In Norway we have a service (mobile app) called Vipps that we use for quick money transfers between individuals, we can also use it to pay in some stores, and as a way of authenticating ourselves online.

I started using Vipps back in late 2015 when I was still serving my compulsory military service. My fellow soldiers and I used to make dinner together and really loved how simple Vipps made it when we were going to split the bill. The app has a calculator and a group functionality for splitting bills. We used it multiple times a week.

In order for the app to function, ie. to send money you need to provide Vipps a phone number in order to find the receiving person, back then I never really questioned this.

Fast forward to 2019, I’m studying Computer Security at UiB and I’ve recently met my SO. I randomly got a phone call from a number I didn’t recognize and I couldn’t find it on nummeropplysingen (collective concept for yellow pages), and then my SO said: “Just look it up on Vipps and see if you get a result”. And to my surprise I found out who had called me, I could see their full name and even an associated photo.

I found this invasive. Because, I’ve also registered against being visible on nummeropplysingen in Norway, and to know that someone can easily find me on Vipps (if they have my number) was concerning.

A lot of modern payment systems in Norway use Vipps and most day-to-day people rely heavily upon it. Heck, even I rely upon it. And if you don’t have Vipps you suddenly become a “burden” for “everyone”, since they now have to transfer money manually via their bank.

I believe that Vipps should allow for usernames as a means of finding other when you’re going to send them money. That way you don’t need to provide them with your phone number if you are scared they are going to do something with it etc.

I reached out to Vipps in early 2021 and asked them if they’ve considered this at all, and they “kindly” replied that this is not something they think of as an issue. They referred to their privacy policy that this is something their users are made aware of when they start using Vipps. Everyone I’ve told this to tells me that this is news to them, that they never were made aware of it (heh, I guess my friends don’t read the TOS or the Privacy policy). Vipps also said that they’ve been in contact with supervisory authorities in Norway and were told that they comply with national privacy laws. They simply say it is not possible to look up users with any other method than a phone number, at the moment.

Again, I believe Vipps needs usernames or at least another alternative measure to let their users identify themselves via the app. What do you think? I’m curious what others think about this. (I know this is mostly relevant for Norwegian citizens).