Betterment.com’s Email System Just Sent a Properly Signed Scam Email to Users, and Then Apologized for Causing “Confusion” as If They Hadn’t Just Sent a Scam Email
It offered to triple deposits sent in the next 2 hours, and then followed up with an email saying, “Please note that this is not a real offer and should be disregarded. We apologize for any confusion.”
I think that Betterment.com just had one of their email channels hacked, & they’re really downplaying it. About 3 hours ago, I received an email from them with the subject, “Aaron: we’ll triple your crypto sends!”
This email was properly digitally signed by Betterment.com’s servers, came from their actual address, and was properly targeted to me using an email that I use only with their system. It offered to triple any deposit I made for a limited time, included two crypto addresses, and a two hour time limit to take advantage of the offer.
To be clear, I have a business relationship with Betterment. It is entirely normal to deposit very large sums with them, and matching promotions is a common tactic for businesses like this. It would be like Chase Bank sending you an official email re. a new checking account promotion. Suspicious mostly in how good the offer was, but in structure not completely crazy.
2 hours and 5 minutes later, Betterment sent a follow-up email with the subject, “Important update regarding unauthorized message,” where they said, “This was an unauthorized message sent via a third-party system we use for marketing and other customer communications. Please note that this is not a real offer and should be disregarded. We apologize for any confusion.”
Which, to be clear, is a very mild way of saying, “Our email system has been hacked, we sent you a scam email, and you will lose anything you send to those addresses.”
Get Aaron Stanton’s stories in your inbox
Join Medium for free to get updates from this writer.
Not, “THAT EMAIL WASN’T US,” in the subject. Not what to do if you sent money and now are feeling robbed. In fact, their email really just made it clear that it’s not really, “their” fault — only that there was confusion, like a bank mix-up, and probably by somebody else.
I feel like Betterment’s warning email is weirdly passive in the face of a threat to their client base because of their communication system. It is not just, “not a real offer,” that could cause “confusion,” — it’s someone trying to steal money. And being successful, to a degree.
At the moment, it looks like only about 20 or 30 people have sent money, and most in small increments. Because the addresses are public, we can see that the Bitcoin address has been sent $12,331.61 in the last few hours, and the Eth account has been sent about $1,829. As of my writing, both accounts are emptying everything they receive pretty much the instant it arrives.
There are a handful of transfers in the thousands of dollars. The single largest transfer was $3,168.58. At the moment, there haven’t been any additional transfers since the second email arrived.
So while the total volume of money is probably fairly manageable at the moment, I still think Betterment’s email was lacking, requiring greater explanation, and certainly a lot more ownership and sympathy for those who did just send them money in response to an email that — for all purposes — was from their official channels.
Their communication to me screams of someone much more concerned with damage control than actually warning people of the risk.
Note: I don’t actually know that their partner was literally hacked, or what the story is behind the email. However, unless there really was consideration of a Betterment promotion to not only give people $4.5m in exchange for depositing $1.5m of funds, without a limit of terms, by sending money to a random crypto account… well, there’s no way that this email was just a “confusion.” I highly doubt it was an accidental send for a promotion they’d been discussing with their partner, etc — somebody either at the partner, or who gained access to the partner systems, sent this email from their authorized pipeline with the intention of stealing money from their customers.
The accountability for that probably ultimately falls on the email partner. But how Betterment.com communicates with their users when one of their official systems is used to target them through Betterment itself… that I feel sits very much on Betterment.
And their “warning” annoys me, to be honest.
