I just got an email from them confirming somebody else's order.

Whoever it was apparently misspelled their e-mail address in the order forms, or purposely used a phony one to avoid the possibility of spam but happened to pick one that was genuinely in use.

Either way, I would up with a plaintext order confirmation with someone else's street address and a bit of financial information in it. The customer's home address and shipping address were both in there (and in this case were the same, but if the customer had shipped to a P.O. box it still wouldn't have stopped the email exposing their home address).

Apparently they don't verify that an e-mail address belongs to the correct person before sending information on it.

I recall this site having featured, in the not too distant past, a) gripes about Digital River doing other shenanigans and b) gripes about a different company, I think a telecom, persistently sending emails with sensitive information meant for a customer to the wrong address and refusing to correct the error.

I replied to the Digital River originated email to alert them that they'd "gotten the wrong number" and suggest that they change such emails to just contain links back to their site, where a customer can login to see whatever the email would have contained.

Create Account
Nickname:
Password: