Bank

Auto Added by WPeMatico

Flybits nabs $35M to build consumer recommendation engines for the financial sector

Published July 16, 2019

Financial service companies like banks have seen some of their business cannibalised over the years with the rise of digital-based alternatives — often in the form of apps — that provide lower fees, faster responsiveness and more flexibility to consumers. Today, Toronto-based startup Flybits is announcing $35 million in funding for a platform that it believes can offer these banks a way of continuing to capture their users’ attention and help them pivot into the next generation of services, financial or otherwise.

Today, a typical end product for a customer of Flybits’ services will use insights to upsell a customer by offering financial services; for example, a bank providing an offer of a specific kind of loan or credit card that you are more likely to take; or to offer a loyalty program or rewards for usage. But the longer-term goal, said CEO and co-founder Hossein Rahnama, is to help its customers take on a bigger role as repositories that can be used for more than just money, and used beyond the walls of the bank.

“We don’t think banks will go away, as some do, but we think that they could have a role not just as money vaults, but as data vaults: a place where you can deposit data, which you trust,” he said in an interview. Indeed, some of the funding will be used to put into action some of the AI and machine learning patents the startup has amassed, with the building of a “data” marketplace for banks, fintechs and other data providers to partner and build more services together.

The Series C comes from an interesting group of investors that includes both strategic backers using Flybits’ services, as well as backers of the more non-strategic, financial kind. Led by Point72 Ventures (hedge fund supremo Steve Cohen’s VC fund), the list also includes Mastercard, Citi Ventures and Reinventure (the fund backed by Australia’s Westpac Banking Corporation), Portag3 Ventures, TD Bank and Information Venture Partners. Valuation is not being disclosed, and prior to this the company had raised around $15 million.

Much like another marketing tech company, Near — which today announced $100 million in funding — the premise that underpins Flybits’ technology is that there is a lot of disparate data out there that, if it’s treated correctly, can uncover a lot more insights about consumer behavior, and that by and large many companies are missing this opportunity because they haven’t found the right way of merging the data to unlock insights.

While Near is applying this to location-based data and a range of different verticals, Flybits’ primary target has been banks and the data that they and other financial services providers already possess.

Many smaller startups in the world of financial services have stolen a march on bigger incumbents by building personalization into their products from the ground up. (Indeed, some like Step, aimed at teens, are so personalised that they will actually change their service mix as their customer base grows up and needs new products.) This is something that incumbents might have been more readily able to do in the old days, when people knew their bank managers and tellers and made daily trips into branches to transact. In the digital age they have fallen behind and are now catching up.

Flybits’ investors have spotted that and this in part is why they are banking on technologies like this to help bigger companies catch up, not just in financial services (although with banking alone estimated to be a €6.9 trillion industry, this is clearly a good start).

“Personalization is mission-critical for all D2C businesses in the digital age. Flybits’ integrated platform allows financial services firms to offer contextualized experiences, driving product awareness and adding significant value to the lives of their customers,” said Ramneek Gupta, managing director and co-head of Venture Investing at Citi Ventures, in a statement. “We look forward to partnering with Flybits in its next phase of growth as it continues to set the bar for hyper-personalized customer experiences.”

Indeed, it’s not just banks that are working on upselling, or that have large repositories of data that are not used as well as they could be.

“Mastercard and Flybits share a vision on using data driven insights to enrich consumers’ experiences,” said Francis Hondal, president, Loyalty & Engagement at Mastercard, in a statement. “Our ultimate goal is to develop products and services that engage consumers in a highly contextual manner. Through this collaboration with Flybits, we’ll be able to offer rich, personalized experiences for them throughout their journeys.”

The future of car ownership: Cars-as-a-service

Published July 10, 2019

Car shoppers now have several new options to avoid long-term debt and commitments. Automakers and startups alike are increasingly offering services that give buyers new opportunities and greater flexibility around owning and using vehicles.

Cars-as-a-Service

In the first part of this feature, we explored the different startups attempting to change car buying. But not everyone wants to buy a car. After all, a vehicle traditionally loses its value at a dramatic rate.

Some startups are attempting to reinvent car ownership rather than car buying.

