Square has reportedly leaked sensitive payment information to other customers, highlighting the need for more private payment solutions.
According to a Wall Street Journal report, Square, the popular retail point-of-sale system, accidentally sent payment receipts to the wrong email address, divulging personal financial information to unintended third parties. This has ranged from affecting regular purchases such as coffee to more sensitive transactions such as divorce attorneys and holiday presents. Receipts were sent automatically after cards were entered for payments, many of them to the wrong recipient.
The privacy dangers of identity-linked payments shown in massive data breaches
The incident highlights a privacy issue inherent in payment systems that can be easily linked to personal identity. When a card is used through a payment processor such as Square, and an email is used to receive a receipt, that card number can be kept on file and associated with that personal identity moving forward. This can lead to a single party having access to a significant chunk of a consumer’s financial activity, leading to further issues if said said information is leaked in a data breach.
This latest privacy breach joins a string of similar high-profile incidents over the last few years. Last year Venmo was found to leak private purchase data by default, publishing all purchases to social media. Earlier this year millions of credit card numbers were stolen from a popular chain of restaurants, while a data breach by Mariott hotels late last year caused the private information, including some card information, of 500 million guests to be exposed, recalling the Equifax incident of over 200,000 credit card numbers compromised the year prior. Finally, Amazon customer logins and emails were leaked late last year, and earlier in 2018 Amazon and Mastercard were found in a data-sharing partnership to close the loop on missing customer purchase data.
Functions such as PrivateSend may one day become standard for payments
Cryptocurrency stands as a strong alternative for private purchases since typically addresses are not associated with personal identity, and in most modern wallets a new address is generated for every payment, decreasing the chance of association with any particular individual. However, even using cryptocurrency for purchases can result in incomplete privacy. Certain privacy attacks, such as the dusting attack, can be used to associate addresses and attempt to decipher users, and a study from Princeton University revealed that Bitcoin transactions could be correlated and linked to individual identities through online purchases revealing email addresses an other identifying information. As such, using advanced privacy features and techniques, such as Dash’s PrivateSend, as well as adopting best practices for private transactions, can protect an individual shopper’s information from unwanted data breaches.
