Is Monzo requiring access to contacts for joint account opening / Monzo.me necessary & secure?

[alexs (Alex Sherwood)]

@Gaoler

Shame that these big features are predicated on unnecessary exposure of users’ contacts.

I’m not quite sure what you’re imagining there. Here’s how Monzo secure’s that data -

@jgarnham

What does Monzo do with my contacts?
We never send or store your full address book on our servers and we won’t spam or get in touch with your contacts without your permission, nor share their information outside of Monzo. If you’re interested in the details, you can read more below.

What do people see when I pay them?
Anyone you send money to from within the Monzo app will see your name, any message you added, and the amount of the payment. Additionally, those who don’t already have your phone number will be able to see your number and add it to their address book so they can send money back to you.

The details
We wanted to build Monzo payments in the most privacy friendly way we could, whilst still making it as simple and easy to use for our customers as possible. We never send or store your full address book on our servers, instead we use the following process to check if your contacts already use Monzo:

1. Your device generates a hash for each of the contacts in your address book
2. Your device then uploads a portion of that hash to the Monzo servers
3. The server checks if the hash matches any existing users and if it does, sends your device a slightly larger portion of the hashed contact
4. Your device then matches the larger hash with its existing hash to confirm the correct contact record has been matched
5. If there’s a match, we show you that contact as a Monzo contact. If there’s no match, the hash is deleted from the server and Monzo never sees any of the contact’s information.
6. The server never receives any of your contacts’ phone numbers, names or any other personal details during this process. The only time we transmit their full phone number is when you actually send money to that person and this is fully encrypted in transit, stored securely as part of our banking infrastructure, and only sent once you’ve confirmed the payment using your PIN or fingerprint.