Security

Read all 'Senator' posts in Security
November 23, 2009 4:00 AM PST

E-tailers snagged in marketing 'scam' blame customers

by Greg Sandoval
  • 120 comments

First, the good news for consumers: the U.S. government's investigation into how dozens of well-known online stores worked with controversial marketers to "deceive" customers out of $1.4 billion has prompted some retailers, including Continental Airlines, to sever ties with the marketers.

Mark Goldston, chairman and CEO of United Online, parent company of Classmates.com, which banked $70 million from marketing practices now under investigation by the Senate Commerce committee.

(Credit: United Online)

Now, the bad news: the marketers--Affinion, Vertrue, and Webloyalty--are still in business and judging from the responses of many of the retailers involved, such as Priceline, Classmates.com, FTD, Shutterfly, and Orbitz, it will be business as usual. They see nothing wrong with the marketing practices that millions of angry online shoppers and members of the U.S. Senate have called a "scam," "robbery" and "theft."

While the U.S. Senate Commerce committee produced a staggering amount of documentation during a hearing last week that appears to show consumers are misled into signing up for so-called loyalty programs, the retailers continue to suggest it's their customers who are at fault.

The controversy began last May, when the Commerce committee launched an investigation into the practices employed by Vertrue, Affinion, and Webloyalty. The committee's investigators found thousands of complaints going back years from people who said they discovered "mysterious charges" on their credit cards and struggled to discover how they got there.

The Senate's investigators said they learned that the retailers had made an unholy alliance with the marketers. Under most of the agreements between the marketing firms and retailers, an advertising page is presented to a shopper while they complete a transaction at the retailer's online store. Many shoppers say they entered their e-mail address and pushed a large "Yes" button on the ad because it appears to be a $10 cash-back offer or coupon. Many of those that complain say they thought they were being rewarded by the retailer for making a purchase.

Written in much smaller print within the ad are the full terms of the deal. A customer is notified there that by providing their e-mail address they are joining a membership program and agreeing to pay one of the marketing firms a monthly fee, typically between $10 and $20.

Despite being blasted last week by members of the Commerce committee, most of the retailers involved haven't done much repenting.

Orbitz "does not pass on any personally identifiable customer information to third party vendors without their permission," the travel site said in a statement.

United Online, parent company of FTD and Classmates.com, a company that the government said banked $70 million via the three marketers said: "We believe that our marketing practices provide clear disclosure. We do not transfer our customer's credit or debit card information to third parties without our customer's consent."

Priceline said the terms of the deal have "been clearly and fully explained."

It's all your fault
The inference is clear: The people complaining about this are the ones who screwed up. The terms of the deal were all in the ad so that means anyone who was charged the monthly fee either wanted it at the time or was negligent.

I can start by listing all the information that the government has found that shows that as many as 30 million consumers were unaware that they were signing up for the loyalty programs. But first, let's look at the obvious.

Webloyalty, Affinion and Vertrue all say they do their best to make it clear to consumers what they're signing up for. That's nonsense of course. If their claim was true, they would simply insert the following graph or something like it high up into their ads:

BY ENTERING YOUR CREDIT CARD NUMBER YOU ARE REGISTERING FOR MEMBERSHIP PROGRAM AND YOUR CREDIT CARD WILL BE CHARGED $12 PER MONTH FOR THIS SERVICE UNTIL YOU CANCEL YOUR MEMBERSHIP. ENTER CARD NUMBER HERE:________. EXPIRATION DATE HERE:________.

Voila. End of confusion.

This simple fact was presented in a Jan. 8, 2007, court filing that was part a class-action lawsuit filed against Webloyalty, one of several suits filed against the three marketing companies over the years. In this case, the attorneys representing plaintiff Joe Kuefler sized up why they believed Webloyalty doesn't display its terms in this clear way or ask consumers to input their credit card information themselves.

"The answer is nefarious," the lawyers wrote. "If customers had to retype their credit card numbers, they would know that they were registering for a monthly fee-based service and defendants would not be able to get rich by fooling people into signing up."

Confusion breeds deception
Here's the next obvious fact that readers should know: burying important contractual information deep inside big blocks of text isn't new. Creating confusion around a purchasing experience and then obtaining a consumer's credit card information from someone other than the owner to make charges isn't novel. These ideas have been around in some form or another for decades and are outlawed in many parts of the brick-and-mortar world. These tactics won't fool everyone, but they will mislead enough consumers for the companies to profit.

In the court filing against Webloyalty, Kuefler's lawyers said that if they could get their hands on the company's internal documents they could prove Webloyalty knew that most "members" were duped into signing up. Well, the government did obtain documents.

