Is Rakuten Safe? Permissions, Privacy and Ownership Checked

Is Rakuten safe and legit to use?

Rakuten is legit: it is a real cash-back portal that retailers pay for referrals, and it passes part of that commission back to you. For most shoppers it is safe, provided you treat the browser extension as what it is, a tool that watches which shopping sites you open.

The complaints you find on Reddit, Trustpilot and ConsumerAffairs are mostly about cash back that never tracked, slow payouts and account reviews, not stolen cards or malware. Those are genuine frustrations, but they are service problems rather than security breaches. The trade-off worth weighing is privacy: Rakuten earns money by knowing where you shop.

Is it a scam?

No. You sign up free, click through to a store, buy normally and receive a share of the store's referral fee.

Is the extension malware?

No, it is Rakuten's own shopping assistant. It does ask for wide site access, which is normal for this category but still worth restricting.

What is the main risk?

Profiling of your shopping activity, plus account takeover if your email or password is weak.

What goes wrong with money?

Orders that fail to track, cash back reversed after returns, and waiting a quarter to be paid.

Who should skip it?

Anyone who does not want a third party logging which stores they visit and what they spend there.

What's the catch with Rakuten?

The catch is that you are the referral being sold. Stores pay Rakuten an affiliate commission when you click through and buy; Rakuten keeps a cut and hands you the rest as cash back. Nothing extra is charged to you, and prices are the same as going to the store directly.

That model explains nearly every quirk. Cash back depends on an affiliate cookie set when you click through Rakuten or activate the extension. If another coupon tool, a rival cash-back site or a cookie cleaner overwrites or deletes that cookie before checkout, the store credits someone else, or nobody, and you get nothing.

It also explains the data side. To show offers and pop up at checkout, the extension must recognise the store you are on. That means it looks at the pages you open, at least enough to match them against its merchant list.

• The store pays, not you. Rakuten has no reason to charge members, which is why joining is free.
• Rates move constantly. Boosted percentages are time-limited promotions, so the rate you saw last week may not apply today.
• Exclusions are common. Gift cards, certain product categories and orders using coupon codes not listed on Rakuten are frequent reasons for zero cash back.
• Only one referral wins per order. Whichever affiliate link was clicked last usually gets credit.

Who owns Rakuten, and what happened to Ebates?

The US cash-back site started life as Ebates, and Rakuten Group bought it in 2014. In 2019 the service was renamed Rakuten in the United States, so older reviews that mention Ebates describe the same program under its old name.

Rakuten Group is a large, publicly listed Japanese company founded in 1997, with e-commerce, fintech, mobile and media businesses. That cuts two ways for safety. A company that size has plenty to lose from a data scandal and publishes a formal information security policy. But your data also sits inside a group that runs many services, so check the privacy policy for how information is shared with affiliated companies and advertising partners.

The Rakuten name also appears on travel, ebook and streaming services. They belong to the same corporate family but have their own accounts and terms, so a good experience with the cash-back site does not vouch for any of them, and the reverse is also true. Judge each on its own terms page and refund policy.

What can the Rakuten Chrome extension see?

The Rakuten extension needs to read pages on shopping sites to detect stores, show the cash-back rate and activate your referral. Chrome describes that as permission to read and change data on websites, and for a shopping assistant it typically covers all sites rather than a short list.

We do not reprint its permission list here, because manifests change with updates and a stale list is worse than none. Check the live version yourself; it takes under a minute. Our explainer on the access to all websites permission covers what that grant allows in practice.

1. Type chrome://extensions in the address bar and press Enter.
2. Find the Rakuten card and click Details.
3. Read the Permissions list. Wide site access, tab information, cookies and local storage are what you would expect from a cash-back tool; access to your full browsing history would deserve a closer look.
4. Under Site access, switch from On all sites to On click or On specific sites, then add only the stores you shop at.
5. Open the extension's Chrome Web Store listing and scroll to Privacy practices to see which data types the developer says it collects.
6. If you only want cash back occasionally, turn the toggle off on the extension card and switch it on before a planned purchase.

