including t heir other private information like cell phone numbers and CC digits. I decided it’s better to buy from amazon instead of costco with Instacart. It’s beyond me why their trust department refused to investigate their system with obvious evidence for bugs, and I don’t want to text the other person in my account to notify him that his private information has been compromised, because the communication with Instacart made me feel that I am guilty. If you use Instacart to buy from Costco, be aware.

azemetre 6y ago
You need to publicly shame them on twitter. That is a massive breach likely happening to other users as well. HN has a decent audience but twitter has an enormous audience. Tag some tech reporters as well for extra fun.
- tasogare 6y ago
  You need a personal audience for that. Posting on Twitter with 10 followers at best isn’t likely to make it.
  - chris_vancity 6y ago
    not with the right hashtag or mentions
    - sbarre 6y ago
      Why don't you go ahead and do that, and then report back to us on your success.
    - defnotashton2 6y ago
      Yea like all social media platforms these days you usually have to pay in one way or a not to promote a hash tag. I bet most of the popular hash tags you know of were sponsored at some point.
- iamyi 6y ago
  I thought about that but I am no influencer type. The communication with Instacart makes me feel that they suspect I have stolen somebody’s credit card to make the purchase, and after they reopened my account I can see that person’s cell number and address and such, and I don’t know an easy way to go public without showing the proof, which is another person’s private information.
  - ShroudedNight 6y ago
    > I don’t know an easy way to go public without showing the proof, which is another person’s private information. It might be worth sharing with a journalist; potentially the author of the linked article?
- raxxorrax 6y ago
  No! They would comply, post an apology and continue the same way. You need to sue them for data breaches and endangering personal info. Of course legislation has to come up for stuff like this. Best day for that would be yesterday.
mattigames 6y ago
Just tangentially related but recently I tried to buy something from an online store called Adorama and when I tried to place an order I got the notification of the charge from my bank after clicking the order button but the page didn't do anything, initially I though "well lets just get in touch with customer support, pretty sure they can see the charge and let me know what happen with it" oh boy was I wrong, their customer support only has access to orders not transactions, so when a bug in their website charged me without creating an order there is nothing they can do at all; all they did is recommend me to ask my bank to do a chargeback, but my bank says I need to wait 30 days after the transaction to so. So yeah, my lesson was the same, I should have had stick with Amazon because smaller stores just can't be trusted with handling purchases correctly.
- WrtCdEvrydy 6y ago
  Privacy.com... is my thing for this reason.
  - therockspush 6y ago
    as soon as you can use a credit card to fund it, perfection.
    - WrtCdEvrydy 6y ago
      that will probably not happen because they would be eating a credit card fee... that service only works because they become the credit card processor and get to pocket the card fee...
- staticautomatic 6y ago
  Adorama is totally reputable and everyone is smaller than Amazon. Still super annoying to encounter things like that though.
- ponker 6y ago
  Adorama is a huge company. Must be a top 1000 e-commerce vendor.
breakingcups 6y ago
I know people on here might have GDPR fatigue, but in Europe you'd have a massive stick to incentivize them to make it right. This is exactly why regulation such as this is needed. We shouldn't have to depend on publicity and shame to force a company to be careful with our data, we should have a neutral agency that investigates every report equally and is able to hand out fines for those companies that don't take our privacy seriously. (I mean, California is on the right track)
- richrichardsson 6y ago
  You may underestimate how much of shit companies care. T-Mobile Netherlands have been sending me plenty of private information about one of their customers for months (their customer signed up using a.person@gmail.com as their email address, I've held the aperson@gmail.com account since 2006, hence I receive the emails). I've tried escalating this with them multiple times, each time they insist that I won't receive any more emails, until the next one arrives. I also tried threatening them with taking it up with whichever authority is relevant if they don't fix it and reminded them about the 20m Euro or 4% of global turnover fine they could incur, yet still keep receiving this poor saps information.
  - ShroudedNight 6y ago
    In case you haven't already tried, I would contact their legal department. I would expect them to be far more invested and effective in fixing these breaches than anybody in the phone-based customer support chain.
    - ReidZB 6y ago
