9 ms·
I reached out to them to get a refund for my Car Thing - and they actually sent me an email asking for my checking account number and routing number to be sent
by djc6 2y ago
I reached out to them to get a refund for my Car Thing - and they actually sent me an email asking for my checking account number and routing number to be sent to them VIA EMAIL. And presumably into their ticket system where future hackers will find a nice collection of financial info.
I wonder if their CISO or security team is aware of this, I reached out to address found in https://www.spotify.com/.well-known/security.txt https://www.spotify.com/.well-known/security.txt
Here is response I received:
Hello there,
Thanks for reaching out to us via messaging. Your case has been escalated to the highest tier of Customer Support here in Spotify. All communication within this email thread will be from the Escalation team from now on.
We can see that you've already sent a proof of purchase via chat. About refunding, please share the following details with us:
- Bank name
- Bank Location
- Account Holder Name
- Routing & Account no
- SWIFT
- A screenshot of the required bank details on your online banking or bank letter (if it's possible).
Make sure to hide any sensitive payment information like your full card number for your security.
We'll keep an eye out for your response so we could sort this out.
Kind regards,
XXXX
Escalations Team - Spotify Customer Support
- kuschku 2y ago> they actually sent me an email asking for my checking account number and routing number to be sent to them VIA EMAIL Is that an actual issue with US accounts? Over in EU it's common to publish your account number (IBAN) and routing code (BIC) on your website, letterhead, and obviously on bills you send to customers so they can pay you. They should only be able to send you money, not use it to request money, right?
- hamandcheese 2y agoNope. My utility company and also Verizon withdraw from my checking account, and all they needed was the account number, routing number, and my name. No further verification. For that reason, I have two checking accounts, and don't keep large sums of money in the account I use for payments.
- alvarlagerlof 2y agoThat's seems terribly unsafe.
- SkyPuncher 2y agoIn the US, it goes both ways with just a routing and account number. It's a terribly outdated system.
- Cthulhu_ 2y agoSince Spotify is a Swedish company, I'm sure this is why they didn't think it would be an issue.
- mschuster91 2y agoSEPA Direct Debit is a thing here in Europe as well, this is why we could live just fine without credit cards for so long. We instead had our local variants of what y'all call ACH and a few cooperation networks, that got unified as part of the EU-wide SEPA rollout (must have been something like 10 years ago). Now you can do money transfers to and from the entirety of the EU between all banks, if you pay a bit extra most banks can actually do real-time nowadays. If someone does direct debit fraud with your account number, you can claw back the money just as easy as you can do with a credit card. The only problem remains card-based POS transactions... unfortunately, MasterCard and VISA spent shit tons of money into lobbying to make sure people would finally all converge on their standard instead of an established domestic one, their closed network where these fuckers could finally get a chance at getting their cut from the 448 million EU citizens. Fuck MC and VISA.
- DerekL 2y agoSpelling nit: though the logo is all-caps, the company is called “Visa”.
- irq 2y agoTo be clear, Spotify is a _global_ company, and there is no excuse for this.
- thiht 2y agoFunny thing to say when you see how US-centric most global companies are.
- jjice 2y agoOh man this would fix the most annoying and terrifying part of bank transactions in the US (IMO). Instead, we have a million third parties that help ease the situation, but all take a cut, so some services make you use the original method.
- ildon 2y agoNope, your IBAN alone can be used to set up withdrawals. That has to be approved by the bank, so it's not as easy as stealing the IBAN, but still...
- ThePowerOfFuet 2y agoOnly businesses can create SEPA Direct Debit mandates, and they can be blocked easily and refunded at the initiative of the account holder no-questions-asked within two months.
- AzzyHN 2y agoThat's insane. If anybody told me to send them my bank account number and routing number, I'd assume they're a scammer.
- lambdaxyzw 2y agoSpotify is an European company. Here it's normal to send people your bank account number, you put it on invoices, on your company website, etc. I assume someone who invented this process assumed this is normal everywhere (I learned today that in USA it isn't).
- RIMR 2y agoSpotify Technology S.A. may be headquartered in Sweden, but all business in the USA is conducted via Spotify USA Inc, which is a US company headquartered in the World Trade Center in New York City. It is completely understandable that someone like you who doesn't live or work in the USA wouldn't know how sensitive a Bank Account/Routing number is here. If you exist in a modern banking system with proper security, it is easy to assume that the rest of the world works the same way. However, there is absolutely no excuse for the decision makers at Spotify here in the USA not to understand this.
- sokoloff 2y agoIt's printed on the bottom of every check you've ever written to someone. It's not particularly secret information.