On Android and iPhone, Chrome does not run desktop extensions, so Rakuten on mobile means its app or the website. The app has its own permission prompts in your phone's settings, separate from anything you set in desktop Chrome.

What data does Rakuten collect about you?

Expect Rakuten to hold your account details, the purchases that earn cash back, your payout details and device data from its site, app and extension. That is standard for a cash-back service; the exact list and who it is shared with are set out in Rakuten's privacy policy, which is worth ten minutes before you install anything.

The extension is the more sensitive piece because it runs across your browsing, not only on rakuten.com. The useful question is what it does on sites that are not Rakuten stores. The Web Store privacy disclosure and the policy together answer that better than any third-party review can.

Depending on where you live, privacy law may give you the right to request a copy of your data or have it deleted. The privacy policy explains how to make that request. Closing your account is a separate step, so do both if you want to leave cleanly.

Is it safe to link your credit card to Rakuten?

Linking a card for in-store cash back is reasonably safe: card-linked offers are set up to match qualifying purchases at participating merchants, not to let Rakuten charge you. What you give up is privacy, since you are agreeing to have those purchases matched to your account.

• Use a credit card, not debit. Credit cards generally give you stronger fraud protection and keep thieves away from your bank balance.
• Link one card. Every extra card is one more set of transactions tied to your profile.
• Unlink when you stop. If you tried in-store offers once and forgot about them, remove the card from your account settings.
• Keep online and in-store separate in your head. Online cash back never needs your card; only the in-store program does.

Rakuten has also offered a co-branded credit card issued through a partner bank. That is a credit product with its own application, credit check and terms, so treat it as a card decision, not a question about the extension's safety.

What are the downsides of using Rakuten?

The main downsides are slow payouts, cash back that fails to track and the tracking itself. Missing cash back is the most common complaint, and it is usually caused by something in your own browser rather than by Rakuten holding back money.

Purchases sit as pending while the store's return window runs, so a big order can take months to reach your balance. Returns and cancellations reverse the cash back. Accounts showing unusual patterns, such as heavy referral activity, can be reviewed or closed, which is where many of the angrier complaints come from.

If an eligible order still never shows, Rakuten's help center has a missing cash back claim form. Keep the order confirmation email; it is the evidence the claim needs.

Do you really get money back from Rakuten?

Yes. Cash back builds up in your account, moves from pending to confirmed once the store confirms the order, and is paid on a quarterly schedule by PayPal or check. Minimum balances and extra payout options change, so check the help center rather than trusting an old blog post.

The money only reaches you if the payout path stays yours. Someone who takes over your email can reset your Rakuten password and switch the PayPal address before the next payout. So the real security work is on your email and PayPal accounts: unique passwords and two-factor sign-in on both.

Is Rakuten free? Yes, joining costs nothing. Is it worth it? If you already buy from partner stores it is money back for a click. It stops being worth it if chasing cash back pushes you to buy more, or if the tracking bothers you more than the rebate helps.

How do you use Rakuten more safely in Chrome?

The safest setup is limited site access, one savings tool at a time, a unique password and two-factor sign-in on the accounts that receive your money. It keeps the cash back and trims most of the risk.

1. Install Rakuten only from the listing published by Rakuten, or use the website without the extension.
2. In chrome://extensions > Rakuten > Details, set Site access to On click.
3. Generate a unique Rakuten password in a password manager instead of reusing your email password.
4. Turn on two-factor sign-in for your email and PayPal accounts, and on Rakuten too if your account settings offer it.
5. Disable other coupon and cash-back extensions before checkout so they cannot overwrite the referral.
6. Turn off promotional emails in your Rakuten account settings if you do not want them.
7. Review linked cards and payout details every few months.

For more tools reviewed with the same caution, browse our shopping extensions and security and privacy picks, or read how we evaluate extensions before you trust any of them with site access.