Partnerships, Pivots And Bookended Data Breaches

Summer is settling into its declining days, vacations are winding down. In some school districts, kids have even gone back to the school for the year. Labor Day is two weeks from today.

However, there’s no shortage of news in our payments and commerce world. How fun for all of us!

Last week we saw Uber and Green Dot on a mission to pay drivers faster, Goldman Sachs loving the little guy, and hackers…well, hacking anything that’s not nailed down.

Uber Expanding Instant Pay With Green Dot
While the awesomeness of hailing an Uber ride is nearly universally accepted among consumers, questions about the awesomeness of how drivers are treated by Uber have swirled throughout 2016. While that controversy is complex, what’s not at all complicated is the fact that Uber would like that controversy to go away entirely.

One move made last week may help.

Instant Pay is now available to Uber’s driving fleet.

The service has been popular so far, with 80,000 drivers having already signed up for the option that allows them to get paid on the spot. And, as of this week, Uber is expanding the service by upping the options drivers have for taking those real time cash outs.

For the initial launch earlier this year, Uber partnered with GoBank — drivers who signed on with Instant Pay would receive an Uber Debit Card from GoBank  tied to a mobile bank account offered by Green Dot.

As of this week, Uber has confirmed that it will, in partnership with Green Dot, expand Instant Pay options so that going forward, Instant Pay will work with almost any Mastercard, Visa or Discover U.S. debit card that is attached to a traditional checking and savings account. This is very similar to how PayPal can be linked to most debit cards, making it easy for people to get paid with PayPal but withdraw the money instantly at an ATM machine.

“Whether you’re saving up for something big or hitting the road to pay an unexpected bill, Uber can help you reach your goals on your schedule. It’s your money. You earned it, and you should be able to experience the joy of getting paid anytime you want,” said Uber in announcing the expanded Instant Pay options. “That’s what driving with Uber is all about: work that fits around your life and not the other way around.”

The move comes shortly after Uber announced its newest milestone in July: 2 billion trips completed through its app. That comes just six months after completing its first billion rides.

In a post on Facebook, Uber Chief Executive Travis Kalanick said the company reached the 2 billion-ride mark on June 18 when 147 Uber rides started at the same time.

Goldman Sachs Goes Middle Class
Goldman Sachs — with its long track record of being the investment bank of choice for elite investors, corporations and governments — is probably not the first financial institution that comes to mind when thinking about touching the “common man.”

But it seems Goldman has decided to at least start trying by introducing the world to Marcus — their new online lending platform “for the masses.”

Named for Marcus Goldman, one of the firm’s co-founders, Marcus is set to officially hit the market this fall, according to internal sources quoted by The New York Times.

Marcus’ focus will be offering small consumer loans — an area Goldman Sachs has traditionally avoided but has been pushed toward in recent years as new regulations have forced many venerable Wall Street institutions to think out of the box about revenue streams going forward.

Goldman also came out of the financial crisis facing uniquely terribly reputation issues — lots of banks were involved in the TARP program, but only Goldman Sachs was singled out by Rolling Stone as being “a great vampire squid wrapped around the face of humanity.”

Goldman has also begun offering savings accounts under the GS Bank brand — and it’s not clear if the two business lines will be merged in the future. Goldman has an advantage over online-only lenders because it is a bank with steady funding (but no overhead related to branches) — but analysts wonder if Goldman Sachs will be able to gain initial traction in an area that has filled up notably in the last few years.

The major question is: will Marcus serve the little guy as well as Goldman Sachs has served the big dogs?

We’ll keep you updated.

From Hiking To Hotels – Hackers Are Ruining Your Vacation
There are many things that we think count against pursuing a career in cybercrime — it’s illegal, it’s immoral, your financial future is probably tied to the bitcoin and its volatile prices — those reasons all make the shortlist. Add to that list: it’s a 24/7/365 job with, it seems, no summer vacations. Week-in and week-out this summer, we’ve seen another nationally known retailer or brand get hit by hackers.

Perhaps inspired by Usain Bolt actually pulling off the Olympic Triple-Triple, international data-thieves outdid their summer 2016 performance by managing to open and close the same week with two big hacks.

The gold medal effort hit early — with news that Starwood, Hyatt and Marriott had all been snared in the same data breach affecting a property management company used commonly among them. Twenty U.S. hotels operated by HEI Hotels & Resorts for Starwood, Marriott, Hyatt and Intercontinental coughed up some payment card data, and though the number of hotels may not sound like a lot — the amount of data lifted sure was. Though there is no exact count as of yet, estimates are putting the number of transactions accessed in the tens of thousands — swipes for food and drink primarily.

This breach follows the form of previous hospitality breaches seen of late, particularly the one of Hyatt Hotels and Starwood Hotels & Resorts Worldwide.

Connecticut-based HEI attributes the stolen data to malware placed in their system. The bad code was first discovered in June, and it was found to be primarily affecting payment systems used at restaurants, bars, spas and lobby shops.

The good news — if there is such a thing when these things happen — according to Chris Daly, a spokesman for HEI, is that though there were tens of thousands of transactions, many of them wouldn’t be for unique cards. Customers likely used the same card repeatedly throughout their stay.

That’s supposed to make this better?

All in all, 12 Starwood properties, 6 Marriott Properties and a single Hyatt hotel were found to have been snagged in the breach. According to available data, the breach was active March 1, 2015 to June 21, 2016, with 14 of the hotels affected after Dec. 2, 2015, HEI said on its website on Friday.

IHG and Marriott have no comment on the breach at this point. According to HEI – customer names, account numbers, payment card expiration dates and verification codes are all likely to have been stolen.

And hotels weren’t alone — retail outfitter for outdoor adventures Eddie Bauer also got tagged in a breach last week. As Friday faded out into the weekend, reports surfaced that malicious code seems to have found its way in to all of Eddie Bauer’s POS systems in the U.S. and Canada.

Though there is no official confirmation – it seems that credit and debit cards used at those stores during the first six months of 2016 may have been the target of the breach. Eddie Bauer acknowledged their systems impregnation with malware about six weeks after Krebs On Security reached out to inform them of a possible data breach.

“While not all transactions during this period were affected, out of an abundance of caution, Eddie Bauer is offering identity protection services to all customers who made purchases or returns during this period,” the company said in a press release.

How nice.

So what did we learn this week? Uber drivers are getting paid faster, Goldman Sachs is broadening its appeal and hackers will never take a break from trying to take your data.