6

I just signed up for a new Venmo account. I did this on my desktop through the web interface rather than on my phone, so none of my phone data is available to it. I do not have a Facebook account, so did not link to one. I do not use Contacts features in email apps, etc., instead managing my contacts manually using files that my web browser does not know how to find. I have not yet linked to any friends, so it can't look up friends-of-friends.

So when Venmo presented me a list of suggested friends and told me "This list is based on your network," I was baffled where it drew this list from. About half the people on this list are people I interact with regularly or semi-regularly. Others are people I have little interaction with or have not spoken to in years, and two are names I don't recognize at all.

Where is Venmo getting this list from?

4
  • Perhaps, but almost none of the others on the list are people I've had PayPal/eBay interactions with. For obvious reasons, a couple of suggested random strangers is less of a privacy concern than all the people I know and used to know.
    – Targeloid
    Oct 9 '17 at 13:58
  • Even though you did not give access to your Contacts, it's possible that (as many apps do) others close to you in your social circles have given access to Venmo/PayPal/eBay for their contacts, and that may be what populates Venmo's social graph. Using the same email for Venmo that you use for other social apps/services could also potentially be compromising you. Venmo has a rather extensive description in their Privacy policy "THE INFORMATION WE COLLECT" section on Social Web Information they collect: venmo.com/legal/us-privacy-policy
    – pseudon
    Oct 9 '17 at 23:28
  • Also: "Finally, we may collect additional information from or about you in other ways not specifically described here." which means pretty much anything goes.
    – pseudon
    Oct 9 '17 at 23:30
  • @pseudon: I presume all privacy policies have a "you have no privacy" clause; my question was more about how they got the information than what gave them the right to collect it. <p> At most one person on Venmo's suggested-friends list knows the email address that I gave Venmo, but I've texted all of them at some point, so your conjecture that Venmo made the connection via raiding their contacts lists is plausible. (If your comment were an answer, I'd vote for it!)
    – Targeloid
    Oct 14 '17 at 21:03
2

I don't know for sure what mechanisms Venmo uses specifically, and I suspect that anyone who does is under non-disclosure, but it is common practice for "social" apps to use a number of signals to make correlations to construct your potential social graphs. See, for example, this very recent article on Facebook's "People You May Know": How Facebook Outs Sex Workers

Even though you did not give access to your Contacts, it's possible that (as many apps do) others close to you in your social circles have given access to Venmo / PayPal / eBay for their contacts, and that may be what populates (part of) Venmo's social graph. Using the same email or phone number for Venmo that you use for other social apps or services could also potentially be compromising you. Venmo has a rather extensive description in their Privacy Policy "THE INFORMATION WE COLLECT" section on Social Web and other information they collect: Venmo Privacy Policy

Location is also a strong signal, and it can come from Location access given to apps (which extends to 3rd-party code running in those apps that can then share or aggregate behind the scenes), or simply coming into proximity of one or more of the same WiFi access points.

If a good correlation can be made to some of your close contacts through some of the available signals, then it's an easy leap to mine their Facebook and other public profiles and graphs to suggest friends of friends (you are likely to know many of these people).

Also in THE INFORMATION WE COLLECT: "Finally, we may collect additional information from or about you in other ways not specifically described here." which means pretty much anything goes. For example, it could include information from data brokers who have aggregated a broad array of data about you and your associations over time.

2

I just signed up for Venmo and was looking to find out how they knew whom to recommend to me. I've concluded that it must be my phone number living in someone's smartphone, because nothing else makes sense.

2

They use your phone number when you signup. They then cross reference that phone number with peoples contacts who have already downloaded the mobile app and voila they recommend people who have your phone number stored on their phones. I know this because I just got a new phone and it only recommended people whom I gave my phone number to.

1

I speak from the same experience (and I'm a web developer). I looked at the list of suggested friends Venmo gave me upon joining (with a socially unconnected gmail address) and wondered the same. The friend pictures appeared to be from Facebook or IG which made me wonder if there was a facebook friend-list api that they accessed without permission. I conclude that they did not, it appears to be contacts shared from other friends that have joined Venmo with their facebook account.

  • Note: If a website wanted to, they could create an xml request that would make a facebook search of your visible friends on facebook by your name which you provided.
  • Note: If a website wanted to (and if you signed up with your confederated facebook account login), they could simply log into your facebook account(which they wouldn't unless they wanted to get class actioned) and view your information. Have you seen your facebook profile(I mean the one that you can download in which they detail your behavior/demo/preferences)? People are giving them so much information and I've seen facebook give a lot of it to other sites that use the confederated login.

They are smart.

1
  • I arrived at the same conclusion you did at the end of your first paragraph, but through the simpler route of not having a Facebook or Instagram account.
    – Targeloid
    Jun 17 '18 at 23:04
-1

You provide a phone number (and recently, a "REAL" number: can't use Google Voice or other VoIP numbers), and an e-mail to sign up.

Whoever has that e-mail OR phone number saved to either their phone's contacts or facebook's contacts (YOU don't have to be on FB for your friends to save you on that app's/site's contacts) AND allowed Venmo to access that information helped create your network.

Most people are not diligent about privacy, so they don't immediately check privacy settings. When our friends allow access to "their" contacts, they are actually allowing access to OUR/YOUR information.

I just re-signed for a new venmo account using a brand new number that I've only shared with three family members, but upon signing up I had two suggestions: 1. a sibling 2. a person who'd sent my number an SMS after they mis-typed a new contact. Both these people saved my number to their phone's contacts, and allowed Venmo to access that information.

I immediately told my sibling to turn off that setting, which they did, but they are still recommended. Once a contact is linked, they do not disappear because you change your contact information or they change their privacy settings.

Venmo's friends suggestions are cumulative: if/when you update your phone or e-mail, those remain in their database, forever mapping you to old contacts, and contacts with your new info are just appended.

The best part about the Venmo social-list is that they are TRANSPARENT about who they map to you: instagram/fb/whatsapp google, apple, microsoft do the same, but don't display their full mapping.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.