Millions of Venmo transactions scraped in warning over privacy settings

A computer science student has scraped seven million Venmo transactions to prove that users’ public activity can still be easily obtained, a year after a privacy researcher downloaded hundreds of millions of Venmo transactions in a similar feat.

Dan Salmon said he scraped the transactions during a cumulative six months to raise awareness and warn users to set their Venmo payments to private.

The peer-to-peer mobile payments service faced criticism last year after Hang Do Thi Duc, a former Mozilla fellow, downloaded 207 million transactions. The scraping effort was possible because Venmo payments between users are public by default. The scrapable data inspired several new projects — including a bot that tweeted out every time someone bought drugs.

A year on, Salmon showed little has changed and that it’s still easy to download millions of transactions through the company’s developer API without obtaining user permission or needing the app.

Using that data, anyone can look at an entire user’s public transaction history, who they shared money with, when, and in some cases for what reason — including illicit goods and substances.

“There’s truly no reason to have this API open to unauthenticated requests,” he told TechCrunch. “The API only exists to provide like a scrolling feed of public transactions for the home page of the app, but if that’s your goal then you should require a token with each request to verify that the user is logged in.”

He published the scraped data on his GitHub page.

Venmo has done little to curb the privacy issue for its 40 million users since the scraping effort blew up a year ago. Venmo reacted by changing its privacy guide and, and later updated its app to remove a warning when users went to change their default privacy settings from public to private.

How to change your Venmo privacy settings.

Instead, Venmo has focused its effort on making the data more difficult to scrape rather than the underlying privacy issues.

When Dan Gorelick first sounded the alarm on Venmo’s public data in 2016, few limits on the API meant anyone could scrape data in bulk and at speed. Other researchers like Johnny Xmas have since said that Venmo restricted its API to limit what historical data can be collected. But Venmo’s most recent limits still allowed Salmon to spit out 40 transactions per minute. That amounts to about 57,600 scraped transactions each day, he said.

Last year, PayPal — which owns Venmo — settled with the Federal Trade Commission over privacy and security violations. The company was criticized for misleading users over its privacy settings. The FTC said users weren’t properly informed that some transactions would be shared publicly, and that Venmo misrepresented the app’s security by saying it was “bank-grade,” which the FTC disputed.

Juliet Niczewicz, a spokesperson for PayPal, did not return a request for comment.