Square Cash: The Simplest Way to Send Money Yet

Now the NSA can access my bank account faster than the IRS.  This is all we need to have happen.  I will not be using this service.

Not to alarm you, but the NSA—and local police, for that matter—can easily get access to your bank records simply by requesting them, no warrant required. IIRC, the standard is just that the request merely needs to be relevant to an investigation.

There’s nothing private about financial transactions. And that’s been the case for quite some time.

Trust me, as long as we’re on the grid, the government can track including our money.

I’m just a wee bit concerned about the possibility of thieves draining our bank accounts via Square Cash. So I raised that issue with them.

First and foremost, if you wish you can detach your debit card/account from your Square Cash email address any time. If you re-input your information into Square Cash for each individual transaction, it makes your use of the system somewhat clunkier—but also obviously safer. Obviously, it’s your call.

(At least right now, you have to manually detach the debit card/account each time. They might in the future enable you to set it up so that the system automatically wipes the information after each transaction, if you so desire.)

Also, they have told me that their system can tell whether or not an email’s From: line has been forged.

Plus, note that transactions are subject to real-time human monitoring. And, if something appears really suspicious they may send you an email to ask you to confirm the transaction.

In addition, you’ll get an email receipt for each transaction—through which you can cancel a transaction if you can both get the receipt and can act before the recipient redeems it. You can also arrange to get a text alert each time.

The sticking point here is our smartphones. We send email from them—and presumably many if not most of those who want to use Square Cash plan to do so from their smartphones for maximum convenience.

Thing is, if someone steals a smartphone (or “borrows” it while the owner isn’t looking) and manages to access its email functions, now s/he can send an email to him/herself with Square Cash. (The thief may know the owner and know s/he uses Square Cash, or may be a stranger who’s heard about Square Cash and figures hey, why not give it a shot.)

Not to mention a smartphone thief/“borrower” may be able to intercept the above-mentioned emails and texts, and confirm transactions if need be (unless the process is stopped in time).

So for heaven’s sake, anyone who uses Square Cash (especially if you actually leave your debit card/account linked) please, please set up a password, pattern, PIN and/or biometrics (eg, face or fingerprint unlock). You might also want to guard your email (and Square Cash!) apps with something like Application Protection—which requires inputting a separate PIN or pattern to access a given app.

Not to mention follow basic precautions like picking a complex and hard-to-guess password, pattern or PIN, changing it occasionally, keeping it to yourself (or at the very least restricting it to a very few people you trust who may need to know it) and minimizing the risk of shoulder surfing.

It also might be worth your while to set up a security app or two. For example, if you’re a Droid user, Android Device Manager can help. Otherwise, I recommend Cerberus, Lookout or TrustGo. These programs can help you recover your phone in case it’s lost or stolen, as well as add a password (or rather, an extra password right?) or even wipe everything from the phone’s memory if need be.

(For that to be a viable backup, it really helps to be able to quickly access an Internet connection right after you know your phone is missing.)

By the way, smartphone or no smartphone you need to practice security hygiene on your email system itself. See above with regard to passwords and shoulder surfing, for example. Also, if you can use two-factor authentication please do!

Also, in case a thief does strike there are some steps you can take. First off, immediately contact Square Cash, which may be able to help.

If worse comes to worst, you can try disputing the transaction with your bank (albeit without the protections of the Fair Credit Billing Act since Square Cash only accepts debit cards) and contacting law enforcement.

These last resorts can work because both individual email messages and email account setups are traceable. Plus, after all this is a money transfer between bank accounts, not Bitcoin or literal cash. Accounts can be traced too.

Last but not least, read Square Cash’s website in detail, especially these information resources, before proceeding.

One other safety feature Square Cash has: A weekly transaction limit of $250. If you need to go over that, you can upgrade to Gold status and authenticate your account, and thus be able to send up to $2,500 per week.

Watch out, though: Gold status is irrevocable. Once you’ve qualified your email address to send $2,500 per week, you can never revert to the lower limit.

So if you do this, be extra careful. As in, I would only do this with an email address whose system enabled two-factor authentication.

And I would consider setting up and using that two-factor authentication, password protection for my smartphone (if I have one and can access that email account through it) and unlinking the debit card/account after each transaction (and thus relinking it anew for the next one*) to be absolute minimum precautions.

[*] Oh yes, and going home or back to (a private space in) the office to do the transaction. Yes, it looks chic to just whip out your smartphone, take ten seconds to send an email and say “That’s for the ticket!” But if you have to also whip out your debit card it looks clunky anyway—not to mention unsafe.

I think of these measures as the financial equivalent of condoms…they take a few extra steps and may not look so smooth, but the peace of mind is more than worth the trouble. What do you think?