“Privacy”.com–Yeah Right
ersei.net
ersei.net
It's mostly about hiding the fact that the same person, you, are paying to merchant A and merchant B. It allows you to easily have a card per merchant, and lock it to the merchant so that when its number is stolen, it can't be used anywhere else.
The domain name is a bit lofty, yes.
In my experience even that can fail. I had a card number stolen from them, charged to the tune of $200+, and their support refused to even entertain the idea of it being fraud, and when I mentioned a chargeback they basically said "we don't do those, because we have contracts with vendors."
A payment stop at the bank sure worked though.
I'm curious, how did this happen specifically? In my experience, all privacy.com virtual cards default to being merchant-locked to the first place you use them. Did the merchant run an unauthorized transaction on the card?
I've had online payment info compromised once, and privacy.com caught it cold (and also clearly demonstrated that the vendor had mishandled the payment info, despite claiming otherwise).
This was during a big wave of unauthorized activity being attempted on their cards as well, a lot of friends reported blocked charges for random amounts at like a retirement/hospice home(?) at the time.
This was like 3+ years ago, and my only guess now (read: can't remember if this is true) is that the card had never been charged to the merchant, only pre-authed. But even then I'd expect the pre-auth to lock it to a merchant.
0. https://blog.privacy.com/a-different-type-of-card-fraud-anat...
Maybe they think that not sending me to collections after I stopped the payment at the bank and closed my account is "being made whole."
Honestly I'm still confused by the whole thing.
I told them that it was a fraudulent transaction that I didn't approve, they then kept asking me for tracking numbers and finally closed the support ticket, and would close any further ones instantly on me with this reply.
https://i.imgur.com/EyjCGiU.png
Never mind the fact that it was a completely separate issue than what they would keep replying to me about, the fact that they included the line of
> At this point, the only possibility is that the shipment was stolen after the delivery. This is no longer a case where the merchant is at fault. Hence, the case would be concluded in the merchant's favor.
is a complete disregard for visa's rules. The fact that they wouldn't even let me open a dispute is the biggest factor of "wtf" here to me.
Visa is probably easier to deal with in the case of fraud than what it sounds like privacy.com is like.
I use a single CC for everything (that I'm willing to pay with a CC for.) It's been compromised to the point that charges went through 2-3 times over the past decade and a half. CC company caught the fraud each time, automatically charged-back each of the fraudulent transactions, and overnighted me a new card. They also moved all of my recurring charges to my new card (somehow.) From what I understand, all of the big 4 CC companies operate more or less the same in this regard.
This thread has eliminated the chance of me using Privacy.com in the future. If they can't make dealing with fraud at least as easy as a regular CC (which is quite painless, there's no reason to use them.
But I end up having to cancel and get a new credit or debit card about once a year. And this actually is really inconvenient, when you think of all the places you have stored a CC that have to be updated.
I guess my bank doesn't do automatic updates of any recurring subscriptions, I've always had to deal with it manually. (And in charitable contributions, amazon, paypal, stripe, grubhub, etc etc etc).
That was making me consider privacy.com instead... but if I'm doing it cause of that fraud inconvenience, which right now is just an inconvenience which I have no worry whatsoever would result in actual $$ (cause it's happened so many times now and it's never even been a threat), and switching to privacy.com may eliminate having to update card numbers everywhere when fraud happens but actually increases my risk of actually being out the $$ (or increases the amount of time I have to spend dealing or fighting with customer service or fraud recovery support anywhere) -- forget it.
If you're curious about how this works, read up on "Visa Account Updater".
My concern wasn't that Privacy.com knows who is using their service, but with rather how they choose to know that information through a third party (Onfido) and how terrible Onfido's privacy policy is.
Paddle has no excuse for collecting selfies, they are providing services to businesses that can be verified in more humane and secure ways, such as an electronic signature.
Verifying people with selfies is a degrading and insecure practice, especially when you encounter Onfido during the installation process of a bank's app that you already have an account with, opened in person at a local branch in the EU. This bank also asks you to create a video of yourself and submit your speech to configure their mobile banking app. I'm sure the data will be useful for someone when Onfido eventually gets hacked, or just sells your biometric data.
