Money isn’t free. Here’s what to know before downloading a cashback app

“Cashback” apps make an enticing promise. You download an app or click on a web browser extension. You go about your online shopping as usual, spend money, but then get some cash back. It sounds simple, right?

In recent years, cashback programs have made a serious splash with online shoppers.

The Singapore-based company ShopBack, for example, currently has more than 55 million customers worldwide and was last valued at A$1.4 billion.

And it’s competing in a crowded market, alongside companies such as Freecash, Honey, Kickback, Boost your Super and Grow My Money.

Even some of the big banks are getting in on the cashback trend. Westpac has partnered with Shopback, NAB has its own “NAB Goodies Program”, and Commonwealth Bank has “CommBank Yello”.

Of course, nothing is free. When a “middle man” cashback company is involved, either you or the retailer is paying somehow. Here’s how these programs work – and some of the risks you should be aware of.

Money for nothing?

Cashback programs entice shoppers with incentives such as cash, discounts and rewards when they make a purchase.

Some might be a free app, others a browser extension to use while online shopping. But they’re almost always designed to serve consumers with advertisements and collect consumer information.

The typical model is to track purchases using an app or browser, and then deal out “rewards” once certain conditions are met.

This could include:

• meeting a minimum spend
• purchasing particular products
• waiting until your purchase is tracked and approved.

To avoid products being returned after rewards have been granted, wait times for cash back can be long and indefinite.

Where does the money come from?

There are a few different ways these companies make money.

One is by providing a simple advertising service. Cashback companies will often channel online traffic to retailers in return for a commission. They then use this commission to offer consumers rewards for their purchases (and keep some for themselves as profit).

But they also typically collect extensive data about their users’ online behaviour – including searches for products they’re interested in, shopping history and more.

Your data is valuable

When you download an app or use a web extension, you may need to enter information or “accept” that the software will collect your information.

However, even when you “consent” to disclose your personal information, you may not realise the extent of what you’re handing over, including your sensitive information.

Most data collection, use, storage and disclosure is difficult to detect and track. Sometimes consumers won’t know what privacy implications their app or web extension usage will have in future.

In the worst case scenario, a consumer’s identifying data may be sold and bought multiple times online without their knowledge. (However, some apps specifically state they don’t sell that data.)

Consumer data is valuable to companies who are trying to understand consumer behaviour, such as purchasing habits. This data also appeals to companies trying to market products, networks involves in identity thefts, and scams and criminals who take advantage of data breaches.

What the law says

Information privacy is protected by the Privacy Act and the 13 Australian Privacy Principles that restrict how an entity can handle a consumer’s personal information.

This includes strict rules about management, notification, use, cross-border disclosure and security of personal information.

Private information can be subject to a data breach if adequate data security systems are not in place. And even large, well known and trusted companies are not immune to this risk.

For example, in 2023, Singapore’s data privacy watchdog fined Shopback S$74,400 (A$83,300) over a 2020 data breach that impacted more than 1.4 million people.

Private, personal and sensitive information can cross borders without detection and this can lead to wider exposure of information that may be used to identify or impersonate an individual.

Buyer beware

So, while getting 5% back on your purchases, there are a few key things to be aware of.

Consumers need to be careful when disclosing information to these companies and this includes information that can identify them as an individual. For example, personal information might include names, a signature, an address, phone number, date of birth or a photograph.

Sensitive information might include ethnicity, gender, health data or beliefs.

Generally, sensitive information has a higher level of privacy protection than other personal information, and should be treated with an extra level of care.

Financial information is a special category of information and consumers should think carefully before disclosing financial details to a third party – even if there is an incentive offered.