In March, Vanessa Acuña received an email from PayPal asking her to update her debit card information since the debit card linked to her account had expired. Because Acuña, who lives in Vancouver, rarely used the online payment service, she ignored the request.
Turns out, PayPal didn’t need her to take any action after all.
“Two days afterwards, I got another email saying, ‘Oh we updated for you, so you don't have to.’ And I just thought ‘what?’” Acuña told the CBC on Sunday.
She called PayPal, which told Acuña that they’d received her updated debit card information from her “financial institution or her credit card company.”
Acuña was stunned, but others were less surprised. Thomas Keenan, who wrote a book, Technocreep, on how technology has compromised privacy, said that banks and credit card companies are often paid by companies to to share customer information.
“Banks make a business out of information sharing,” he said.
Many credit card companies have what they call an “updater” service that automatically gives updated credit card information — including account numbers and expiry dates — to subscribing merchants. The purpose of this service is to help customers and merchants alike avoid missing recurring payments.
Credit card companies often opt their customers into the service, but because this policy is embedded in the fine print of credit card agreements, few customers are aware that this is happening.
Acuña thinks that the updater service gave her information to PayPal, but that didn’t explain why information for her debit card — and not her credit card — was disclosed. Under the updating agreement with TD, her bank, only credit card information can be shared with merchants.
When she contacted TD and Visa, both companies denied giving her debit card information to PayPal.
When the CBC reached out to PayPal, the company said that it had received Acuña’s information from “account update services.” But a few days later, the company backtracked, saying that the service “doesn’t apply” to Acuña’s case.
Acuña agreed to waive customer confidentiality to allow the company to answer CBC’s questions, but PayPal will not disclose how it received her information. TD and Visa also declined to take responsibility.
Acuña said that she is not against providing merchants with her information — but she wants to be able to control where that information goes.
“I'm capable of putting in my information online if I need to. It's not a hassle for me,” she said.