2

I just signed up for a new Venmo account. I did this on my desktop through the web interface rather than on my phone, so none of my phone data is available to it. I do not have a Facebook account, so did not link to one. I do not use Contacts features in email apps, etc., instead managing my contacts manually using files that my web browser does not know how to find. I have not yet linked to any friends, so it can't look up friends-of-friends.

So when Venmo presented me a list of suggested friends and told me "This list is based on your network," I was baffled where it drew this list from. About half the people on this list are people I interact with regularly or semi-regularly. Others are people I have little interaction with or have not spoken to in years, and two are names I don't recognize at all.

Where is Venmo getting this list from?

  • Perhaps, but almost none of the others on the list are people I've had PayPal/eBay interactions with. For obvious reasons, a couple of suggested random strangers is less of a privacy concern than all the people I know and used to know. – Targeloid Oct 9 '17 at 13:58
  • Even though you did not give access to your Contacts, it's possible that (as many apps do) others close to you in your social circles have given access to Venmo/PayPal/eBay for their contacts, and that may be what populates Venmo's social graph. Using the same email for Venmo that you use for other social apps/services could also potentially be compromising you. Venmo has a rather extensive description in their Privacy policy "THE INFORMATION WE COLLECT" section on Social Web Information they collect: venmo.com/legal/us-privacy-policy – pseudon Oct 9 '17 at 23:28
  • Also: "Finally, we may collect additional information from or about you in other ways not specifically described here." which means pretty much anything goes. – pseudon Oct 9 '17 at 23:30
  • @pseudon: I presume all privacy policies have a "you have no privacy" clause; my question was more about how they got the information than what gave them the right to collect it. <p> At most one person on Venmo's suggested-friends list knows the email address that I gave Venmo, but I've texted all of them at some point, so your conjecture that Venmo made the connection via raiding their contacts lists is plausible. (If your comment were an answer, I'd vote for it!) – Targeloid Oct 14 '17 at 21:03
0

I don't know for sure what mechanisms Venmo uses specifically, and I suspect that anyone who does is under non-disclosure, but it is common practice for "social" apps to use a number of signals to make correlations to construct your potential social graphs. See, for example, this very recent article on Facebook's "People You May Know": How Facebook Outs Sex Workers

Even though you did not give access to your Contacts, it's possible that (as many apps do) others close to you in your social circles have given access to Venmo / PayPal / eBay for their contacts, and that may be what populates (part of) Venmo's social graph. Using the same email or phone number for Venmo that you use for other social apps or services could also potentially be compromising you. Venmo has a rather extensive description in their Privacy Policy "THE INFORMATION WE COLLECT" section on Social Web and other information they collect: Venmo Privacy Policy

Location is also a strong signal, and it can come from Location access given to apps (which extends to 3rd-party code running in those apps that can then share or aggregate behind the scenes), or simply coming into proximity of one or more of the same WiFi access points.

If a good correlation can be made to some of your close contacts through some of the available signals, then it's an easy leap to mine their Facebook and other public profiles and graphs to suggest friends of friends (you are likely to know many of these people).

Also in THE INFORMATION WE COLLECT: "Finally, we may collect additional information from or about you in other ways not specifically described here." which means pretty much anything goes. For example, it could include information from data brokers who have aggregated a broad array of data about you and your associations over time.

2

I just signed up for Venmo and was looking to find out how they knew whom to recommend to me. I've concluded that it must be my phone number living in someone's smartphone, because nothing else makes sense.

1

I speak from the same experience (and I'm a web developer). I looked at the list of suggested friends Venmo gave me upon joining (with a socially unconnected gmail address) and wondered the same. The friend pictures appeared to be from Facebook or IG which made me wonder if there was a facebook friend-list api that they accessed without permission. I conclude that they did not, it appears to be contacts shared from other friends that have joined Venmo with their facebook account.

  • Note: If a website wanted to, they could create an xml request that would make a facebook search of your visible friends on facebook by your name which you provided.
  • Note: If a website wanted to (and if you signed up with your confederated facebook account login), they could simply log into your facebook account(which they wouldn't unless they wanted to get class actioned) and view your information. Have you seen your facebook profile(I mean the one that you can download in which they detail your behavior/demo/preferences)? People are giving them so much information and I've seen facebook give a lot of it to other sites that use the confederated login.

They are smart.

  • I arrived at the same conclusion you did at the end of your first paragraph, but through the simpler route of not having a Facebook or Instagram account. – Targeloid Jun 17 '18 at 23:04
1

They use your phone number when you signup. They then cross reference that phone number with peoples contacts who have already downloaded the mobile app and voila they recommend people who have your phone number stored on their phones. I know this because I just got a new phone and it only recommended people whom I gave my phone number to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.