{"id":34569,"date":"2014-04-08T06:00:23","date_gmt":"2014-04-08T13:00:23","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=34569"},"modified":"2025-08-07T22:50:56","modified_gmt":"2025-08-08T05:50:56","slug":"credit-karma-and-fandango-exposed-by-ftc","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/credit-karma-and-fandango-exposed-by-ftc\/","title":{"rendered":"Fandango and Credit Karma Mobile Apps Put Users At Risk"},"content":{"rendered":"

A night at the movies previously meant compromising between an edge-of-your-seat thriller and that new Nora Ephron romantic comedy, with the biggest ding to your wallet being a $10 bucket of large popcorn. However, now it may end up costing you more than just the exorbitantly priced snacks.<\/p>\n

Movie ticket site Fandango as well as credit score management site Credit Karma found themselves in some hot water recently after it came to light that their mobile apps for iOS and Android did not properly encrypt customer data<\/a>. The Federal Trade Commission (FTC) called the companies out<\/a> for knowingly disabling critical mobile security features and potentially exposing customers\u2019 credit card information, Social Security numbers, and other personal information.<\/p>\n

Currently, Fandango has had nearly 100 million downloads from the Apple App Store and Google Play Store in total, and Credit Karma has more than 5 million downloads overall, which means that there were a considerable amount of people potentially impacted by these oversights. According to the FTC<\/a>, Fandango and Credit Karma misrepresented the security of their apps and failed to take the necessary steps to keep customer data safe. Both companies disabled the Secure Sockets Layer (SSL) certificate validation process for their iOS and Android apps, which verifies that the apps\u2019 communications are secure when sensitive data is being transmitted over the network.<\/p>\n

These security slip-ups were dangerous not only because both apps were used for financial transactions, but also because they made sensitive data vulnerable to easily executed attacks via public Wi-Fi<\/a>. In Credit Karma\u2019s case, the original mistake occurred during testing, when developers disabled the SSL certificate validation feature and then failed to turn it back on after releasing it to the Apple App Store. The same mistake was also made nearly six months later when they released the Android version in February 2013. Fandango, on the other hand, allowed its iOS app to skip SSL certificate validations for nearly three years before rectifying the error. Both situations reveal a major gap in the app security review process, as well as reiterating the importance of maintaining safe mobile habits despite app promises.<\/p>\n

Both companies quickly settled the complaint with the FTC, and while they will now be required to establish comprehensive security programs and undergo security assessments every other year for the next 20 years, the information that was potentially exposed prior to discovery cannot be reclaimed. However, Fandango and Credit Karma were not the first, nor will they be the last company called out for neglecting to properly secure their mobile apps\u2014and the data sent through them. Consumers are increasingly using mobile apps for sensitive transactions and shouldn\u2019t assume that companies are taking their safety seriously. With great convenience comes great responsibility, and users must take the security of their mobile devices and personal information into their own hands.<\/p>\n

Tips to Follow When Transacting Via Mobile<\/h2>\n

Below are some simple safety tips to follow when using your mobile devices for sensitive transactions.<\/p>\n