My hope is that biometric data collection for online account verification will become illegal once all EU member states have intoduced electronic IDs which have an NFC chip. The verification should consist of a person holding their ID next to their phone, and the online service would only receive the minimum amount of personal data to complete the verification.
The image of your face and the image (NFC capture) of your ID are stored to prove to auditors that you were indeed verified to required standards.
No one wants your mugshot, it’s a legal requirement they are having to satisfy.
KYC checks are already being tested with electronic IDs, and the identity of the customer is verified by the presence of a government ID, and the input of a PIN. No selfies or similar farces are involved.
"As part of a business transfer. Onfido may disclose your personal information to an actual or potential buyer, investor or partner (and its agents and advisers) in relation to any actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding"
All I remember is using the plaid bank API which is itself probably very dangerous and a poor decision to allow.
I've used privacy.com for years. Never had an issue. Never had to validate my identity. Never had any issues with support. If used as prescribed (setting limits on cards etc) it fits in directly to where it belongs in my threat model.
What a strangely charged article.
I'm not sure what you want privacy.com to do differently.
This seems like a larger security/privacy surface area than the latter approach.
Privacy.com don't have to use Onfido, there are other options out there. There could be a myriad of reasons why they chose Onfido over the competition but the TOS bind the privacy.com users and they don't offer any alternative.
For a company leaning on "privacy" as their primary marketing tool, this is a double standard. It doesn't mean Privacy.com is a bad company with horrible people building a terrible product. They're just calling out a company for doing something seemingly opposite to their marketing, and saying that's why they personally aren't using the product.
You can disagree with OP but doesn't make their point wrong, invalid, or stupid.
If your contractor chooses a bad subcontractor, who do you blame?
This IS a privacy enhancement in many cases.
If there’s a better option for this use case I’m all ears, though. Reading sibling comments that Privacy won’t actually stop charges past set limits is disconcerting.
What merchants out there are cross-correlating credit card numbers to deanonymize people? Can you even do it in a way that's PCI compliant? If you're actually interested in preventing random merchants from tracking you, I think credit card numbers are the least of your worries. Your billing/shipping information, which is almost always collected is much more revealing about you and can't be anonymized. Given this I do think the name of "privacy".com is misleading. At best it's stopunauthorizedcharges.com.
Sure enough someone tried to use my one-time-use utility card multiple times. Once they charged it for 16 cents which how card runners test the cards to see if they are valid. Normally those won't show up on any alerts you may have, because most banks don't alert below $1.
But privacy.com does.
I actually prevented about 1000 stolen cards from being used because I was able to inform the local utility that their database had been breeched before they even knew about it, and they were able to let the CC companies know before the card runners could use them.
My Chase credit card is set to text me on any charge over $0. I have received alerts for under a dollar.
Also, I have been using a credit card extensively for 20 years, and I don’t take many precautions (other than having text alerts for all purchases). I will put that number anywhere I want to buy something without even thinking about it.
I have had many fraud ATTEMPTS over the years, but I have never once lost money because of it. Having to change my credit card number has been annoying, but I am not sure it has been more annoying than it would be if I had to use a different number for every purchase.
In fact, this weekend I got a notice from wilsoncombat that their payment processor had been hacked and card info had been leaked, which I had suspected when I received a notification that a charge ($0.15) had been declined on the card I used with them in March. The charge was declined, and I was able to close that card and not have to redo my card info in every place I have a card linked.
When you're allowing strangers to perform financial transactions - you're taking on risk that the money that is sent needs to actually be funded. They need to conform to KYC laws like all fintech providers - so yes, they will require knowing a little bit about you to operate in the United States like all financial institutions.
3rd party verification has become a standard in the fintech/insuretech industries since its very hard and risky to do KYC on your own. Also personally I don’t trust having all the random companies I transact with maintain my KYC info. At least in theory, the experts at ID verification have strong enough incentives, motivation and expertise to keep my data safe, reducing the attack surface area.
Not affiliated with either party.
> Whenever legally possible, we seek to protect the information we share by imposing contractual privacy and security safeguards on the recipient of the information. This is particularly important in cases where the recipient is located in a country that has different or lesser privacy laws than those of the country where the information was originally collected. In some cases, however, it’s not possible for us to do so — for example, when we have a legal obligation to disclose information to a government authority and that government authority isn’t willing to enter into such contractual safeguards.
