[cornholio]

How about we leave access to Contacts only to apps that, you know, allow you to contact other people and legitimately need either the email or number? Make it a global XOR: you can ask for Contacts OR credit card/financial data, but not both.

In any case, there is never a legitimate need to know the entire address book to "send money to your contacts": mobile OSes could just offer an interface to manually pick a single contact and return it to the app, which could then validate it as a financial partner