Don’t buy, lease

My favorite car blog Jalopnik said it best: “Cars Sales Could Be Heading Straight Into the Toilet.” Citing a Bloomberg report, the site explains automakers may have had the worst first half for new-vehicle retail sales since 2013. Car sales are tanking, but people still need cars.

Companies like Fair are offering new types of leases combining a traditional auto financing option with modern conveniences. Even car makers are looking at different ways to move vehicles from dealer lots.

Fair was founded in 2016 by an all-star team made up of automotive, retail and banking executives including Scott Painter, former founder and CEO of TrueCar.

Colombian point-of-sale lender ADDI nabs $12.5 million from Andreessen Horowitz

Published June 11, 2019

Andreessen Horowitz <3 Latin American startups.

Latin America is the only region outside of the U.S. where the venture firm is routinely investing capital, and it just made another commitment, doubling down on its early-stage support for the point-of-sale lending startup ADDI.

ADDI picked up $12.5 million in new financing in April of this year as the company looks to expand its lending services online.

For an American audience, the closest corollary to what ADDI is up to is likely Affirm, the point-of-sale lender that’s raised a ton of cash and come in for some (valid) criticism for its basic business model.

Like Affirm, ADDI lets its borrowers apply for credit at the moment of purchase. The company likens its service to the layaway and credit plans that already exist in Colombia — but involve pretty onerous requirements to use. Company co-founder Santiago Suarez and Andreessen Horowitz general partner Angela Strange both commented on how, in some cases, Colombian shoppers have to have three people vouch for a borrower before a store will issue credit or agree to a layaway plan.

The difference between an ADDI loan — or any loan — and layaway is that an installment payment plan doesn’t charge interest (and even with the fees that installment plans do charge, they are often still cheaper than taking out a loan).

But financial products are coming for consumers in Latin America whether those buyers like it or not — and for the most part, it seems they do like it.

Historically, only the wealthiest clientele in Latin America received anything resembling the kinds of financial products that are more widely available in the United States, according to Strange. And the investment in ADDI is just part of her firm’s thesis in trying to make more services more broadly available in a region where a technological transformation is creating unprecedented opportunities for challengers.

That assessment is what drew Santiago Suarez back to Latin America only two years ago. A former executive at Lending Club who previously had worked as the head of New Product Development and Emerging Services at J.P. Morgan, Suarez saw the tremendous growth happening in Latin America and returned to Colombia to see if he could bring some much needed services to his home country.

Suarez partnered with his childhood friend, Elmer Ortega, who was working as the chief technology officer of the local hedge fund where he had previously been employed as a derivatives trader before learning how to code.

Together, the two men, who had known each other since they were five years old, set out to transform how credit was offered in retail shops. It’s an industry that Suarez had known well since his parents had owned stores.

“In the U.S. there are all of these gaps that fintech companies are filling,” says Suarez. “But the gaps in Latin America are bigger.”

Suarez and Ortega incorporated the company in September 2018, around the same time they raised $2.3 million from the regional investment firm, Monashees, Andreessen and Village Global . They then raised another $1.5 million in an internal round of financing before closing the most recent funding.

The company offers loans at annual percentage rates ranging from 19.99% to 28.90%. The company started with a digital solution for brick and mortar retailers because 90% of retail in Colombia still happens offline.

Although it’s in its early days, the company has already originated 10,000 borrowers and typically loans out roughly $500 since it launched on February 22, according to Suarez. He declined to comment on the company’s default rate on loans.

Now with 40 employees on staff, the company is looking to bring its lending tool to more e-commerce and physical retailers, according to Suarez. And despite the threat of cyclical political turmoil, Suarez says there’s no better time to be investing in Colombia.

“It’s the most stable country outside of Chile… Way more stable than Brazil, way more stable than Argentina and way more stable than Mexico,” Suarez says. “What we’re looking at is more than cyclical instability… those things go beyond that. Nubank was able to build a multibillion business in the worst political and economic crisis in Brazil’s history. I think Colombia is an incredibly attractive space with a deep talent pool.”