"As part of a business transfer. Onfido may disclose your personal information to an actual or potential buyer, investor or partner (and its agents and advisers) in relation to any actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding"
Here's the full paragraph:
"As part of a business transfer. Onfido may disclose your personal information to an actual or potential buyer, investor or partner (and its agents and advisers) in relation to any actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding"
This user experience has trained the most vulnerable, non-tech-savvy audiences to provide just about anything requested when asked for ID verification. Including to phishers.
If you push back too hard against arbitrary, invasive KYC requests, you start down a path towards becoming unbanked.
The USA is badly in need of modern consumer privacy regulations.
I think Plaid's stance was that if the host service (the one asking you to use Plaid) wanted to be invasive then it's up to them, or if this host would be upstanding and maintain your privacy, that could happen, too. It was up to the customer to check their policies. But this limitation was not spelled out nor promised that I could see.
Their policy may have changed since then.
Here's an example: https://d1hzvs60s6jsjg.cloudfront.net/IMAGES-1/208624076/pla... Does this look like it's going to be shipping your credentials off to be stored by a third party?
“Plaid will store your plaintext password and use it to periodically access your bank account.”
Burying truth deep in a TOS is seen by some as deceptive.
(Though instead of "access", which could imply "take money out" to some people, they'd probably use a more descriptive term)
That's terrifying.
I'm looking into privacy.com as an alternative to using my real debit card number online because it gets stolen at least once a year. Having my bank account itself compromised does not sound like an improvement. Then again, how often do banks get hacked and have their credentials compromised? At least as often.
When it is, the vendors/platforms that "junky credit unions" use will add it, same thing as when big banks will add it. A vendor that small banks and credit unions use for their online platform probably has the same order of magnitude of aggregate consumer customers as a big bank has, I don't see why it wouldn't be about as do-able for one of those vendors as a big bank.
Plaid uses banking credentials on a user's behalf. Yes, it's similar to using stolen credentials because... it's the same thing, except consent, audits, insurance, etc. all play a role whereas with criminal activity they do not.
That said, if it makes you feel better, pretend my comment read "Plaid pretends to be the users' banks in order to trick users into giving Plaid their bank credentials and stores those credentials without their knowledge or consent".
Plaid is not phishing, by any true definition of the word.
I'm content with my comment if you agree Plaid's behavior matches phishing with the only exception being how they use the credentials afterwards.
If I go to a store and pick up some items and leave with them is that stealing? How about if I pay for them?
Please describe to me how I can figure out from this that my bank credentials will be sent to and stored by a third party that isn't my bank.
fighting crime as crime isn't meaningless, it's how we're supposed to do things.
Oh, and newsflash - a SD trust is an absolute red flag, and will just mark you for “Enhanced Due Diligence”, where you will be asked to prove the source of funds. And chances are that info will be then shared with your local financial crimes agency - and without your knowledge. And if you think your lawyer or accountant don’t make those reports… heh.
Products like this are particularly susceptible to fraud, especially given that they're charging your bank account directly. Without any KYC, if I as a fraudster get access to your bank login, I can basically drain your account. That opens up a ton of liability to Privacy. Also, the card networks tends to be pretty risk-averse with allowing issuing products access to their networks if there's a lot of fraud going through their services.
So, it's much easier to put KYC in place in order to avoid the headache of dealing with fraud/AML/etc
The actual funding source/bank behind them won't see any detail beyond "privacy.com".
Any card issuer (or virtual card issuer) has to do this.
Edit: A sibling explains a good liability reason for this, which makes sense but would not imply any legal reason.
What this kind of article should be about is the same thing that VPN is about. privacy.com actually removes privacy. Now, instead of VISA being the only aggregator of your purchase data, privacy.com is also. Either way, the merchant and VISA know your purchase history. Now, so does "privacy".com.
If you want to hide something from your bill so that someone else in your household doesn't see it, then ok. If you want to hide your address and name from a merchant (say for a digital downlaod) then ok. If you actually want more privacy, privacy.com is the opposite of what you want.
how does the merchant know your purchase history if you're using virtual cards with bogus info?
