Venmo in hot water over account hacks

Millennials’ preferred mobile payment app is facing questions about apparent security holes that make it easier for hackers to take over user accounts.

Venmo, which processed $700 million in payments during the third quarter last year, is in the hot seat after Slate documented several user complaints about fraud in the service.

{mosads}One of the individuals featured was a New York City Web developer named Chris Grey who discovered last week that his Venmo account had been compromised.

An unauthorized user had broken in, changed the password, added a new email address, disabled notifications and stolen $2,850 of Grey’s money.

Grey’s main complaint was that Venmo never notified him, when major account settings were changed, something users can usually expect from online payment and other services.

The app also does not require two-factor verification, instead relying on the less secure but traditional combination of a user name and password. 

“There are basic security holes that you could drive a truck through,” Grey told Slate.

The anecdote sums up user complaints about Venmo security that are publicly visible on Twitter and other online forums.

Grey and others have also criticized the application for failing to respond in a timely way to alerts about fraud.

The company is a relative upstart in the world of mobile payments. Launched in 2011, it had fewer than 100 employees at the end of last year.

Venmo was acquired by payment company Braintree in 2012, which was then acquired by PayPal in 2013, making both it and Venmo part of the group of businesses owned by eBay.