How Safe Is Venmo and Is It Free?

Venmo has been billed as the payment app for Millennials and is known for making the most awkward part of the night (splitting the bill) more bearable. It’s also one of the most popular apps in the peer-to-peer (P2P) payments space.

Founded in 2009, Venmo began as a payment system through text message. Then, to capitalize on the growing P2P economy, the company introduced a platform with an integrated social network in March 2012. It caught on quickly, and less than six months later Braintree (the payment system for apps including Airbnb and Uber) acquired Venmo for $26.2 million. Less than a year later, the payment company PayPal Holdings Inc. bought Braintree for $800M.

In 2018, Paypal started to monetize Venmo’s user base. This was good news for the company. However, Venmo is far from out of the woods, facing security concerns and mounting competition. And in a crowded marketplace, security concerns can be all the more damning.

Here, we take a look at Venmo: how it works, how it makes money, security concerns and competition in the industry.

The Technical Side

It’s pretty simple. By linking a credit card, debit card or checking account to their account, Venmo users can exchange funds with one another and send each other charges. Funds exchanged on Venmo can either be stored in the on-platform Venmo balance for later use on the platform, or cashed out to a bank account, which takes a few days to process. Like WePay and other payment platforms, Venmo has an application programming interface that allows websites and businesses to add Venmo to their payment services.

Venmo can be understood as a middleman between the bank accounts of its users. When you send money to a friend using Venmo, it doesn’t go directly to your friend’s bank account. First, it goes to Venmo. The app then lowers your Venmo balance and raises your friend’s balance to reflect the payment. However, the money doesn’t actually leave your bank account until your friend transfers his Venmo balance to his bank account. This means that you and your friend can send money back and forth on Venmo without either bank account balance ever actually changing. Only the Venmo balances fluctuate.

A Venmo balance is a ledger that represents funds and transactions without actually executing them outside the Venmo platform.

In a sense, your balance on Venmo is essentially virtual money: Until it is transferred to a bank, it isn’t actually in the user's possession. (This is a little different when using a Venmo debit card, but we’ll get to that later.)

The Social Side

There are only so many ways a P2P application can work. How has Venmo differentiated itself?

The answer is target demographics and the user experience, which are closely linked.

Venmo has taken something awkward—the money owed between friends (Millennials)—and turned it into a conversation. “Sending your friends a note and including an emoji [like a wine glass or a winged stack of cash] takes the awkwardness out of asking your friend to pay back their portion of the bar tab last night,” said Venmo spokesman Josh Criscoe in an interview with Moneyish. “Venmo has married the social element and the financial element, which no one else has been able to crack.”

For the most part, Venmo is a free-to-use platform. While most free-to-use platforms turn to advertisements for revenue, Venmo has managed to avoid this route.

While Venmo is mostly free for individuals, the company does generate revenue through fees levied on merchants.

According to Venmo’s website, sending money using Venmo comes with a standard 3% fee, but the company waives that expense when the transaction is funded with your Venmo balance, bank account or debit card. There is a 3% fee that is not waived for credit card payments. According to Venmo’s website, this fee originates with the credit card companies. Venmo is simply passing the cost onto consumers.

Transferring money out of Venmo is a bit different. Standard transfers (which take 1-3 business days) are free. In 2018, the company added a fee structure for Instant Transfers, which place the money in your account in as short a time as 10 minutes. In January 2018, Venmo began charging 25 cents for Instant Transfers. Since November 2018, the company deducts 1% of the transfer amount, with a minimum of 25 cents and a maximum of $10.

A more significant revenue stream comes from the per-transaction fees charged to merchants, and Venmo’s social media feed plays a substantial role here. Thanks to Paypal’s infrastructure, Venmo is now compatible with more than 2 million merchants, almost as many as PayPal itself. This compatibility comes in two forms.

The first is a “smart payment button” that can be integrated into apps for in-app purchases. For instance, In July 2018, Uber announced that it was adding a service to allow its mobile app users to pay for rides and Uber Eats using Venmo, without leaving the Uber app. The money can be drawn from the in-app Venmo balance, an associated debit or credit card, or a linked bank account. Additionally, the cost of the ride or food can be split with other users.

The second is a debit card, the Venmo card, which draws directly from a user’s Venmo balance. This card operates through Mastercard and can be used at any business that accepts Mastercard.

