After you’ve launched CurrentC you’re given two options: I Have An Invitation or I Need An Invitation. If you tap I Have An Invitation you’ll be asked for your email address and ZIP code. Entering an email that hasn’t been invited yet will kick you back to the first screen and give you a message saying they’ll let you know when CurrentC is available in your area. A concerning behavior I saw here is that regardless of what email you enter, CurrentC’s service will respond with a large dictionary of user data.
Now, I have to stress here, I never got CurrentC to return me a real user’s data. However, the fact that these fields exist is a good indicator that CurrentC plans to collect this data, and also why on Earth would you ever return these fields without any sort of authentication first? I never hit on an email that appeared to be a valid account, but I was honestly too nervous to keep trying given the data it seemed eager to send back.
Your CurrentC account, I should add, is tied directly to your checking account. This is ripe for all kinds of abuse, the least of which is all the tracking MCX retailers will put on you.
ONE MORE THING: They just got hacked. Read:
On Wednesday, those taking part in the CurrentC pilot program received a warning from the consortium of anti-credit-card retailers called MCX, or Merchant Consumer Exchange: The program was hacked in the last 36 hours, and criminals managed to grab the email addresses of anyone who signed up for the program.
MCX confirmed the hack, adding what’s become a go-to line for any company that loses your data: “We take the security of our users’ information extremely seriously.”
It’s a rough start for an app that aims to be a competitor to Apple Pay and Google Wallet.
Over a million people happily gave their credit card numbers to Apple Pay in the first 72 hours, instantly making it bigger than every other e-payment system combined. It doesn’t seem likely that people will be lining up virtually to hand over their Social Security and checking account numbers to CurrentC.