Slashdot Mirror


Security Firms Fined Over Never-Ending Subscriptions

Barence writes "'Security firms Symantec and McAfee have both agreed to pay $375,000 to US authorities after they automatically renewed consumers' subscriptions without their consent.' The two companies were reported to the New York Attorney General after people complained that their credit cards were being charged without their consent. The investigators found that information about the auto-renewals was hidden at the bottom of long web pages or buried in the EULA."

47 of 194 comments (clear)

  1. Pathetic by akanouras · · Score: 5, Insightful

    $375,000? That's petty change compared to how much they made out of it.

    1. Re:Pathetic by Jaysyn · · Score: 2, Interesting

      No doubt. That is simply cost-of-business to those crap-peddlers.

      --
      There is a war going on for your mind.
    2. Re:Pathetic by gnick · · Score: 3, Insightful

      This is unconscionable. AVG has also auto-renewed my subscription perpetually ever since I installed it. I want my bandwidth back!

      Seriously though, "cost of business" is exactly right. If the return outweighs the risk*most-likely-consequence, no business would act ethically. It's like insurance companies randomly denying claims knowing that some denials will go unchallenged and they'll come out ahead. The punishment should outweigh the crime.

      --
      He's getting rather old, but he's a good mouse.
    3. Re:Pathetic by ObsessiveMathsFreak · · Score: 5, Insightful

      In the past, when an aristocrat or lord committed a crime against a lesser citizen, they were not held to account in the same way as an ordinary man would. Instead of summary justice, they needed only to pay a small fine or make some other slight amends. This included crimes such as aggravated assault and murder.

      Our society is not so different.

      --
      May the Maths Be with you!
    4. Re:Pathetic by lavacano201014 · · Score: 4, Informative

      They still have a free version but they just don't advertise it.

      --
      A wise man once said, "Where is my other quotation mark?
    5. Re:Pathetic by oakgrove · · Score: 5, Interesting

      However, this is good news in that despite the EULA containing info about the auto-renewal, that wasn't enough to justify the practise. Further proof that, in the eyes of the law, the EULA is anything but iron-clad.

      --
      The soylentnews experiment has been a dismal failure.
    6. Re:Pathetic by Arthur+Grumbine · · Score: 3, Informative

      They still have a free version but they just don't advertise it.

      That's right, they've outsourced their advertising to WHOOSH, a small, but persistently oblivious content-writing firm with members all over the world, most commonly found posting in this thread.

      --
      Now that I think about it, I'm pretty sure everything I just said is completely wrong.
  2. Humph... by fuzzyfuzzyfungus · · Score: 4, Funny

    Anybody who is Anti-Symantec is objectively Pro-Virus.

    1. Re:Humph... by sakdoctor · · Score: 4, Insightful

      Synamic products = Virus
      Anti-Synantec = Anti-Virus

    2. Re:Humph... by jimbudncl · · Score: 2, Funny

      Anybody who is anti-Semitic deserves to get a virus? I'm confused.

  3. Fine by Hatta · · Score: 4, Insightful

    Security firms Symantec and McAfee have both agreed to pay $375,000 to US authorities

    And how much are they going to pay to the people they defrauded?

    --
    Give me Classic Slashdot or give me death!
    1. Re:Fine by Random2 · · Score: 3, Insightful

      Were the people technically defrauded? They did agree to the service via EULA after all...

      --
      "Our goal each year should be to increase the number of goals we set for ourselves!"
    2. Re:Fine by TheRealMindChild · · Score: 4, Insightful

      I'm sorry. While I agree that reading a contract of any merit is important before agreeing to it, some EULA's are DOZENS of pages. I have two colleagues who's whole job is solely to read and interpret EULA's for software that has potential of being purchased. Combine these two things, with the affirmation that you can screw end users by hiding fees in the EULA and you are asking for absolute disaster. It shouldn't be allowed at all.

      --

      "When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
    3. Re:Fine by snowraver1 · · Score: 5, Insightful

      It's hard to say. As gets brought up on /. quite frequently, EULAs have never really been tested in court. I personally feel that they should be unenforcable because no one reads them, and they are too complicated for the average person. If they are enforceable, it makes it too easy for entities to slip in one-sided terms.

      As a consumer, I would expect that any rebill stuff should be clearly presented to the customer to prevent any confusion, at the time of checkout. It should be in bold, and might include a checkbox to check representing that you understand that this will be rebilled.

