Venmo

In 2018, Venmo released a new physical debit card available for users.[13] The card runs on the MasterCard network and offers ATM access and overdraft protection. It can be used anywhere that accepts MasterCard, and it enables up to $400 in daily ATM withdrawals, though transactions at non-MoneyPass ATMs come with at least $2.50 in withdrawal fees.[7]

In addition, the service offers a reload function, which, when enabled, takes money from a user's linked checking account in $10 increments if their Venmo balance drops too low to cover a purchase. Customers could be subject to fees or other consequences from their bank if they overdraft that account.[7] Card purchases show up in a user's Venmo transaction history, and the card can be canceled from within the app.[14] These features make the card similar to a traditional bank debit card, but adds the ability to directly track spending in-app.[7]

Social feed of transactions on Venmo[15]

Venmo includes social networking interaction; it was created so friends could quickly split bills, whether that is for movies, dinner, rent, tickets, etc. When a user makes a transaction, the transaction details (stripped of the payment amount) are shared on the user's "news feed" and to the user's network of friends.[16] This mimics that of a social media feed. There is a "world wide" Venmo feed, a "friends only" feed, and then personal feed. Venmo encourages social interaction on the application through comments[17] using jokes or emojis and/or likes. Early on, Venmo required new users to sign up through Facebook, which made it easy to find peers they wanted to pay and also provided Venmo with free marketing.[18] For users not friends on Facebook, the application allowed the opportunity to search by username and phone number. Profiles are personalized with profile pictures, usernames and Venmo transaction history. The transactions can be made private, but most users keep the default and do not change the privacy settings.[19] Venmo does not have either buyer or seller protection.[20]

Venmo includes three social feeds: a public feed, a friends feed, and a private feed. By default, all Venmo transactions are shared publicly. Anyone who opens the app to the public feed, including people who do not themselves use Venmo, can see these publicly shared posts. The privacy settings can be changed so that all posts are either shared only with a user's Venmo contacts, or even kept private. If posts are shared only with contacts, they still appear in a friends feed, whereas private transactions are only visible to the two parties involved in the transaction. If two users involved in a single transaction have differing privacy settings, Venmo applies the more restrictive level. Users can override their overall preference for any individual transaction, including after the transaction has been made.[21]

A 2018 study analyzed over 200 million public transactions and found that Venmo "reveals a massive amount of private details about users' lives by default".[4] The same year, the company reached a settlement with the FTC after the FTC had accused Venmo of "misleading" users about the privacy settings changes required to make transactions completely private.[4] In 2019, another researcher downloaded and analyzed seven million transactions, concluding that although Venmo had made some minor improvements limiting mass-scraping, the data still put users at risk for various forms of cyberattacks.[22][3]

In 2019, Mozilla and the Electronic Frontier Foundation wrote an open letter "to express our deep concern about Venmo's disregard for the importance of user privacy, and to call on Venmo to make two critical changes to its privacy settings: make transactions private by default, and give users privacy settings for their friend lists".[3]

Each transaction includes a description of what the payment is for in text, emoji, or both. This description is required to complete the transaction, but Venmo does not enforce content requirements (e.g., someone could describe the transaction as "nothing"). Venmo recommends emoji when a common expense is entered as the description. Overall, 30% of Venmo transactions include at least one emoji.[21]

Regardless of a transaction's privacy, only the two people involved in a transaction can see the transaction's amount. Transactions are persistent within the feed and scroll infinitely. A previous transaction may be difficult to revisit if a user or their contacts have many transactions.[21]

Venmo's social model has attracted attention from researchers. A research group from University of Washington observes that the social feed in Venmo differs from other social networks in that activity is driven by financial transactions. A user could make a trivial transaction to make a post (e.g., sending someone $0.01, or requesting $0.02), but only one participant in their studies reported ever doing this. Further, neither reading the feed nor sharing a transaction memo publicly or with friends is necessary to send or receive money.[21]

On Venmo, people transact with both friends and businesses via the app.[23] Analysis of public transactions identifies a spectrum of use patterns, from regular users who create transactions for a variety of expenses, to niche users who use Venmo with a small cluster of friends to pay for just a few things (e.g., bills among roommates).

Venmo has claimed that its security is bank-grade, and that personal and financial data are encrypted and protected on secure servers to guard against any unauthorized transactions.[24] However, journalists, security researchers, the California Department of Business Oversight (DBO) and the Federal Trade Commission have all disputed these claims.[25][26][27][28][29]

In February 2018, the FTC settled with Venmo, after an investigation uncovered false representations about "bank grade" security and failures to comply with the Gramm-Leach-Bliley Safeguards Rule and Privacy Rule.[30][31] Under the settlement, Venmo will be required to undergo third-party audits every two years for the next ten years. The FTC also complained that Venmo "misled consumers about the extent to which they could control the privacy of their transactions" and misrepresented the availability of funds for withdrawal.[32]

Venmo states that customers need not worry about their security or privacy, and encourages users to set up a PIN to increase security.[33] On July 17, 2018, The Guardian[34] published an article showing that Venmo is insecure because privacy protection is not set by default. According to the researcher who found this privacy issue, Venmo publishes all transactions along with names openly into the World Wide Web.

The Better Business Bureau has reported that some scammers exploit the cancellation period to appear to pay, but ultimately avoid paying for an item.[35]

In November 2018, The Wall Street Journal reported that Venmo, in the first quarter of 2018, had suffered $40 million in operating losses—nearly 40% more than it had budgeted for—due to "a wave of payments fraud".[36]