Partnering with Visa, emerging market lender Branch International raises $170 million

Published April 8, 2019

The San Francisco-based startup Branch International, which makes small personal loans in emerging markets, has raised $170 million and announced a partnership with Visa to offer virtual, pre-paid debit cards to Branch client networks in Africa, South-Asia and Latin America.

Branch — which has 150 employees in San Francisco, Lagos, Nairobi, Mexico City and Mumbai — makes loans starting at $2 to individuals in emerging and frontier markets. The company also uses an algorithmic model to determine credit worthiness, build credit profiles and offer liquidity via mobile phones.

“We’ll use [the money] to deepen existing business in Africa. Later this year we’ll announce high-yield savings accounts…in Africa,” says Branch co-founder and chief executive Matt Flannery.

The $170 million round from Foundation Capital and its new debit card partner, Visa, will support Branch’s international expansion, which could include Brazil and Indonesia, according to Flannery. Branch launched in Mexico and India within the last year. In Africa, it offers its services in Kenya, Nigeria and Tanzania.

A potential Branch customer

The Branch-Visa partnership will allow individuals to obtain virtual Visa accounts with which to create accounts on Branch’s app. This gives Branch larger reach in countries such as Nigeria — Africa’s most populous country with 190 million people — where cards have factored more prominently than mobile money in connecting unbanked and underbanked populations to finance.

Founded in 2015, Branch started operating in Kenya, where mobile money payment products such as Safaricom’s M-Pesa (which does not require a card or bank account to use) have scaled significantly. M-Pesa now has 25 million users, according to sector stats released by the Communications Authority of Kenya. Branch has more than 3 million customers and has processed 13 million loans and disbursed more than $350 million, according to company stats.

Branch has one of the most downloaded fintech apps in Africa, per Google Play app numbers combined for Nigeria and Kenya, according to Flannery.

Already profitable, Branch International expects to reach $100 million in revenues this year, with roughly 70 percent of that generated in Africa, according to Flannery.

In addition to Visa and Foundation Capital, the $170 Series C round included participation from Branch’s existing investors Andreessen Horowitz, Trinity Ventures, Formation 8, the IFC, CreditEase and Victory Park, while adding new investors Greenspring, Foxhaven and B Capital.

Branch last raised $70 million in 2018. The company’s overall VC haul and $100 million revenue peg register as pretty big numbers for a startup focused primarily on Africa. Pan-African e-commerce startup Jumia, which also announced its NYSE IPO last month, generated $140 million in revenue (without profitability) in 2018.

Startups building financial technologies for Africa’s 1.2 billion population have gained the attention of investors. As a sector, fintech (or financial inclusion) attracted 50 percent of the estimated $1.1 billion funding to African startups in 2018, according to Partech.

Branch’s recent round and plans to add countries internationally also tracks a trend of fintech-related products growing in Africa, then expanding outward. This includes M-Pesa, which generated big numbers in Kenya before operating in 10 countries around the world. Nigerian payments startup Paga announced its pending expansion in Asia and Mexico late last year. And payment services such as Kenya’s SimbaPay have also connected to global networks like China’s WeChat.

Africa Roundup: Jumia files for IPO, OneFi acquires Amplify, FlexClub expands in Mexico

Published April 4, 2019

Less than a decade ago IPOs, acquisitions and global expansion by African startups were more possibility than reality. March saw all three from the continent’s tech scene.

Pan-African e-commerce company Jumia filed for an IPO on the New York Stock Exchange, per SEC documents and confirmation from chief executive Sacha Poignonnec.

In an updated filing, (since the March 12 original) Jumia indicated it will offer 13,500,000 ADR shares, for an offering price of $13 to $16 per share to trade under the ticker symbol “JMIA.” The IPO could raise up to $216 million for Jumia.

Since our first story (and reflected in the latest SEC docs), Mastercard Europe agreed upfront to buy $50 million in Jumia ordinary shares.

With a smooth filing process, Jumia will become the first African startup to list on a major global exchange. The company is incorporated in Germany, but maintains its headquarters in Nigeria, and operates exclusively in Africa, with 4,000 employees on the continent.

The pending IPO creates another milestone for Jumia. The venture became the first African startup unicorn in 2016, achieving a $1 billion valuation after a funding round that included Goldman Sachs, AXA and MTN.