      I feel that at best, it was underhanded and deceiving, and at worst downright fraudulant.

      --
      Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
    4. Re:Fine by Hope+Thelps · · Score: 4, Informative

      Were the people technically defrauded? They did agree to the service via EULA after all...

      That's the nature of fraud. Theft is when you take something that belongs to someone else without their permission. Fraud is when you trick someone into agreeing that you can have something. Some cases are very clear cut when the poor frail old lady is tricked into signing away everything she had, some are more mundane like this. There are a LOT of grey areas but getting someone to 'agree' to terms they haven't read or haven't understood is a common tool of fraud.

      --
      To summarise the summary of the summary: people are a problem. ~ h2g2
    5. Re:Fine by TheRealMindChild · · Score: 3, Interesting

      What is really sad is the increasing trend of LEGAL business models being dependent on misleading the customers.

      You ever see that crap on TV "Try your free sample now! 30 day sample, FREE!!!". They tell you to verify you are over 18, you need a credit card. What they don't tell you, and what most people find out the hard way, is tucked away in your free samples informational booklet that you will never read is that when you ordered this free sample, you agreed to a monthly, recurring renewal of this product.

      Ever want to try out a gym like Bally's? You know, where they offer you an introductory rate at almost nothing for a month? Yeah, about that. If you don't pay attention, then you forfeit your trial status if you don't appear at the gym something like 5x a week for that month, or you automatically become a "standard member" with all fee's and penalties applicable.

      Ever seen a Cici's pizza, where they advertise their buffet for "Five Dollars and some change"? That is actually $5.99, without a drink, and if you are using anything but cash, you get nailed by a $1 "fee" for using their debit/credit machine. By the time you figure this out, you already have your family at the register, ready to eat. A little hard to back out then.

      Some of these are more obvious than others, but the point is, we gave them an inch, and they took more than a mile. It is total bullshit and it is only getting worse.

      --

      "When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
    6. Re:Fine by david_thornley · · Score: 4, Informative

      Precisely where it is now.

      The typical EULA either denies certain rights to the user, or requires the user to do something, or establishes a potentially unwanted continuing obligation. Since the user is giving something up, this requires some sort of contract. Whether, and under what conditions, a EULA constitutes a valid contract is still heavily debated, and will be until either Congress does something about it (most EULAs cross state boundaries), or there's enough generally accepted case law.

      The GPL does not deny you any rights you already had, or obligate you to do something. It establishes conditions on how you can do certain things that would otherwise be illegal. The user is giving nothing up, but if the user wants to do something beyond use the software, the user must comply with the license. This does not require any sort of contract.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    7. Re:Fine by hurfy · · Score: 3, Interesting

      Don't rely on the CC expiring. Sony managed to bill my expired Visa debit card for a Stars Wars subscription once. Turbine didn't for similar services. Not sure how that works but naturally i would have wanted it to be the opposite :( Got the bank to reverse after convincing them they couldn't explain it to my satisfaction why they let them bill an expired card.

      Back on topic...

      yup, that is barely a blip as a cost of doing business for them i am sure. Millions in subs vs $375k in fines is probably only a percent or 2. I don't see that they agreed to stop, nor any of the other bazillion companies doing the same. Just a feel-good deal for an Attorney General while the companies rewrite a couple lines of the EULA in CAPS....

    8. Re:Fine by Grimbleton · · Score: 2, Interesting

      Yes, how dare the customer pay for the transaction fees in a transaction they start.

  4. Subscription services and auto-renewal are new? by djh101010 · · Score: 4, Insightful

    You know, I can't think of a single subscription service I have that _doesn't_ auto-renew. In fact, I would be quite annoyed if I had to explicitly tell them "Yes, please, I want the Internet / satellite TV / newspaper tomorrow as well".

    Is there anyone surprised that if you sign up for a subscription, that it keeps going?

    1. Re:Subscription services and auto-renewal are new? by John3 · · Score: 5, Insightful

      I get periodic statements for my newspaper and cable/TV/phone subscriptions. Generally speaking those subscriptions are month-to-month. If I don't send a check, the newspaper stops. These folks do offer automatic billing to your credit card, but the ones I have seen are VERY clear about this offer. They don't bury the renewal option in the fine print.