This move has helped Venmo pivot from an exclusively social P2P platform to a company involved at points of sale, both online and at brick-and-mortar stores. In an interview with Digiday, Javelin Strategy and Research analyst Rachel Huber said, “a card familiarizes [Venmo’s] brand with merchants as a payment mechanism—and merchants are going to be the biggest factor in Venmo achieving profitability. Think marketing and loyalty tie-ins, integration fees, and promotional deals.”

In both cases, Venmo charges merchants a 2.9% plus a 30-cent transaction fee, which is at the higher end of fees charged.

Venmo justifies these rates in a couple of ways. Also according to Huber, “Venmo has access to an extremely desirable consumer segment—expect them to use that to their advantage.”

But it isn’t just the consumer demographics, it’s also the kind of access it has.

In an interview with The Atlantic, Richard Crone, who runs a payments-focused firm called Crone Consulting, said “You walk into any retailer, any restaurant, any service provider—what do they want you to do? Like them on Facebook, follow them on Twitter.” Partnering with Venmo, he said, is like partnering with a credit-card processor, “but with much more upside, because the retailers spend far more trying to get you to like them on Facebook and follow them on Twitter and all these other things that they could just get as a byproduct of the payment.” People can see where their friends have been and what they’ve been buying. It turns the user, and people’s friends, into advertisements for businesses, among a highly desirable target demographic.

This is just the beginning of the value Venmo offers. According to the same Atlantic article, “the other more lucrative aspect of becoming merchants’ preferred means of payment is access to information about where customers are spending their money.” Crone says “the real value is in the data, and the ability to render customized ads and offers, and generate a revenue stream from that.” Crone Consulting has estimated that the data of an active user’s mobile payments is “worth more than $400 per year in revenue, to whoever does it.” Venmo has a lot of users. (Verto Analytics estimates about 10 million.) 

Currently, this data is recorded by the companies facilitating the transaction: banks and credit card companies. However, if users start using Venmo instead of their credit cards at points of sale, the information will show up to the banks only as a Venmo transaction. That probably has something to do with Venmo’s mounting competition, but we’ll get to that in a second.

While it’s hard to precisely ascertain Venmo’s revenue, it is adding users faster than ever, and is processing more money every quarter. In the last quarter of 2018, it processed $19 billion in volume, up 55% from a year earlier. PayPal, however, reported $15.4 billion in revenue for 2018.

Nothing connected to the internet is completely safe. Therefore, applications that are directly linked to consumer’s bank accounts, like Venmo, must be held to the highest security standards.

Venmo uses data encryption to protect users against unauthorized transactions and stores user information on servers in secure locations. Venmo also allows users to set up a PIN code for mobile application use for additional security, though it does not compel users to set one up, by default. These measures may seem sufficient at first glance, but they have been bypassed by hackers and scammers. Venmo has been repeatedly criticized for security breaches of user accounts and painfully slow customer service.

While Venmo’s security, encryption and liabilities insurance ostensibly protect users from losses, they are easy to circumvent. After gaining access to a user’s account, hackers can easily change passwords, linked email addresses and bank accounts unbeknownst to the legitimate user. This allows the hacker to make transactions on an account and transfer a user’s Venmo balance to a new bank account. By changing the user’s linked email address, the hacker can reroute users' transaction notifications, leaving them in the dark until the bank notifies them of balance changes, which can be days after the theft. Stories of Venmo users losing up to $3,000 have been widely reported.

Venmo’s use of text messages (SMS) to notify users of a charge presents another security risk. Users can authorize a charge by replying to an SMS they receive from Venmo with a six-digit code included in the original message. By exploiting security weaknesses in operating systems that Venmo must interact with in order to send notifications, such as iOS, Apple’s mobile operating system, researcher Martin Vigo was able to use the platform's SMS notifications to make unauthorized payments. As far as hacks go, Vigo’s method is relatively easy to replicate. Thus, it is no surprise that hacked Venmo accounts are common. Reddit and other online forums are filled with posts from users asking for help after their Venmo accounts were been hacked. Losses can be as high as $2,999, the maximum balance anyone can have in their Venmo account before transferring off the platform.