Founded in Lagos in 2012 with Rocket Internet backing, Jumia now operates multiple online verticals in 14 African countries. Goods and services lines include Jumia Food (an online takeout service), Jumia Flights (for travel bookings) and Jumia Deals (for classifieds). Jumia processed more than 13 million packages in 2018, according to company data. The company has started to generate annual revenues over $100 million, but like many burn-rate startups, has done so while racking up big losses.

There’ll be a lot more to cover, analyze and debate pre and post Jumia’s NYSE bell toll — which could happen in coming weeks or months. For example, can Jumia generate a profit; is it really an African startup; will Jumia become an acquisition target for a big outside name or an acquirer of smaller startups in African e-commerce? Stay tuned for continuing TechCrunch coverage.

On the acquisition front, Lagos-based online lending startup OneFi bought Nigerian payment solutions company Amplify for an undisclosed amount.

OneFi is taking over Amplify’s IP, team and client network of more than 1,000 merchants to which Amplify provides payment processing services, OneFi CEO Chijioke Dozie told TechCrunch.

The purchase of Amplify caps off a busy period for OneFi. Over the last seven months the Nigerian venture secured a $5 million lending facility from Lendable, announced a payment partnership with Visa and became one of the first (known) African startups to receive a global credit rating. OneFi is also dropping the name of its signature product, Paylater, and will simply go by OneFi (for now).

Collectively, these moves represent a pivot for OneFi away from operating primarily as a digital lender, toward becoming an online consumer finance platform.

“We’re not a bank but we’re offering more banking services…Customers are now coming to us not just for loans but for cheaper funds transfer, more convenient bill payment, and to know their credit scores,” said Dozie.

OneFi will add payment options for clients on social media apps, including WhatsApp, this quarter — something in which Amplify already holds a specialization and client base. Through its Visa partnership, OneFi will also offer clients virtual Visa wallets on mobile phones and start providing QR code payment options at supermarkets, on public transit and across other POS points in Nigeria.

On the back of the acquisition, OneFi is in the process of raising a round and will look to expand internationally, considering Senegal, Côte d’Ivoire, DRC, Ghana and Egypt and Europe for Diaspora markets.

On African startups expanding globally, FlexClub — a South African venture that matches investors and drivers to cars for ride-hailing services — announced it will expand in Mexico in a partnership with Uber after closing a $1.2 million seed round led by CRE Venture Capital.

The move comes as Africa’s tech-transit space continues to produce unique mobility solutions shaped around local needs.

FlexClub touts itself as a “gig economy investment platform” that is creating new asset classes in emerging markets, according to chief executive and co-founder Tinashe Ruzane.

That asset class, for now, is ride-hail vehicles. FlexClub allows investors to go on the site and purchase a car (ultimately managed and serviced by FlexClub). The startup then connects that car to an Uber driver who uses earnings to pay a weekly rental charge.

Those fees generate monthly fixed-rate interest income for the investor. The driver has the option of buying the car after 12 months, with a descending purchase price over time.

FlexClub’s platform manages the investment, rental income and disbursement of funds across all parties. The startup also handles insurance, maintenance and upkeep of the cars.

Ruzane envisions this as a model to finance multiple asset classes in emerging markets — where lending options are fewer for individuals who may not have credit histories.

“Our goal is to make this completely passive… where investors can invest in different kinds of assets on our platform, login to a dash, and see this is how my five cars in South Africa are doing, my vans in Mexico, my motorbikes in Indonesia — with a diversified portfolio around the world,” he explained.

FlexClub will begin work matching investors to cars and Uber drivers in Mexico in April. The startup sees opportunities to move into other mobility classes, such as Africa’s ride-hail motorcycle taxi and three-wheel tuk-tuk market, CEO Tinashe Ruzane told TechCrunch in this feature.

And finally, francophone Africa will see a boost in funds and support for startups. The Dakar Network Angels group launched last month, making its first investment to cleantech venture Coliba — an Ivorian startup that uses a mobile app to coordinate waste recycling

The deal is part of Dakar Network Angels’ mission of convening experts and capital to bridge the resource gap for startups in French-speaking Africa — or 24 of the continent’s 54 countries.