      A better example to the anti-virus subscription is a magazine subscription. You know up front that you are signing up for a one year, two year, or some other subscription time period. As that time period nears an end (usually much sooner) you start to receive notices that you should renew. Even if you paid the initial subscription with a credit card, they don't automatically renew with that card.

      --
      "We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
    2. Re:Subscription services and auto-renewal are new? by atfrase · · Score: 4, Insightful

      You know, I can't think of a single subscription service I have that _doesn't_ auto-renew. In fact, I would be quite annoyed if I had to explicitly tell them "Yes, please, I want the Internet / satellite TV / newspaper tomorrow as well".

      Is there anyone surprised that if you sign up for a subscription, that it keeps going?

      I think part of the problem is that a lot of people still don't think of computer security in general, and virus/malware/etc protection in particular, as an ongoing necessity. People's computers slow down, crash, display popups or whatever, they go out and buy some product to "fix it", and think of it as a one-time deal. They don't think of it as a "subscription" and don't expect to have to renew it.

  5. Sting those bastards with a charge back by sakdoctor · · Score: 3, Interesting

    It's not immediately clear if the companies will be governed by the same rules in the UK.

    The charge-back form from your bank, will most likely have this scenario as one of the generic reasons for issuing a charge back.
    I caught sneaky virgin media dipping in for an extra month (before they turned super evil), but the money was back in my account within a few weeks.

    They'll get a charge back fee for sure; though the companies size probably makes them immune from having their card processing facility revoked, for excessive charge backs. Shame.

    1. Re:Sting those bastards with a charge back by bcrowell · · Score: 3, Informative

      Charge-backs aren't always that easy to do. I had one that I thought was super-straightforward (merchant charged me twice in a row for the same thing, and wouldn't communicate with me about the problem), but the cc company wouldn't do the chargeback because my evidence didn't convince them.

      If you've got a recurring charge that you want to cancel, and you have a feeling that the company might be sleazy about it, the simplest thing to do is just cancel the cc number associated with the periodic billing, and have your cc company set you up with a new card and a new number. Same thing you'd do for any other kind of fraud, such as identity theft. If you have other recurring payments on that card, you do have to change them to the new number, but that's probably less than half an hour of work if you don't have too many of them -- that's a lot less than the amount of time you could spend banging your head against the wall trying to deal with the dishonest company that's the source of the problem.

      Trying the charge-back can't hurt, of course. If the merchant is both small and sleazy, it might actually have a significant effect on them. If there are enough charge-backs, the cc company will shift them to a higher-risk category (which costs the merchant money).

      The sleaziest example of abusive recurring charges I ever had to deal with was with the company that was providing me with a merchant credit card account. I canceled the account, but then a year later their charges mysteriously started showing up on my monthly cc bill again. Getting a new account number was my cc company's suggestion. Worked great.

  6. Rebills? by basementman · · Score: 4, Interesting

    I wonder if this means they will also begin cracking down on people promoting rebills (crap online products that start with an initial buy in price of $2 but then charge you another $60 after a month). Which they try to claim they're legal because they bury it 4 pages in on the Terms and Conditions page which is link to in fine print on the bottom of the sales page.

  7. If you buy from abusers, expect to be abused. by Futurepower(R) · · Score: 2

    If you agree with the those charges, then logically you should NEVER by something from Symantec and McAfee. If you do business with abusers, expect to be abused.

    1. Re:If you buy from abusers, expect to be abused. by MightyMartian · · Score: 4, Funny

      I don't deal with either, not because of this, but because they're products suck. I use F-Prot nowadays, cheap and simple, with a dead-dog simple LAN client. I wouldn't install Symantec's garbage on my worst enemy's computer, because I'm a bastard, but not a cruel bastard.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    2. Re:If you buy from abusers, expect to be abused. by hairyfeet · · Score: 3, Interesting

      Yeah, which is a shame, as in the days of Win3.xx and Win9X Norton stood for quality. In the shop i was working at at the time we pretty much insisted that a customer pick up Norton Utilities with their new PC purchase. Norton Utilities and especially Disk Doctor were simply miles above anything MSFT packed with the OS and would often fix things that would have meant a return if you only used MSFT tools. But then Win9X gave way to WinNT arch and they just went down the shitter.