      Although it's about a different subject matter, I'm reminded of this quote from a patio11 article: > [A bank's] CS department is scored on number of tickets resolved per hour, and each rep’s incentives are simply to classify you as something requiring no followup and get you off the phone. [...] The legal department (or an analogous group – it is different at every bank) is not scored on cases resolved per week. They are scored on regulatory incidents per quarter, and their target for success is likely zero. Shockingly senior people will be involved to avert regulatory incidents. src: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...
drevil-v2 6y ago
Why can't you go shopping yourself? I am genuinely curious, not being sarcastic. Costco is typically stuff that you buy once a month if that; can you not even spare an hour or two once a month to go shopping?
- iamyi 6y ago
  That was in May, shopping at Costco means waiting in line outside for a couple of hours. We are also a high risk household. Costco was the only shop that does grocery delivery at the time (amazon fresh was totally not available then). It’s an easy decision between shopping at store, or online and have them delivered the next day. We are using the Costco website, so I think maybe the bug is in their integration.
  - drevil-v2 6y ago
    Fair enough. I never got the appeal of Instacart & the like but I guess it is good that the option is there should one need it.
    - iamyi 6y ago
      I actually never used the Instacart app and I can care less. I do care about the Costco next day grocery delivery service, which has a transparent integration with Instacart. That is, I order on Costco.com and Instacart will deliver it next day. Costco won’t allow me to chose other vendors for delivery. If you use Instacart app to order items from Costco the price is actually different. I guess using Costco.com I have my membership benefit.
      - richrichardsson 6y ago
        > I actually never used the Instacart app and I can care less. What is the meaning you are trying to convey here? Genuinely confused by this sentence.
        bottled_poe 6y ago
stepstop 6y ago
Wow, thanks for sharing this. I’m going to close my Instacart account now. I haven’t used it in a while but I don’t want my data sitting on a platform that doesn’t care about security
TuringNYC 6y ago
I'm pretty curious how this happens technically -- is there a hash collision? Do they hash email addresses as a key or something?
- poyu 6y ago
  It's gotta be something simpler than that. Perhaps there's a database rollback and now they have mismatched ID somewhere. Or perhaps the caching scheme wasn't thought out thoroughly and the caches got delivered to the wrong person. There's literally a million ways things could go wrong, and hash collision is the last thing I'll suspect.
  - iamyi 6y ago
    Yep that's exactly what I told them that its mostly a hash collision when I was not willing to pay the chargeback unless they can explain why somebody else's number was on my account. That's why it makes me angry after I paid the chargeback and can still see another person's info in my account, that I realize they have all the information themselves already and they know the issue, they just refuse to fix it and acknowledge it. It's strange that they can see the mismatch information in my account all alone, but they only care about recovering the $80 chargeback, while I have already made another $1000 purchase from Costco. I think it may be a better approach to escalade to costco.
calvinmorrison 6y ago
Had InstaCart this week charged my card in error. I told them, then they spent the whole week heckling me about card information, etc, claiming they couldn't find the charge, getting auto replies etc. Yesterday I just called my bank and filed a dispute. Problem solved. Instacart Cancelled.
- tehlike 6y ago
  Filing a dispute is the best way to go about lousy merchants...
- iamyi 6y ago
  You may be just the opposite of the issue I have with instacart. If so, I don't think the problem is solved. Instead, Instacart is probably displaying your private information to another person (who your card was charged for).
FascistDonut 6y ago
I was at a friends place in a nearby town and got an order from Fry's (grocery store) where the guy charged me for 5 things he didn't deliver (about $30). I made a complaint (1* review, support ticket) and changed his tip to $0.01 because I couldn't set it to 0. The next day I had 6 charges from 2 Fry's in the area of where I was the day before, totalling about $550 at stores I had never been to (and did not appear as instacart charges like they normally would). My bank gave me a fraud warning when they tried to use an atm. I still had the card in my possession. I reported it to Instacart and never got a response. My bank was able to reverse the charges as fraud though, fortunately. So I don't know how, but at least 1 rogue instacart delivery people was able to get my atm card information and misuse it. If not, the coincidence that accounts for all the evidence is astronomical.
akeck 6y ago
Put these details in a certified letter sent to the legal departments of both InstaCart and Costco. They'll pay attention to an evidence trail.
croutonwagon 6y ago
Why not create a new, separate account. I keep a pre-paid credit card that i will occasionally refill for stuff like this. I keep my actual banking 2-3 steps away from anything online. All charges go through a credit/charge card (usually amex). If im particularly skeptical or its a company that requires card info for something that shouldnt (like some intro/free trial) i just use a prepaid card with a minimal amount im willing to lose.

