Upside is a cashback app that connects to your debit or credit card, not your bank account directly—and that distinction matters for your security
Upside does not ask for your bank login credentials or direct access to your account. Instead, you link a debit or credit card through their app, the same way you would add a card to any other rewards program. The app then tracks purchases you make with that card at partner gas stations and restaurants, and deposits cashback into a separate Upside wallet or your linked bank account later.
The real security question is not whether Upside can see your account—it cannot—but whether the connection itself is encrypted, whether Upside stores your card data safely, and what happens if Upside is breached. Those are the things that actually determine whether linking is safe.
Key Takeaways
- Upside connects to your card, not your bank account login, so the app cannot drain your account or change your settings.
- Your card data is encrypted in transit and stored on Upside's servers, but any company that holds payment information can be a target for hackers.
- Upside is backed by venture capital and has been operating since 2014 without a major public breach, though no company is breach-proof.
- You can limit your exposure by using a debit card with fraud protection, setting a low daily spending limit, or using a virtual card number if your bank offers one.
- If unauthorized charges appear, your card issuer—not Upside—is responsible for refunding fraud under federal law.
How Upside actually accesses your payment information
When you link a card to Upside, you enter the card number, expiration date, and CVV into the app. Upside does not ask for your bank username, password, or PIN. The app uses that card data to identify your purchases at partner merchants and calculate your cashback.
This is fundamentally different from apps that ask for your online banking login. Those apps—sometimes called "open banking" or "aggregator" apps—can see your full account history, transfer money, and change settings. Upside cannot do any of that. It can only see transactions made with the specific card you linked.
The card data itself is encrypted using industry-standard protocols (TLS/SSL) when it travels from your phone to Upside's servers. Once stored, it is encrypted at rest as well. This is the same encryption standard that banks, credit card processors, and major retailers use.
What happens if Upside is hacked
If Upside's servers are breached and your card data is stolen, the thief would have your card number, expiration date, and CVV—the same information a waiter or gas station attendant sees when you hand them your physical card. They could potentially make online purchases or create a duplicate card.
However, you are not liable for those charges. Under the Fair Credit Billing Act and the Electronic Funds Transfer Act, your card issuer must refund unauthorized charges. For credit cards, your maximum liability is $50 per card, and most issuers waive that entirely if you report fraud quickly. For debit cards, your liability is $0 if you report the fraud within two business days; after that, it rises to $50 or potentially $500 depending on how long you wait.
Upside itself has not experienced a major public breach since its founding in 2014. The company is backed by venture capital firms and has millions of users. That track record is not a may provide—no company is breach-proof—but it suggests the company takes security seriously enough that investors trust it with their money.
Comparing Upside to other cashback apps
Most cashback apps work the same way Upside does: they connect to your card, not your bank account. Apps like Fetch Rewards, Ibotta, and Rakuten all use card-linking technology. Some also offer the option to connect your bank account directly for transfers, but that is optional and separate from the cashback tracking itself.
The difference between apps is usually in how they store your data, how often they update their encryption, and how quickly they respond to security issues. Upside publishes a security policy and has a bug bounty program that pays researchers to find and report vulnerabilities before hackers can exploit them. That is a sign of a company taking security seriously, though again, it is not a may provide.
If you are uncomfortable linking any card to any app, you can use a virtual card number instead. Many banks and credit card issuers (American Express, Capital One, Citi, Chase, and others) let you generate temporary card numbers that are tied to your real account but expire after one use or one merchant. This limits the damage if that number is stolen, because it cannot be used anywhere else.
Steps to reduce your risk when using Upside
If you decide to link a card to Upside, you can take several steps to limit your exposure. First, use a credit card rather than a debit card if you have one. Credit cards have stronger fraud protection than debit cards, and fraudulent charges do not come directly out of your checking account.
Second, link a card with a low credit limit or one you use only for Upside. This caps the damage if the card number is stolen. Third, check your card statement weekly rather than monthly. The sooner you spot unauthorized charges, the sooner you can report them and the easier the refund process becomes.
Fourth, enable transaction alerts on your card if your issuer offers them. Most banks let you set alerts for any charge over a certain amount, or for charges in specific categories. This gives you real-time notice if someone uses your card without permission.
Fifth, use a virtual card number if your bank offers one. Generate a new number for Upside, and if that number is compromised, you can deactivate it without affecting your real card.
What Upside does with your data after the transaction
Upside uses your transaction data to calculate cashback and to show you personalized offers at partner merchants. The company does not sell your personal data to third parties. However, Upside does share anonymized transaction data with its merchant partners so they can understand customer behavior and adjust their offers.
You can review Upside's full privacy policy in the app or on their website. It explains what data they collect, how long they keep it, and who they share it with. If you are uncomfortable with any of those practices, you can delete your account and unlink your card at any time.
Cashback you earn sits in your Upside wallet until you transfer it to your bank account. Upside does not automatically transfer it, so you control when and whether that money leaves the app. This means if your Upside account is compromised, the attacker cannot drain your cashback without your permission.
When linking a card to Upside is not the right choice
If you have had your identity stolen in the past, or if you are managing finances for someone else (a minor, an elderly parent, or someone with power of attorney), linking a card to a third-party app adds a layer of complexity to your fraud monitoring. In those cases, it may be safer to skip Upside and use cashback offers directly from your bank or credit card issuer instead.
If you use a prepaid card or a card from a smaller bank that does not offer fraud protection, the risk is higher. Prepaid cards often have weaker protections than credit or debit cards from major issuers, and smaller banks may take longer to investigate fraud claims.
If you are not comfortable with any third party holding your card data—even encrypted—that is a valid choice. Upside is optional. You can earn cashback through your bank's rewards program, your credit card's rewards program, or by shopping through your credit card's online portal instead.
Frequently Asked Questions
Can Upside see my bank account balance or transfer money without my permission?
No. Upside only sees transactions made with the specific card you linked. It cannot see your account balance, access other cards or accounts, or initiate transfers. Only apps that ask for your online banking login can do those things, and Upside does not ask for that.
What should I do if I see a charge on my card that I did not make through Upside?
Contact your card issuer immediately—not Upside. Your bank or credit card company is responsible for investigating fraud and issuing refunds. Report the charge as unauthorized, and your issuer will walk you through their dispute process. Most issuers can issue a temporary refund within one to three business days while they investigate.
Is Upside safer than linking my card to other cashback apps?
Upside uses the same encryption and security standards as other major cashback apps. The real difference is in the company's track record and how quickly they respond to security issues. Upside has been operating for nearly a decade without a major breach, which is a good sign, but no app is completely risk-free.
Can I unlink my card from Upside anytime?
Yes. You can unlink your card in the app settings at any time. Once unlinked, Upside cannot track new purchases or access your card data. Any cashback you already earned stays in your Upside wallet until you transfer it or delete your account.
What if Upside goes out of business?
If Upside shuts down, your card data would be deleted according to their data retention policy. Any cashback in your wallet would likely be forfeited, though the company would probably give users notice and time to transfer their balance before closing. This is a small risk, but it is one reason to transfer your cashback to your bank account regularly rather than letting it accumulate in the app.