Despite the potential dangers, users can protect themselves from hacking by following some best practices. These include:

• Never store large amounts of money in your Venmo balance. Always transfer Venmo transactions to your bank account right away.
• Only use Venmo to exchange funds with people you actually know. Do not use Venmo to purchase things from individuals you have never met or have met online.
• Opt out of Venmo’s social network. The default setting for a new Venmo account is “public,” meaning Venmo will publish your transactions onto its public feed. Users can change this setting to “private,” which keeps their transactions hidden.
• Turn on notifications—Push, Text, Email, or some combination—in order to keep track of login attempts, requests and payments received, and requests and payments sent.
• Set up available security measures, like a PIN and Touch ID.

As consumers continue to embrace digital alternatives to payments by cash and check, user confidence in the security of P2P payments must increase. The Federal Trade Commission provides consumers with protection policies to losses incurred from debit or credit card theft. These laws, on top of company policies, protect the consumer from unauthorized charges. Additionally, emerging markets have the potential for adopting mobile payment systems, specifically in the realm of remittances. This increases the need for greater security in P2P, as an unsecured, globally integrated payment system could have damaging ramifications. Unfortunately, mobile payment platforms remain vulnerable to internet-related security breaches.

It’s worth noting, too, that in May 2016, Texas Attorney General Ken Paxton announced a settlement with Paypal Inc. regarding Venmo’s privacy, safety and security. The settlement included a $175,000 payment to the state, as well as reforms of these practices.

In March 2018, Venmo reached a settlement with the Federal Trade Commission. According to a press release from the commission, the settlement concerned the company’s failure to disclose information to consumers about the ability to transfer funds and privacy settings. The FTC also found the company in violation of the Gramm-Leach-Bliley Act’s Safeguards Rule, “which requires financial institutions to implement safeguards to protect the security, confidentiality and integrity of customer information,” and the Privacy Rule, “which requires financial institutions to deliver privacy notices to consumers.”

Venmo was required to obtain biennial, third-party assessments of its compliance with the terms of the settlement for the next 10 years. Violations of these terms could result in a civil penalty up to $41,484 for each.

So, while the company’s record on security, privacy and disclosure is far from perfect, there do seem to be some institutional and legal measures in place to address these shortcomings.

The P2P economy is here to stay, and mobile P2P payments is the fastest-growing sector of this industry. However, according to estimates from eMarketer, growth may be starting to slow. In 2017, the US P2P mobile payment transaction value was $120 billion, and was forecast to double to $240 billion by 2018. Those same estimates saw the U.S. P2P mobile payment transaction value increasing roughly 30% from 2017 to 2018 or $120 billion to $156 billion, respectively.

Tech companies and banks are racing to penetrate the P2P market—but entrants come and go. Square, a P2P company started by Jack Dorsey, a co-founder of Twitter, supposedly turned down a $3 billion deal with Apple. Apple went on to release Apple Pay, which is now accessed through numerous banks in the United States, Canada, and around the world. In partnership with Square in 2014, Snapchat started a mobile pay service, which ended in August 2018.

Other tech titans like Alphabet Inc. and Facebook, Inc. have penetrated the mobile payments market as well. Facebook incorporated a money transfer service into Facebook Messenger, allowing users to link debit cards and transfer money as easily as sending a text.

Banks are also hopping on the P2P train. Zelle, a P2P payment app that launched in the summer of 2017, is owned by seven major banks: Bank of America, BB&T, Capital One, JPMorgan Chase, PNC Bank, US Bank and Wells Fargo. This is significant because it allows users to transfer money directly between bank accounts without having to use an intermediary. This alleviates some of the risk of P2P transactions.

Needless to say, the marketplace is saturated and highly competitive. While Venmo is one of the most successful P2P payment applications, staying in a dominant market player depends on successful expansion, namely by making a play for more traditional transactions at points of sale.

Muscling into that space shouldn’t be hard, especially on the back of a robust consumer segment that the company will use to its advantage. From here it can grow the revenue streams beyond the transactions themselves to partnerships and promotional deals, leveraging its social feed as a form of marketing to entice users. Moving into that space, Venmo would also be sitting on a goldmine of user data that it could look to potentially monetize. For now, though, the company is investing (somewhat paradoxically) in the security, confidentiality and privacy of its users’ information.

Despite these challenges, Venmo looks well positioned to compete in the payments business in the near future.