Our goal is to make sure that customer data spends as little time as possible with third-party providers like Onfido. Onfido’s general policy is that they will not save customer data longer than a year but they set up different contractual agreements based on what customers stipulate. We've stipulated that they delete data after 30 days.
The "Privacy" in our name is about making sure our customers’ personal and payment information is kept private from merchants and from fraudsters.
We offer a financial service that comes with legal and regulatory requirements and we have to gather details like address, social security number, and phone number to authenticate a user’s account. If you know of other KYC providers that have more privacy-forward policies, we’re open to exploring.
Happy to discuss more. You can drop me a note at rachel@lithic.com.
The author is complaining about the service's name not matching their expectation of what the service is supposed to do. I don't think that's fair. The Privacy.com homepage summarizes the service very well in my opinion. You give Privacy.com your financial information so you don't have to give it to a dozen other companies, and you get to control when and how those companies use that information by setting limits on spending or card duration.
The author was expecting this to be a cryptocurrency tumbler or what?
I know some people are afraid of the feds having a centralized and accurate registry of citizens, but the alternative (that every company who takes payments must have their own separate, partial, and inaccurate registry) causes a lot of problems.
I would rather prefer a decentralized & secure way that can be accesses via an API by companies such as privacy.com etc. The distributed piece is solved by Notaries. Could we learn something from how the notary system works that can be leveraged to build out a modern distributed ID verification system.
Right now, N companies have N partial records of my identity, with varying ages and accuracy levels. Company A has my name and phone number, company B has my email and name and my previous phone number, company C has a copy of my driver's license from two years ago, etc. N partially accurate versions of my identity, floating around, getting bought and sold and merged together with buggy perl scripts, forever. Notaries do nothing to solve this.
Whence comes this fear? How would the government having an accurate list of the citizenry, and storing a key for you so you can attest your identity, intrude on your life? Doesn't having to scan a copy of your ID and send it to your [bank/insurer/crypto account/hosting company/employer/etc] intrude on your life more?
The tech to do this well is nearly here - combination of ID on Apple/google wallet + decent on-device facial recognition tech and you can hugely reduce the risk profile of KYC.
They have saved me from fraud 2x in 3 years. Then I simply closed that "card" with the click of a button. No need to call my bank, cancel my debit card that I use at ATMs, and wait a week for a new card
I don't have to worry about remembering to cancel free subscriptions. I set the card max at $1. This has saved me multiple times from the free trial scams that you need to opt out of. Free trials should be opt in after the trial. Opt out is a scam to trickle money into a company from non customers.
They stopped a contractor from charging me over $2k when I specifically told them they needed to tell me how much before charging me. Of course they didnt tell me and tried to run the charge. Privacy put a stop to their BS.
It is mostly automatic or easy to set up once you are using Privacy. Some banks have started to offer similar digital card numbers similar to Privacy.
It is a hard problem, and using a 3rd party service is more cost effective than staffing a department to do manual verification.
Anyways, they're probably harvesting your payments and selling that info. I've noticed that since the card issuers have such high security requirements, and audits, a lot of little businesses have cropped up who are trying to act as middlemen to your payments. Because they just found a backdoor to getting all your payment history without hacking your card issuer. I believe privacy.com is one such business.
[0] - https://techcrunch.com/2021/05/20/privacy-com-rebrands-to-li...
But I still do believe this practice goes on here in Sweden where small businesses are offering services that act as man in the middle between the consumer and the card issuer. And therefore they're able to harvest your transaction data, which is gold.
If you just want to generate 1-time credit card numbers to use once it's the best experience imo - can easily do it in the Wallet app.
Also lots of these subscription websites now detect card generated from something like a Privacy.com is prepaid and will prevent you from using it which defeats the purpose. Not the case with Apple.
I'm sorry, but how? To best of my awareness, there is only one virtual card (though it has a rotating CVV) and the only option I see is "request new card number" that should be used in event of having the current number compromised. I don't see any way to have multiple virtual cards there.