The organization — which goes by DNA for short — will offer seed fund investments of between $25,000 to $100,000 to early-stage ventures with high growth potential. These rounds will come with the entrepreneurial guidance of DNA’s angel network.

Launched in Senegal, the organization’s founder Marieme Diop — a VC investor at Orange Digital Ventures — named the goal of bridging VC disparities between francophone and non-francophone Africa as the primary driver for DNA. She pointed to funding data by Partech, indicating that 76 percent of investment to African startups goes to three English-speaking countries — Nigeria, Kenya and South Africa.

To gain consideration for DNA investment, startups must gain referral by a member. DNA will take a minority stake (less than 10 percent) in ventures that receive seed funds and provide program mentorship until exits, Diop told TechCrunch.

To become an angel, members must commit to investing a minimum of $10,000 a year (for those coming on as individuals), $20,000 (for corporates) and be on hand to support the portfolio startups, according to DNA’s Corporate Membership Charter.

More Africa Related Stories @TechCrunch

African Tech Around The Net

How business-to-business startups reduce inequality

Published January 30, 2019

Sibjeet Mahapatra
Contributor

Sib Mahapatra is a writer and co-founder of Bureau, an end-to-end office furniture startup in NYC.

A path to equal opportunity: Turning fixed costs into variable costs

What do AWS, WeWork, Stord, Gusto and RocketLawyer have in common? They provide cloud computing services, office space, warehouse storage, payroll management and access to legal templates, respectively — at first glance, not a particularly congruent set of services.

But they are alike in the economic purpose they serve for their customers. Each of these services takes a fixed cost — a bank of servers, a lease, a legal retainer — and transforms it into a variable cost. As a refresher, a fixed cost stays constant regardless of output, and variable costs scale with the output of a business.

When my father started his software consulting business in the early 1990s, I remember the giant boxes of AIX servers that arrived at our apartment, and tagging along to office tours in central New Jersey before he decided to run the company out of our spare bedroom. Back then, starting almost any kind of business was hard because of high fixed costs. Without AWS or WeWork, you shelled out upfront for hardware and a lease.

Access to capital, whether in the form of a bank loan, savings or friends and family was a prerequisite for entrepreneurship.

Today, startups make it possible to start and scale almost any kind of business while incurring few fixed costs. Want to found an e-commerce store? Start with a free Shopify account and dropship your inventory. Want to become a freelance designer? Put a shingle up on Fiverr and meet clients at a Breather you rent by the hour.

Whether software or hardware or labor, building a business is way easier when overhead is transformed into a string of flexible microservices that you only pay for as you grow.

Image courtesy of Getty Images

Lower fixed costs means capital matters less

Taken together, startups that turn fixed costs into variable costs make it less capital-intensive to start a business. This decreases the influence of gatekeepers and aggregators of capital — an impact evident in the way entrepreneurs think about starting businesses today.

It’s no coincidence that the rise of B2B startups fitting this theme has coincided with the bootstrap movement, in which tech entrepreneurs with major ambitions demur from raising venture funding because — well, they don’t need the money anymore.

It has also coincided with a renaissance in freelance entrepreneurship: 56.7 million Americans freelanced in 2018. Beyond the economic benefits of working for yourself — the fastest growing segment of freelancers earns more than $75,000 a year — freelancers can access the lifestyle and health benefits of owning their destiny, which aren’t directly captured but play a role in the economic picture. Indeed, 51 percent of freelancers said no amount of money would lure them into a traditional job, and 64 percent reported feeling healthier and happier.

When capital plays a reduced role in new business formation, access to capital plays a smaller role in determining who will succeed. More companies are founded, and the economy becomes more likely to birth new Davids that will unseat the Goliaths. Economics 101: lower barriers to entry create markets that converge on perfect competition instead of oligarchic concentration.

Source: Getty Images/ERHUI1979

Variable costs don’t scale, but that’s OK

Variable costs have their downsides. A startup with a relatively higher proportion of fixed costs — the profile of the classic high-tech software business — can achieve higher profit margins as it scales. Compare Microsoft or Google, which pay high fixed costs in the form of salaries and servers but few costs in delivering their services and achieve operating margins of 25-30 percent, to Costco, which takes in more than $100 billion of annual revenue but earns an operating margin in the single digits.

