If you decide you’re game enough to use Twitter’s new feature to send strangers on the internet money, do your best not to accidentally send them your residential address, too.
To explain, you may have heard something about “Tip Jar,” which the company soft launched Thursday, heralding it as a way “for people to send and receive tips.” The new feature, which is available via the mobile app on Android and iOS, allows users to send money to other accounts using a variety of third-parties. It’s very easy to operate: By clicking on a dollar bill icon next to a person’s username, you will be presented with a list of options for how to donate: Venmo, Cash App, Bandcamp, Patreon, PayPal, and so on. Choosing a payment option redirects you to the selected third-party’s platform to allow a transaction to occur. You’ll want to rush to do this as a way to...uh, reward good tweets? Yes, the point of the whole enterprise isn’t entirely clear, but do people really need a reason to throw more money around on the internet? Ostensibly Twitter is trying to become a bigger playground for creators and this will help with that.
Anyway, the Twit-Tips are currently undergoing a trial run, with a number of creators, journalists, and non-profits acting as guinea pigs that Twitter users can send money to, though allegedly the feature will soon have a wider release. Currently, it’s only available for people using Twitter in English.
As is usually the case with new things, users were quick to point out some stuff that wasn’t totally hunky dory. Rachel Tobac, a security professional, was playing around with the app when she noticed what initially seemed like a glaring security risk. Tobac discovered that if you specifically used PayPal to send someone a tip, you will also be sending them a fairly intimate detail: your home address. This doesn’t appear to be an issue for any of the other pay applications set up through Tip Jar.
In a Tweet shared by Tobac, an image of a receipt for the PayPal donation clearly shows the sender’s residential address.
“This is EXACTLY what I was concerned to test when Twitter announced Tip Jar. PayPal needs to make it crystal clear which data is given to money receivers and stop sharing that data, & Twitter needs to educate users who don’t realize what info tip receivers get when using PayPal,” Tobac tweeted.
Kayvon Beykpour, product lead at Twitter, quickly replied to her comments: “this is a good catch, thank you. we can’t control the revealing of the address on Paypal’s side but we will add a warning for people giving tips via Paypal so that they are aware of this.”
However, it turns out this is not some sort of weird bug, it’s just a feature of how PayPal payments work. Specifically, there are two different modes by which payments can be made and received on PayPal accounts—one of which requires the disclosure of your address because it is pegged to “Goods and Services,” i.e., deliveries. So, we can surmise, Tobac was using this mode to send her tip. It is certainly something that customers should be aware of, said Tom Hunter, Senior Manager of Global Communications with PayPal, in an email. Hunter said:
When using PayPal to send and receive money, there are two options a customer can select before processing the payment on how that money is sent. “Goods and Services” is used to buy or pay for an item or service from someone and will automatically share the customer’s address with the recipient for the delivery of those goods and services. Customers can toggle within the payment flow to select “Friends and Family” which does not share the address with the recipient. This is the standard functionality of the PayPal app and we will work with Twitter closely to ensure user awareness.
While this isn’t a glaring security risk, it is certainly a good thing for users to know about. Sending your address out willy nilly on the internet is generally frowned upon, but it seems fairly easy to avoid if you have a good understanding of PayPal’s functionality. Granted, if you’re willing to send someone you don’t really know a bunch of money, maybe you’re also willing to let them know where you live? I don’t know.
When reached by email, a Twitter spokesperson reiterated that they have no control over how PayPal works or whether or not users know how to use third-party accounts, but said that they were going to try to get the word out to users:
Tipping through Tip Jar takes place on the selected payment service app or website and as a result relies on the third-party service’s functionality. When tipping with Tip Jar, people are notified that they’re going to a separate app or website to send their tip, and that tipping on that third-party platform is subject to the platform’s terms. We’re updating our in-app notification and Help Center article to make it clearer that other platforms, per their terms, may share information about people sending tips to one another.
Duly noted. Ultimately, it’s probably good that this whole little episode happened because it highlights some potential privacy hiccups for consumers when it comes to the new feature—something Twitter was likely testing for in the first place. Slow rollouts allow companies to discover stuff like this. Twitter said in its announcement that it is “always looking for feedback and ways to improve updates like Tip Jar – let us know what you think.” Looks like it got some.