      Now as far as AVs go, I give Avast! to my customers that still have Win2K workstations(like the one I am typing this on) and Comodo Internet Security to those on XP32/64 and Vista. While I think Avast! runs better on older hardware Comodo is simply more user friendly IMHO and seems to be the best I've tried so far for 64 bit Windows. On my XP X64(which despite all the horror stories I heard actually turned out to be a damn fine OS) it hardly uses any resources and does its job quietly and effectively. So my rule of thumb is-older machine equals Avast! and newer and 64bit equals Comodo.

      --
      ACs don't waste your time replying, your posts are never seen by me.
  8. Malware by Mr_eX9 · · Score: 4, Insightful

    Antivirus companies: The world's only legitimate malware vendors.

  9. Do I get some of that fine money? by charleste · · Score: 5, Informative

    <rant>About two years ago, I noticed this after I actually went to their website AND called to cancel prior to renewal. It still renewed, and the "customer service" rep had the balls to tell me that they couldn't refund my money when I called about it. I took that one as far up the food chain as I could - including writing an email to the president or whatever, and got the "immediate" response that they wouldn't auto-renew NEXT time. It took approximately 3 months to get my money back. ONLY because I had documented my cancellation with workers numbers and crap. I figure they owe me about $600 in time. </rant>

    1. Re:Do I get some of that fine money? by JSBiff · · Score: 4, Interesting

      I find it very. . . interesting, that on the McAfee website, you can turn ON the auto-renew yourself through the account management, but to get it turned OFF, you have to contact their customer service reps. What kind of BS is that? I'm getting my parents away from McAfee, and I myself left McAfee a couple years back. They used to be a good company to deal with. Now, I just don't trust them anymore. Setting up your website like that just screams out to me that they are trying to make it as hard as possible for people to get out of the auto-renew.

  10. rtfeula tag? by system1111 · · Score: 2, Insightful

    Really??? Something such as auto-renewal charging is not EULA material. Most users have been brainwashed into clicking yes through these things. Sounds like I should make 40 page EULA on my next app that states "LULz if accepted you agree to the additional BS fee of 1 million dollars". I don't see why they couldn't do anything as mentioned here as per magazine/utilities models. (Yes utilities have auto renew but all that I've come across force you to sign up and hit at least 3 "Are you sure you want to turn this on buttons") Really this just comes across as a petty way to get a few more bucks out of people.

    1. Re:rtfeula tag? by Cheech+Wizard · · Score: 2, Funny

      PC Pitstop included a clause in one of its EULAs that promised anyone who read it, a "consideration" including money if they sent a note to an email address listed in the EULA. After four months and more than 3,000 downloads, one person finally wrote in. That person, by the way, got a check for $1,000 proving, at least for one person, that it really does pay to read EULAs.

      http://www.pcpitstop.com/spycheck/eula.asp

  11. EULA not binding by Comboman · · Score: 2, Insightful

    In a court of law, clicking OK on a EULA does not carry the same weight as signing a contract.

    --
    Support Right To Repair Legislation.
    1. Re:EULA not binding by Anonymous Coward · · Score: 4, Insightful

      Hmm, there is no case law contradicting his statement.

      see how easy that is without proof?

    2. Re:EULA not binding by Fulcrum+of+Evil · · Score: 2, Insightful

      so post a link, why don't you?

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
  12. Re:So let me get this straight... by n30na · · Score: 2, Insightful

    Are you saying you read the EULA for every piece of software you use? For most of us with jobs and limited time, that's not a reasonable reality.

  13. retunds? by n30na · · Score: 2, Informative

    Customers will also be allowed to apply for refunds for up to 60 days after being charged.

  14. Law enforcement by FlyingBishop · · Score: 2, Funny

    It's getting to the point where law enforcement really needs to handle PC security. We have strict laws on what a car needs to go on the road, we really need equivalent rules about what a PC needs to connect to the Internet. I'd put something like Symantec or Mcafee as the equivalent of auto insurance, in terms of the damage it prevents to other computers on the internet. And like auto insurance, it needs to be mandatory (in addition to keeping things up to date against security threats, much like cars must keep up to safety and pollution standards.)

  15. Ah yes... by binaryseraph · · Score: 2, Insightful

    Nothing like taking pages from the porno industry M.O. Beautiful.