That’s OK. Neither type of cost is “better” or “worse,” but having the option to decide how to structure costs through a company’s life cycle can meaningfully impact an entrepreneur’s ability to execute a business idea.
Founders investigating startup ideas — and politicians debating the impact of technology — would do well to pay attention to how B2B companies have democratized access to entrepreneurship.

Equality of outcome arrives from equality of opportunity — and a future where millions of people can start businesses, differentiate and succeed on the basis of their ability and value proposition, rather than their access to capital, sounds like a promising representation of the egalitarian ethos Silicon Valley wants to bring to pass.

Scooter startup Bird tried to silence a journalist. It did not go well.

Published January 11, 2019

Cory Doctorow doesn’t like censorship. He especially doesn’t like his own work being censored.

Anyone who knows Doctorow knows his popular tech and culture blog, Boing Boing, and anyone who reads Boing Boing knows Doctorow and his cohort of bloggers. The part-blogger, part special advisor at the online rights group Electronic Frontier Foundation has written for years on topics of technology, hacking, security research, online digital rights and censorship and its intersection with free speech and expression.

Yet, this week it looked like his own free speech and expression could have been under threat.

Doctorow revealed in a blog post on Friday that scooter startup Bird sent him a legal threat, accusing him of copyright infringement and that his blog post encourages “illegal conduct.”

In its letter to Doctorow, Bird demanded that he “immediately take[s] down this offensive blog.”

Doctorow declined, published the legal threat and fired back with a rebuttal letter from the EFF accusing the scooter startup of making “baseless legal threats” in an attempt to “suppress coverage that it dislikes.”

The whole debacle started after Doctorow wrote about how Bird’s many abandoned scooters can be easily converted into a “personal scooter” by swapping out its innards with a plug-and-play converter kit. Citing an initial write-up by Hackaday, these scooters can have “all recovery and payment components permanently disabled” using the converter kit, available for purchase from China on eBay for about $30.

In fact, Doctorow’s blog post was only two paragraphs long and, though didn’t link to the eBay listing directly, did cite the hacker who wrote about it in the first place — bringing interesting things to the masses in bite-size form in true Boing Boing fashion.

Bird didn’t like this much, and senior counsel Linda Kwak sent the letter — which the EFF published today — claiming that Doctorow’s blog post was “promoting the sale/use of an illegal product that is solely designed to circumvent the copyright protections of Bird’s proprietary technology, as described in greater detail below, as well as promoting illegal activity in general by encouraging the vandalism and misappropriation of Bird property.” The letter also falsely stated that Doctorow’s blog post “provides links to a website where such Infringing Product may be purchased,” given that the post at no point links to the purchasable eBay converter kit.

EFF senior attorney Kit Walsh fired back. “Our client has no obligation to, and will not, comply with your request to remove the article,” she wrote. “Bird may not be pleased that the technology exists to modify the scooters that it deploys, but it should not make baseless legal threats to silence reporting on that technology.”

The three-page rebuttal says Bird used incorrectly cited legal statutes to substantiate its demands for Boing Boing to pull down the blog post. The letter added that unplugging and discarding a motherboard containing unwanted code within the scooter isn’t an act of circumventing as it doesn’t bypass or modify Bird’s code — which copyright law says is illegal.

As Doctorow himself put it in his blog post Friday: “If motherboard swaps were circumvention, then selling someone a screwdriver could be an offense punishable by a five year prison sentence and a $500,000 fine.”

In an email to TechCrunch, Doctorow said that legal threats “are no fun.”

AUSTIN, TX – MARCH 10: Journalist Cory Doctorow speaks onstage at “Snowden 2.0: A Field Report from the NSA Archives” during the 2014 SXSW Music, Film + Interactive Festival at Austin Convention Center on March 10, 2014 in Austin, Texas. (Photo by Travis P Ball/Getty Images for SXSW)

“We’re a small, shoestring operation, and even though this particular threat is one that we have very deep expertise on, it’s still chilling when a company with millions in the bank sends a threat — even a bogus one like this — to you,” he said.

