Is Monzo requiring access to contacts for joint account opening / Monzo.me necessary & secure?

[kieranmch (Kieran McHugh)]

@Gaoler

Again, that will depend on who you are and who your contacts are.
If you’re building a bank, you should probably build for as wide a spectrum of people as possible.
Maybe the mindset here is that all monzo users are or should be tech savvy and used to living life online in a very trusting way without much fear of the consequences. Share all your contacts? Oh, I’ve done that loads of times!
In current times, such attitudes are a bit strange.

At Monzo we use Private Contact Discovery. We do not store your phone contacts on our backend, and our backend doesn’t even see their phone numbers or personal details. Here is a summary of the protocol.

@jgarnham

What does Monzo do with my contacts?
We never send or store your full address book on our servers and we won’t spam or get in touch with your contacts without your permission, nor share their information outside of Monzo. If you’re interested in the details, you can read more below.

The details
We wanted to build Monzo payments in the most privacy friendly way we could, whilst still making it as simple and easy to use for our customers as possible. We never send or store your full address book on our servers, instead we use the following process to check if your contacts already use Monzo:

1. Your device generates a hash for each of the contacts in your address book
2. Your device then uploads a portion of that hash to the Monzo servers
3. The server checks if the hash matches any existing users and if it does, sends your device a slightly larger portion of the hashed contact
4. Your device then matches the larger hash with its existing hash to confirm the correct contact record has been matched
5. If there’s a match, we show you that contact as a Monzo contact. If there’s no match, the hash is deleted from the server and Monzo never sees any of the contact’s information.
6. The server never receives any of your contacts’ phone numbers, names or any other personal details during this process. The only time we transmit their full phone number is when you actually send money to that person and this is fully encrypted in transit, stored securely as part of our banking infrastructure, and only sent once you’ve confirmed the payment using your PIN or fingerprint.

[Gaoler]

Thanks for the reminder Kieran.
I understand this process.
Unfortunately, it relies on trusting the server.

What method does Monzo use for remote attestation?

[Gaoler]

At risk of flogging a dead horse, how does Monzo get consent from users for their data to be shared in this way?

Surely it requires explicit consent for Monzo to share one user’s data with another user.

[alexs (Alex Sherwood)]

The only data that’s being shared is the fact that one of your contacts is a Monzo user. The person who’s being shown as a Monzo user has to opt in before that information is shared. You’d see that if you took a look at the feature.

[Gaoler]

Screenshots would be a pleasure. I can’t see any request for consent when the app asks for contact access. Where is the consent obtained?

[alexs (Alex Sherwood)]

I’d suggest you try it & see for yourself.

[Gaoler]

Er, no. I’d prefer to understand the gdpr angle first

[Rat_au_van (Em)]

Monzo aren’t sharing it. By turning on the feature you are deciding to share it with anyone in your contact list who has also decided to share theirs.

[Gaoler]

There’s mention of this with a very short reference to Monzo here