According to the Senate Commerce committee's report a Vertrue employee once wrote that "cancellation calls represent approximately 98 percent of call volume" to the company's customer service operations. One Webloyalty employee said in an e-mail that "90 percent of our members don't know anything about the membership."

Documents obtained by the government show Affinion estimated that the chances of obtaining money from a consumer would be four times higher if a retailer handed over a customer's credit-card information to the marketing firm than if the firm had to get it from the actual cardholder.

Prentiss Cox, a former assistant attorney general and now a Minnesota law professor, says that in his decade-long experience studying the marketing practices employed by Affinion, Vertrue and Webloyalty, it's clear to him that those who voluntarily sign up for the loyalty memberships run by those companies is less than 5 percent.

Since I began writing about this in July, I've seen a lot of reader feedback from people who don't believe they could ever be misled into signing up for the membership programs. But I've also read thousands of complaints, which can be found here, here, and here. Among those that have claimed to have been duped are lawyers, computer programmers, vice presidents, U.S. Army veterans, and journalists.

The government wrote that more than 35 million people have been enrolled in Affinion, Vertrue, and Webloyalty's clubs.

Cox says the marketing techniques used by Affinion, Webloyalty, and Vertue work because shoppers have been conditioned to believe that on the Web they can't be charged without entering their credit card information. He notes the ads that Affinion, Vertrue and Webloyalty stick in the faces of consumers come late in the transaction process, when a consumer might think they need to click the "yes" button and enter their e-mail address to verify their identities. In addition, the ads "are sold as free offers," Cox said. This lowers a shopper's guard.

Another effective technique employed by the marketing companies is that they know many people will be embarrassed. Many consumers will hear that they entered their e-mail address and will assume they erred. Some won't make a stink because they don't want to admit that they don't check their bank statements well enough.

By saying, "we never release credit card information without the consumers authorization," the marketing companies and their retail partners imply that the money their customers lost was caused by their own negligence.

Affinion, Vertrue, Webloyalty, and their retail partners are all profiting from their customers' shame, when it is they who should be ashamed.

Webloyalty illustrated for potential clients how much easier it is to generate "high revenue" from a consumer when the firm can get their credit card information from a retailer ('card on file') instead of the card owner. Members of a Senate committee have called such practices a 'scam.'

(Credit: U.S. Senate Commerce committee)

Click here for a related podcast.

March 12, 2009 5:19 PM PDT

Coleman Senate campaign in donor data leak mess

by Elinor Mills
  • 6 comments

This is a screenshot of the e-mail Coleman's campaign sent to supporters warning them about the data leak.

(Credit: Minnesota Independent)

The campaign of Republican Norm Coleman, who is engaged in a fierce legal battle to keep his Senate seat from Democrat Al Franken, has warned supporters that their credit card numbers may have been exposed on the Internet.

His campaign manager, Cullen Sheehan, said the office became aware of a possible security breach of the donor database in January, however an investigation found the data had not been accessed by an unauthorized party, according to a report on Wednesday in the Minneapolis-St. Paul Star Tribune.

Supporters received an e-mail from the nonprofit Wikileaks site on Tuesday night saying the Coleman campaign had leaked donor information and that it was on the Wikileaks Web site, as well as another e-mail providing some of the data in a spreadsheet as evidence, the report says. The spreadsheet contained information for more than 4,700 donors. But Wikileaks said it has data on more than 51,600 Coleman contacts.

Sheehan e-mailed supporters on Wednesday urging them to cancel their credit cards and hinted at political espionage. Coleman has asked federal authorities to investigate, according to the Star Tribune.

A report in The Minnesota Independent quotes an IT professional who says she was testing the security of the campaign's Web site in January and was easily able to access data without hacking.

IT consultant Adria Richards said she got the site's IP address by entering "colemanforsenate.com" into an OpenDNS cache-check tool, and then copied the IP address into a Firefox browser to reveal the Web site directories for colemanforsenate.com, the report says. She then posted a screen capture of what she found online and wrote about the security problems on her blog.

Richards began her investigative computer work after Coleman's campaign was accused of falsely claiming that its Web site crashed after being overwhelmed by traffic from people who were allegedly disenfranchised voters.

Coleman is challenging Franken's lead of 225 votes, following a recount. The case is being heard by a special three-judge panel. Closing arguments are expected to begin Friday in the trial, which has gone on for seven weeks.

  • prev
  • 1
  • next
advertisement

15 sites that went kaput in 2009

Web sites launch all the time, but they also shut their doors. We highlight 15 that bit the dust this year.

Top 10 news stories of the decade

Let the debate begin: Was the iPhone more important than iTunes? Was anything bigger than Google finding a great business model? CNET offers its list of the 10 most important stories of the '00s.

About Security

Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.

Add this feed to your online news reader

Security topics

Most Discussed



advertisement

Inside CNET News

Scroll Left Scroll Right