The EFF’s response also said that Doctorow’s freedom of speech “does not in fact impinge on any of Bird’s rights,” adding that Bird should not send takedown notices to journalists using “meritless legal claims,” the letter said.

“So, in a sense, it doesn’t matter whether Bird is right or wrong when it claims that it’s illegal to convert a Bird scooter to a personal scooter,” said Walsh in a separate blog post. “Either way, Boing Boing was free to report on it,” she added.

What’s bizarre is why Bird targeted Doctorow and, apparently, nobody else — so far.

TechCrunch reached out to several people who wrote about and were involved with blog posts and write-ups about the Bird converter kit. Of those who responded, all said they had not received a legal demand from Bird.

We asked Bird why it sent the letter, and if this was a one-off letter or if Bird had sent similar legal demands to others. When reached, a Bird spokesperson did not comment on the record.

All too often, companies send legal threats and demands to try to silence work or findings that they find critical, often using misinterpreted, incorrect or vague legal statutes to get things pulled from the internet. Some companies have been more successful than others, despite an increase in awareness and bug bounties, and a general willingness to fix security issues before they inevitably become public.

Now Bird becomes the latest in a long list of companies that have threatened reporters or security researchers, alongside companies like drone maker DJI, which in 2017 threatened a security researcher trying to report a bug in good faith, and spam operator River City, which sued a security researcher who found the spammer’s exposed servers and a reporter who wrote about it. Most recently, password manager maker Keeper sued a security reporter claiming allegedly defamatory remarks over a security flaw in one of its products. The case was eventually dropped, but not before more than 50 experts, advocates and journalist (including this reporter) signed onto a letter calling for companies to stop using legal threats to stifle and silence security researchers.

That effort resulted in several companies — notably Dropbox and Tesla — to double down on their protection of security researchers by changing their vulnerability disclosure rules to promise that the companies will not seek to prosecute hackers acting in good-faith.

But some companies have bucked that trend and have taken a more hostile, aggressive — and regressive — approach to security researchers and reporters.

“Bird Scooters and other dockless transport are hugely controversial right now, thanks in large part to a ‘move-fast, break-things’ approach to regulation, and it’s not surprising that they would want to control the debate,” said Doctorow.

“But to my mind, this kind of bullying speaks volumes about the overall character of the company,” he said.

Here’s what to expect in cybersecurity in 2019

What happens when hackers steal your SIM? You learn to keep your crypto offline

Published August 20, 2018

A year ago I felt a panic that still reverberates in me today. Hackers swapped my T-Mobile SIM card without my approval and methodically shut down access to most of my accounts and began reaching out to my Facebook friends asking to borrow crypto. Their social engineering tactics, to be clear, were laughable but they could have been catastrophic if my friends were less savvy.

Flash forward a year and the same thing happened to me again – my LTE coverage winked out at about 9pm and it appeared that my phone was disconnected from the network. Panicked, I rushed to my computer to try to salvage everything I could before more damage occurred. It was a false alarm but my pulse went up and I broke out in a cold sweat. I had dealt with this once before and didn’t want to deal with it again.

Sadly, I probably will. And you will, too. The SIM card swap hack is still alive and well and points to one and only one solution: keeping your crypto (and almost your entire life) offline.

Trust No Carrier

Stories about massive SIM-based hacks are all over. Most recently a crypto PR rep and investor, Michael Terpin, lost $24 million to hackers who swapped his AT&T SIM. Terpin is suing the carrier for $224 million. This move, which could set a frightening precedent for carriers, accuses AT&T of “fraud and gross negligence.”

From Krebs:

Terpin alleges that on January 7, 2018, someone requested an unauthorized SIM swap on his AT&T account, causing his phone to go dead and sending all incoming texts and phone calls to a device the attackers controlled. Armed with that access, the intruders were able to reset credentials tied to his cryptocurrency accounts and siphon nearly $24 million worth of digital currencies.

While we can wonder in disbelief at a crypto investor who keeps his cash in an online wallet secured by text message, how many other services do we use that depend on emails or text messages, two vectors easily hackable by SIM spoofing attacks? How many of us would be resistant to the techniques that nabbed Terpin?

