Category: Corporate policy gone wrong

Update: user K replied with what I think is the best insight so far:

Just happened to me today when I went to sign up after a year since I was a member. Noped right out of there. You’re right about the merchant fees but I suspect the real reason they are not billing with cards anymore is because of the high volume disputes they have. I used to work for a bank in the claims department and gym memberships and credit scores were our bread and butter. Visa and Mastercard have set rules in regards to merchant rights and would almost always return the funds back to the customer. An ACH transaction does not have the same protection and NACHA regulations does not cover product and services therefore if a customer disputed the transactions the likelihood of receiving the funds back is slim to none.

(emphasis added by me)

I did join a different gym. I was ready to join Planet Fitness; I took the tour, a pleasant young man explained the membership plans, and they sent me a link to sign up at. The facility seemed good, and it was closer to my home than the one I did end up at. But their sign up process demanded that I hand them my checking account number and routing number. That’s a nope, and we’re done.

I even found the Contact Us part of their web site and sent them an email asking what other options were available. They never bothered to respond.

The gist of the problem is computer security; Planet Fitness internal IT security isn’t that good. Well, no-one’s internal security is all that good – just ask T-Mobile: their 2021 data breach was T-Mobile’s fifth incident in four years. Worse, when T-Mobile was asked about the potential for security problems, their answer was “What if this doesn’t happen because our security is amazingly good?“

I can’t help but think that Planet Fitness feels the same way.

Why can’t I have the membership fee charged to my credit card? When their IT infrastructure gets breached (not if), I can easily get a new credit card number from my credit card company – if Planet Fitness would allow me to use a credit card. I’ve actually had to do that before; I got a physical letter in 2016 letting me know of a breach with a particular company that I did business with every couple of months. Changing the credit card number was pretty easy. Slightly annoying, but if that was the worst thing to happen to me in 2016, I’m leading a pretty charmed life.

But what happens when Planet Fitness loses my checking account number (and routing number)?

That would be a disaster.

Sure, I could close the compromised account, and open a new one; but my paycheck gets deposited there. Everything funnels through there. I even had a need to get paper checks printed up a year ago, and that expense of the rest of the paper checks would go in the shredder. Is Planet Fitness going pay me to get new checks printed? If I sued for it, I’m pretty sure I’d win – unless their defense was “well, if you are stupid enough to give us your checking account number, then that’s on you.” Maybe that is the way they think about their customers. 🤷

It also bothers me that Planet Fitness is only being somewhat truthful about why they want to pull the money directly out of my checking account. From their web site:

The method in which members are able to pay for their monthly membership varies by location, but many Planet Fitness clubs accept payment through checking accounts only. We require an Electronic Funds Transfer (EFT) through checking accounts for your convenience: This allows us to be able to continue your membership without interruption or the hassle of updating your payment information if your credit cards are lost/stolen, invalid or expired.

https://www.planetfitness.com/about-planet-fitness/customer-service/billing-faqs

I have a problem with “… for your convenience ….”

This is flat out falsehood. It’s not for my convenience, it’s for Planet Fitness’ convenience.

Also, Planet Fitness doesn’t have to pay the credit card company their commission. That’s the real reason they are willing to risk my security; they are being cheap. My security versus a tiny bit of extra profit? SELL ‘EM OUT BOYS!

It’s also important to note that there’s a major discrepancy in ACH vs. credit card fees. Broadly speaking, ACH transactions have the lowest costs associated with any payment system. On the other hand, credit cards typically charge 2.5% of the transaction value in fees, plus an additional processing fee. So, when it comes to ACH vs. credit card fees, ACH is the clear winner.

https://gocardless.com/en-us/guides/posts/ach-vs-credit-cards/

So, I found a gym that lets me pay by credit card. It is farther away from my home. It doesn’t have as many locations. But it does let me subscribe with a credit card, and it doesn’t lie to me about why they prefer to have my checking account number. They did ask; but they were honest and said it was because they wanted to avoid having to pay the credit card merchant fees. If I was willing to pay more to cover that, they’d let me use a credit card for billing. Yes, I am, because I know that no company’s IT security is all that good. I’m paying now for for easier recovery later. That gives me peace of mind.

LastPass was, for seven years, my password manager of choice. I liked that Steve Gibson of Gibson Research Corporation liked it. I liked that it had Yubikey support. I liked that it had an app for my iPhone. I liked that because it was a cloud service, my passwords followed me around.

The idea is a good one, too: memorize a single complex password, use it plus 2FA (“second factor authentication” in this case my Yubikey) and then make the passwords on every other web site extremely complex. Like Hn6k344SdRt#CT_Epste1nd1dn’tk1llh1mself_PFnPr2XP#J$4P*@Lyxi!r complex.

I did not mind paying for that service, since I know that it costs money to run servers and pay employees and such. The price really wasn’t too bad, either.

But somewhere along the line, the creators of LastPass decided to cash out. They sold the company to LogMeIn. But now, the LogMeIn folks are out cash money, and they need to make that money back; the quicker, the better. Suddenly I and all their other customers began to look like marks to be played.

Sigh.

For several months, I wanted to take a screen shot of my LastPass initial login screen, and then post the screenshot to the Reddit Asshole Design community. What it was, was that all of a sudden, LastPass would post a fake “Warning – We Care About Your Security” alert every time I logged in. But what it really was, was a request to put my credit card number on file with them, so they could auto-renew. It wasn’t about my security. It was about theirs. I’m going to need to buy a pair of cowboy boots, the bullshit is getting so deep around here.

This was a constant reminder that the company had changed, and wasn’t the same company I signed up with. What finally pushed me over the edge was their announcement that as of March 16, 2021 you have to pay, or else “no passwords for you!” if you want to use LastPass on mobile. So now we see their true character: “I Am Altering the Deal, Pray I Don’t Alter It Any Further.”

And I’m out.