Computer Science Student Shows Venmo Transactions Can Be Easily Acquired

Computer Science Student Shows Venmo Transactions Can Be Easily Acquired

A year after a privacy researcher showed the world that Venmo transactions could be easily accessed, a computer science student scraped seven million Venmo transactions to increase awareness of the issue.

A computer science student, Dan Salmon, has been scraping Venmo transactions for the past six months to prove that Venmo’s public activity is not hard to obtain, even after last year, when a privacy researcher showed that Venmo need to curb its privacy issue. The result is that seven million Venmo transactions were obtained by Salmon in this six-month period.

Salmon told TechCrunch he did this in order to raise awareness and encourage users to set their transactions to private. He said that despite Venmo changing their privacy policy, it is still easy to gain access to millions of transactions through Venmo’s developer API. User permission is not necessary to access this information.

“There’s truly no reason to have this API open to unauthenticated requests,” he told TechCrunch. “The API only exists to provide like a scrolling feed of public transactions for the home page of the app, but if that’s your goal, then you should require a token with each request to verify that the user is logged in.”

Sam Bakken, the senior product marketing manager at OneSpan, said that Venmo purposefully designed the homepage news feed feature in order to increase engagement, and some users enjoy looking through the feed to see what their friends are doing. This means that some users leave their transactions available to the public on purpose. He said that he hopes this information will encourage some users to go private with their information.

“Users do have the ability to decide whether their transactions are shared publicly or with friends or not at all,” Bakken said. “I’d argue Venmo should default to keeping users’ transactions private, and if this incident doesn’t convince Venmo to change their policy – I hope at least more people will become aware of this and consider changing their settings.”

Ameya Talwalkar, co-founder and CPO of Cequence Security, said that scraping attacks are becoming increasingly harder to prevent due to the hyper-connectivity culture of this age.

“Many of today’s hyper-connected organizations are faced with the challenge of how to address content scraping attacks in an efficient and scalable manner,” Talwalkar said. “The impact of this attack can be wide-ranging, starting from overspending on infrastructure to devastating loss of intellectual property. Of all the automated business logic abuse attacks, content scraping is the most difficult to prevent.”

About the Author

Kaitlyn DeHaven is the Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.


  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West: Day 2

    What a great show ISC West 2024 has been so far. The second day on Thursday was as busy or even more hectic than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Sands Expo, because there’s more news coming out than anyone could be expected to keep track of. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity


New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • ResponderLink


    Shooter Detection Systems (SDS), an company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3