  16. Home users shouldn't pay for Antivirus by pdragon04 · · Score: 5, Insightful

    I run my own home computer repair company (but don't have enough bandwidth to post my URL here). I give all my customers the free versions of AVG, Avast, or Clamwin, depending on their needs/preferences. Usually throw on Spybot and show them how to use the Immunize feature as well. My advice to them is to never, EVER pay for Antivirus/Antispyware software ever again. It's doesn't prevent infections and they end up just having to pay someone to fix it for them anyway. The free stuff is plenty good enough for notifying them when an infection has occurred. My customers thank me for my honesty, for saving them money, and I get plenty more business than I ever would shelling out subscriptions to crap like this.

  17. Uh huh... by interval1066 · · Score: 2, Insightful

    I hate to be an "I told you so..."

    No I don't. I told all my family and friends, geek and non-geek alike, to opt-out of bundleware, especially Symantec and MacAfee. There are a number of free offerings out there that are less annoying, just as or more effective, and by that are less likely to steal from you.

    --
    Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
  18. Free Alternatives by the_denman · · Score: 5, Informative

    There are plenty of free alternatives out there, I personally prefer AVG. Here is an article laying the free options out for you.

  19. ClamAV by tepples · · Score: 2, Insightful

    sadly, some government departments institutionalise this ("all PCs must have anti-virus") which led to a spate of pointless "virus scanner" programs for gnu/linux with virus-signatures from the 1980's.

    If mail is going through your Linux box, wouldn't you want to run ClamAV on the attachments?

  20. Read the fine print. . . by JSBiff · · Score: 3, Informative

    Those "Free" versions (AVG, Avast, maybe others) are often restricted in the fine print so that you can do no commercial activity whatsoever on your computer. It's ambiguously enough stated that even just using a remote access program to access your computer at your job to do work from home might be violating the EULA. Granted, it's not likely that they'll actually catch you, but the point still remains that if you do anything that might be construed as generating income now or in the future, you might be a fly in their web.

    Not an issue as much with ClamWin, but ClamWin has no real-time scanner, which despite the parent post's assertion, do sometimes stop infections before they happen (not always, it's true, but enough of the time that it's definitely worth having anti-virus software of some sort). The On-access scanner isn't *required*, but most users will not remember to manually scan stuff 100 percent of the time. The On-access scanners, will provide much more consistent protection against infection than a manual scanner, for most users.

    Personally, I've been using the AVG Free edition, and if I need to upgrade to a 'commercial use' license in the future, AVG seems to have slightly better prices than most of the others out there.

  21. Standard here in NL by tsa · · Score: 3, Insightful

    Here in the Netherlands automatic renewal of subscriptions to anything is standard. You have to call or write to the organization to stop your subscription by the next renewal period. This is extremely annoying and tedious of course. I'm so glad I have an American provider for my websites and email! Every year I get an email from them, in which they ask me in a friendly way to renew my subscription. That's the way I like it!

    --

    -- Cheers!

  22. Credit card fee$ by KingAlanI · · Score: 2, Interesting

    I can't comment on the quality of Cici's food, but I must say that $1 goes overboard. PayPal would ding me for 47 cents on a $5.99 payment [$0.30 plus (2.9% * payment_size)], and a large business probably gets better rates. [Paypal almost certainly has the leverage to be paying much less than 2.9%, that's where their profit comes from. :)]

    So while I approve of (in principle) extending the credit card charge to customers *, Cici's is definitely ripping people off with the amount of the charge.

    *
    Hiding costs like CC transaction fees seems like a bad idea, especially if they can easily be avoided.
    Maybe if the customer had to pay the fees, they'd consider using another payment method. If the merchant can't or doesn't pass the fees along, it becomes a Not My Problem(TM)-type situation. The credit card companies obviously don't like that possibility, so I suspect that's why they stress "can't pass the fees along" in their merchant contracts. (There are antitrust issues here, and with the credit card merchant fees in general)

    Although I don't have a citation handy, I suspect that in some areas, it's written into the relevant law that the fees can't be passed along - although shielding the public from shenanigans like Cici's is a good idea, the credit card company lobbyists want such laws for the reasons mentioned earlier.

    On small sales, the flat-rate portion of the fee is a big deal. On low-margin sales, the percentage charge is important, so no wonder the end-merchants want to do something about it

    Selling online, credit card/PayPal are a different issues, because it avoids the aggravation, cost and time-delay of mailed in payments. As such, for physical stores, it's a different story.

    --
    I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.