Another crypto owner, Namek Zu’bi, lost access to his Coinbase account after hackers swapped his SIM, logged into his account, and changed his email while attempting direct debits to his bank account.

“When the hackers took over my account they attempted direct debits into the account. But because I blocked my bank accounts before they could it seems there are bank chargebacks on that account. So Coinbase is essentially telling me sorry you can’t recover your account and we can’t help you but if you do want to use the account you owe $3K in bank chargebacks,” he said.

Now Zu’bi is facing a different issue: Coinbase is accusing him of being $3,000 in arrears and will not give him access to his account because he cannot reply from the hacker’s email.

“I tried to work with coinbase hotline who is supposed to help with this but they were clueless even after I told them that the hackerchanged email address on my original account and then created a new account with my email address. Since then I’ve been waiting for a ‘specialist’ to email me (was supposed to be 4 business days it’s been 8 days) and I’m still locked out of my account because Coinbase support can’t verify me,” he said.

It has been a frustrating ride.

“As an avid supporter and investor in crypto it baffles me how one of the market leaders who just supposedly launched institutional grade custody solutions can barely deal with a basic account take-over fraud,” Zu’bi said.

How do you protect yourself?

I’ve been using Trezor hardware wallets for a while, storing them in safe places outside of my home and maintaining a separate record of the seeds in another location. I have very little crypto but even for a fraction of a few BTC it just makes sense to practice safe storage. Ultimately, if you own crypto you are now your own bank. That you would trust anyone – including a fiat bank – to keep your digital currency safe is deeply delusional. Heck, I barely trust Trezor and they seem like the only solution for safe storage right now.

When I was first hacked I posted recommendations by crypto exchange Kraken. They are still applicable today:

Call your telco and:

Set a passcode/PIN on your account
- Make sure it applies to ALL account changes
- Make sure it applies to all numbers on the account
- Ask them what happens if you forget the passcode
  - Ask them what happens if you lose that too
Institute a port freeze
Institute a SIM lock
Add a high-risk flag
Close your online web-based management account
Block future registration to online management system
Hack yo’ self
- See what information they will leak
- See what account changes you can make

They also recommend changing your telco email to something wildly inappropriate and using a burner phone or Google Voice number that is completely disconnected from your regular accounts as a sort of blind for your two factor texts and alerts.

Sadly, doing all of these things is quite difficult. Further, carriers don’t make it easy. In May a 27-year-old man named Paul Rosenzweig fell victim to a SIM-swapping hack even though he had SIM lock installed on his account. A rogue T-Mobile employee bypassed the security, resulting in the loss of a unique three character Twitter and Snapchat account.

Ultimately nothing is secure. The bottom line is simple: if you’re in crypto expect to be hacked and expect it to be painful and frustrating. What you do now – setting up real two-factory security, offloading your crypto onto physical hardware, making diligent backups, and protecting your keys – will make things far better for you in the long run. Ultimately, you don’t want to wake up one morning with your phone off and all of your crypto siphoned off into the pocket of a college kid like Joel Ortiz, a hacker who is now facing jail time for “13 counts of identity theft, 13 counts of hacking, and two counts of grand theft.” Sadly, none of the crypto he stole has surfaced after his arrest.

TalkBank lets you chat with your bank

Published December 16, 2016

screen-shot-2016-12-16-at-10-57-02-am As a fan of banks – I like the lollipops they give out – I’m slightly disturbed by services like TalkBank. This Russian company replaces one-on-one teller interaction with a chatbot that can tell you your balance, offer on the spot advice, and even send you cool deals related to your credit cards. Founded by Mikhail Popov, Alexander Popov, and Vladimir Kozhevnikov the company… Read More

Albert raises $2.5 million for its finance app that helps you save money

Published November 23, 2016

screen-shot-2016-11-23-at-10-20-31-am Everyone knows the basics of how to improve their financial health: put money into savings, track your spending, reduce your debt, look for ways to save on your monthly bills, and make smart investments. Where people struggle is translating that knowledge into specific actions you can take today. That’s where an application called Albert steps into help. The startup, which has now closed… Read More