Is Monzo requiring access to contacts for joint account opening / Monzo.me necessary & secure?

[kieranmch (Kieran McHugh)]

@Gaoler

Again, that will depend on who you are and who your contacts are.
If you’re building a bank, you should probably build for as wide a spectrum of people as possible.
Maybe the mindset here is that all monzo users are or should be tech savvy and used to living life online in a very trusting way without much fear of the consequences. Share all your contacts? Oh, I’ve done that loads of times!
In current times, such attitudes are a bit strange.

At Monzo we use Private Contact Discovery. We do not store your phone contacts on our backend, and our backend doesn’t even see their phone numbers or personal details. Here is a summary of the protocol.

@jgarnham

What does Monzo do with my contacts?
We never send or store your full address book on our servers and we won’t spam or get in touch with your contacts without your permission, nor share their information outside of Monzo. If you’re interested in the details, you can read more below.

The details
We wanted to build Monzo payments in the most privacy friendly way we could, whilst still making it as simple and easy to use for our customers as possible. We never send or store your full address book on our servers, instead we use the following process to check if your contacts already use Monzo:

1. Your device generates a hash for each of the contacts in your address book
2. Your device then uploads a portion of that hash to the Monzo servers
3. The server checks if the hash matches any existing users and if it does, sends your device a slightly larger portion of the hashed contact
4. Your device then matches the larger hash with its existing hash to confirm the correct contact record has been matched
5. If there’s a match, we show you that contact as a Monzo contact. If there’s no match, the hash is deleted from the server and Monzo never sees any of the contact’s information.
6. The server never receives any of your contacts’ phone numbers, names or any other personal details during this process. The only time we transmit their full phone number is when you actually send money to that person and this is fully encrypted in transit, stored securely as part of our banking infrastructure, and only sent once you’ve confirmed the payment using your PIN or fingerprint.