by iamyi 6y ago

azemetre 6y ago

You need to publicly shame them on twitter. That is a massive breach likely happening to other users as well. HN has a decent audience but twitter has an enormous audience. Tag some tech reporters as well for extra fun.

tasogare 6y ago
You need a personal audience for that. Posting on Twitter with 10 followers at best isn’t likely to make it.
- chris_vancity 6y ago
  not with the right hashtag or mentions
  - sbarre 6y ago
    Why don't you go ahead and do that, and then report back to us on your success.
  - defnotashton2 6y ago
    Yea like all social media platforms these days you usually have to pay in one way or a not to promote a hash tag. I bet most of the popular hash tags you know of were sponsored at some point.
iamyi 6y ago
I thought about that but I am no influencer type. The communication with Instacart makes me feel that they suspect I have stolen somebody’s credit card to make the purchase, and after they reopened my account I can see that person’s cell number and address and such, and I don’t know an easy way to go public without showing the proof, which is another person’s private information.
- ShroudedNight 6y ago
  > I don’t know an easy way to go public without showing the proof, which is another person’s private information. It might be worth sharing with a journalist; potentially the author of the linked article?
raxxorrax 6y ago
No! They would comply, post an apology and continue the same way. You need to sue them for data breaches and endangering personal info. Of course legislation has to come up for stuff like this. Best day for that would be yesterday.

mattigames 6y ago

Just tangentially related but recently I tried to buy something from an online store called Adorama and when I tried to place an order I got the notification of the charge from my bank after clicking the order button but the page didn't do anything, initially I though "well lets just get in touch with customer support, pretty sure they can see the charge and let me know what happen with it" oh boy was I wrong, their customer support only has access to orders not transactions, so when a bug in their website charged me without creating an order there is nothing they can do at all; all they did is recommend me to ask my bank to do a chargeback, but my bank says I need to wait 30 days after the transaction to so. So yeah, my lesson was the same, I should have had stick with Amazon because smaller stores just can't be trusted with handling purchases correctly.

WrtCdEvrydy 6y ago
Privacy.com... is my thing for this reason.
- therockspush 6y ago
  as soon as you can use a credit card to fund it, perfection.
  - WrtCdEvrydy 6y ago
    that will probably not happen because they would be eating a credit card fee... that service only works because they become the credit card processor and get to pocket the card fee...
staticautomatic 6y ago
Adorama is totally reputable and everyone is smaller than Amazon. Still super annoying to encounter things like that though.
ponker 6y ago
Adorama is a huge company. Must be a top 1000 e-commerce vendor.

breakingcups 6y ago

I know people on here might have GDPR fatigue, but in Europe you'd have a massive stick to incentivize them to make it right. This is exactly why regulation such as this is needed. We shouldn't have to depend on publicity and shame to force a company to be careful with our data, we should have a neutral agency that investigates every report equally and is able to hand out fines for those companies that don't take our privacy seriously. (I mean, California is on the right track)

richrichardsson 6y ago
You may underestimate how much of shit companies care. T-Mobile Netherlands have been sending me plenty of private information about one of their customers for months (their customer signed up using a.person@gmail.com as their email address, I've held the aperson@gmail.com account since 2006, hence I receive the emails). I've tried escalating this with them multiple times, each time they insist that I won't receive any more emails, until the next one arrives. I also tried threatening them with taking it up with whichever authority is relevant if they don't fix it and reminded them about the 20m Euro or 4% of global turnover fine they could incur, yet still keep receiving this poor saps information.
- ShroudedNight 6y ago
  In case you haven't already tried, I would contact their legal department. I would expect them to be far more invested and effective in fixing these breaches than anybody in the phone-based customer support chain.
  - ReidZB 6y ago
    Although it's about a different subject matter, I'm reminded of this quote from a patio11 article: > [A bank's] CS department is scored on number of tickets resolved per hour, and each rep’s incentives are simply to classify you as something requiring no followup and get you off the phone. [...] The legal department (or an analogous group – it is different at every bank) is not scored on cases resolved per week. They are scored on regulatory incidents per quarter, and their target for success is likely zero. Shockingly senior people will be involved to avert regulatory incidents. src: https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r...