Well, technically there are 3+ cards - the physical card (without a CVV, so not really useful), the virtual card (see above), and one-per-device Apple Pay cards numbers (probably not useful unless merchant accepts Apple Pay).
If you want multiple cards with limits Citi does this and it's exactly the same as Privacy except you can use your credit card.
If you want various virtual cards with varying limits I also noticed my Citi card allows me to do this. It’s just a little clunkier but it’s actually more robust than Apple’s feature if you wanted a unique number per website.
Not that I can find, which is why I use Privacy.
The main reason I don't use Privacy any more is because you can't back it with a credit card (only debit/bank) and I want the CC points.
Sadly no, there really isn't, unless you lobby congress. These laws were written with law enforcement in mind, not privacy.
To paraphrase Nancy Reagan, "Just say no".
I never expected them to provide any privacy of any sort, but I don’t think they could make matters worse. Privacy.com has been extremely convenient for me, private or otherwise.
"As part of a business transfer. Onfido may disclose your personal information to an actual or potential buyer, investor or partner (and its agents and advisers) in relation to any actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding"
edit: to be clear, the blog post has listed, among other complaints:
> Onfido may disclose your personal information to an actual or potential buyer (note "potential")
which you seem to be confirming from your own review of their policy. What did the blog post misrepresent?
* Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data
* Onfido is in no way linked to or responsible for the practices of other Providers. Onfido encourages you to read Company’s privacy policies and terms and conditions, as well as those of other Providers, which may apply to the use of facial scan data extracted from photos and videos.
* Onfido may disclose your personal information... or other third party where we believe disclosure is necessary... to protect your vital interests or those of any other person
* "Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data"
This is actually "Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data to store the data, to maintain backup copies, and to service the systems on which such data is stored.".
Completely standard and another misrepresentation by the blog trying to paint it like they send the stuff everywhere when it's just about their storage and backup solution.
* "Onfido is in no way linked to or responsible for the practices of other Providers. Onfido encourages you to read Company’s privacy policies and terms and conditions, as well as those of other Providers, which may apply to the use of facial scan data extracted from photos and videos."
Nothing strange whatsoever. Again completely standard in GDPR that you need to have to to acquit yourself.
* Onfido may disclose your personal information... or other third party where we believe disclosure is necessary... to protect your vital interests or those of any other person
This is actually "To comply with laws. Onfido may disclose your personal information to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person; and"
Wow, probably the worst misrepresentation. This blog is straight-up misinformation and slander. Thanks for highlighting it.
Privacy.com flagged you for some unknown reason and asked you to verify your identity. You learned that Onfido exists and googled the name and (LOL) decided you would spend 45s on Wikipedia and then read a privacy policy written not-for-you, and then post yourself on HN so you can "inform others."
As I am not a lawyer, I probably missed some more bits as well.
First and foremost, there are regulations on how PCI/PII data can be stored. I'll assume you read about reading about or pretended to read about PCI so I won't go into the details you don't care to understand (but should).
Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data
Onfido may disclose your personal information to an actual or potential buyer (note "potential")
Believe it or not, startups don't have enough time, money, energy, resources to rewrite every little feature required to run a business. Visa and Mastercard also have their own ways of sharing your private information. Does that also mean to start a privacy focused fintech company you need to write the entire american payment system?
Onfido may disclose your personal information... or other third party where we believe disclosure is necessary... to protect your vital interests or those of any other person
To comply with laws. Onfido may disclose your personal information to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
So what do you do? You try to deprive a company who's actively trying to do what you pretend to do with your useless tantrum.
Practically every major card issuer provides native virtual numbers now.
This is a feature of the past, and most providers don't do it anymore. The only one I know of is Capital One's Eno: https://www.capitalone.com/digital/eno/virtual-card-numbers/
Bank Of America retired theirs (and lost the retirement page): https://webcache.googleusercontent.com/search?q=cache:-9i6Vr...
I remember BofA used to. When they closed it, I thought everyone else followed suite.
2) For a knowledgeable consumer, there is huge incentive to use services like this to prevent the credit companies from being a single point of financial data aggregation. But—and here I guess I'm talking to amex again—if disposable or per-merchant card numbers are widely offered by card providers, I'd expect most people would just use those instead of a more robust provider like privacy.com.