From The Consumerist comes a story about Mint.com (a personal finance management service that aggregates one’s accounts) notifying their customers about fraud:
A couple days ago, we wrote about a fake company called Adele that was fraudulently charging 25 cents to credit cards. Personal finance site Mint heard about the scam too, and they reviewed their users’ records and notified them if they found a fraudulent charge.
At the end of the article, the author brings up the question of whether Mint’s searching through their customers’ records was a violation of privacy.
So far, there seem to be a few basic opinions that are repeated in the comments:
- It’s good that they did this, but it’s somewhat disturbing at the same time (which seems to be the opinion of the Consumerist’s original poster as well).
- What’s the big deal? Privacy only matters if you’re not doing anything wrong.
- No one actually went through the records, it was just a quick query.
The first opinion is actually the one I share. The fact that something like this is possible is one of the major reasons I opted not to use Mint when I looked at their service a while back. At the same time, I realize that Mint users don’t share my opinion on this. Their tolerance for this sort of intrusion is much higher than mine, or they wouldn’t be Mint users in the first place.
I don’t think Mint did anything wrong. In fact, I think that this is simply an additional bit of value added to the service for most of their users (because, again, by virtue of being Mint users, I assume that they aren’t as fanatical about privacy as some others).
I strongly believe that the second opinion is wrong, and, honestly, pretty much unworthy of response, but I’m going to waste a few seconds responding in brief. Why would anyone want to maintain privacy if they’re doing nothing (that they believe to be) wrong? What if an individual donated a small amount of money (low enough that it didn’t have to be publically released) to, say, Proposition 8 in California? Given the actions of anti-Proposition 8 activists since the election, I can absolutely understand why those individuals might want their donation to be kept private[].
The reason I’m writing this post, actually, is the third opinion that I’ve cited. Several Consumerist readers have written responses that read like this: “No one sat down and looked at every charge, they simply ran a database query.” Some of these responses even seem to indicate that no one at Mint even could look at your charges, even if they wanted to.
If no one can get access to a database, then it’s useless. If someone at Mint has the ability to write a query that says “select all records with a payee of ‘Adele Services’”, the ability to run that query on the Mint DB, and the ability to generate an e-mail notifying everyone who had a transaction in the resulting list of records that they may have been the victim of fraud, I am completely certain that same person has the ability to search for users who paid money to become a member of relatively-embarassing-website.com. I’m relatively certain that same person could also query the database to see every business their former (or even current) significant other is paying money to, assuming said (F)SO is a user of the service.
I’m not arguing that anyone at Mint would do these things[], only that they could, and whether they’re thumbing through physical records or running a query in a database is a trivial distinction.