drevil-v2 6y ago

Why can't you go shopping yourself? I am genuinely curious, not being sarcastic. Costco is typically stuff that you buy once a month if that; can you not even spare an hour or two once a month to go shopping?

iamyi 6y ago
That was in May, shopping at Costco means waiting in line outside for a couple of hours. We are also a high risk household. Costco was the only shop that does grocery delivery at the time (amazon fresh was totally not available then). It’s an easy decision between shopping at store, or online and have them delivered the next day. We are using the Costco website, so I think maybe the bug is in their integration.
- drevil-v2 6y ago
  Fair enough. I never got the appeal of Instacart & the like but I guess it is good that the option is there should one need it.
  - iamyi 6y ago
    I actually never used the Instacart app and I can care less. I do care about the Costco next day grocery delivery service, which has a transparent integration with Instacart. That is, I order on Costco.com and Instacart will deliver it next day. Costco won’t allow me to chose other vendors for delivery. If you use Instacart app to order items from Costco the price is actually different. I guess using Costco.com I have my membership benefit.
    - richrichardsson 6y ago
      > I actually never used the Instacart app and I can care less. What is the meaning you are trying to convey here? Genuinely confused by this sentence.
      - bottled_poe 6y ago

stepstop 6y ago

Wow, thanks for sharing this. I’m going to close my Instacart account now. I haven’t used it in a while but I don’t want my data sitting on a platform that doesn’t care about security

TuringNYC 6y ago

I'm pretty curious how this happens technically -- is there a hash collision? Do they hash email addresses as a key or something?

poyu 6y ago
It's gotta be something simpler than that. Perhaps there's a database rollback and now they have mismatched ID somewhere. Or perhaps the caching scheme wasn't thought out thoroughly and the caches got delivered to the wrong person. There's literally a million ways things could go wrong, and hash collision is the last thing I'll suspect.
- iamyi 6y ago
  Yep that's exactly what I told them that its mostly a hash collision when I was not willing to pay the chargeback unless they can explain why somebody else's number was on my account. That's why it makes me angry after I paid the chargeback and can still see another person's info in my account, that I realize they have all the information themselves already and they know the issue, they just refuse to fix it and acknowledge it. It's strange that they can see the mismatch information in my account all alone, but they only care about recovering the $80 chargeback, while I have already made another $1000 purchase from Costco. I think it may be a better approach to escalade to costco.

calvinmorrison 6y ago

Had InstaCart this week charged my card in error. I told them, then they spent the whole week heckling me about card information, etc, claiming they couldn't find the charge, getting auto replies etc. Yesterday I just called my bank and filed a dispute. Problem solved. Instacart Cancelled.

tehlike 6y ago
Filing a dispute is the best way to go about lousy merchants...
iamyi 6y ago
You may be just the opposite of the issue I have with instacart. If so, I don't think the problem is solved. Instead, Instacart is probably displaying your private information to another person (who your card was charged for).

FascistDonut 6y ago

I was at a friends place in a nearby town and got an order from Fry's (grocery store) where the guy charged me for 5 things he didn't deliver (about $30). I made a complaint (1* review, support ticket) and changed his tip to $0.01 because I couldn't set it to 0. The next day I had 6 charges from 2 Fry's in the area of where I was the day before, totalling about $550 at stores I had never been to (and did not appear as instacart charges like they normally would). My bank gave me a fraud warning when they tried to use an atm. I still had the card in my possession. I reported it to Instacart and never got a response. My bank was able to reverse the charges as fraud though, fortunately. So I don't know how, but at least 1 rogue instacart delivery people was able to get my atm card information and misuse it. If not, the coincidence that accounts for all the evidence is astronomical.

akeck 6y ago

Put these details in a certified letter sent to the legal departments of both InstaCart and Costco. They'll pay attention to an evidence trail.

croutonwagon 6y ago

Why not create a new, separate account. I keep a pre-paid credit card that i will occasionally refill for stuff like this. I keep my actual banking 2-3 steps away from anything online. All charges go through a credit/charge card (usually amex). If im particularly skeptical or its a company that requires card info for something that shouldnt (like some intro/free trial) i just use a prepaid card with a minimal amount im willing to lose.