Slashdot Mirror
Square Debuts New Email Payment System
cagraham writes "Mobile payment company Square — best known for their smartphone credit-card swipers — has launched a new payment service called Square Cash. The service doesn't require users to sign up or make an account. Instead, they just email the person they'd like to transfer money to (with the amount as the subject), and CC 'cash@square.com.' Square asks the sender for their debit card info, and then sends a link to the recipient, who can transfer the money into any account they want within 1-2 business days."
Sounds too complicated. Sorry, but think of the average moron.
This has got to be the most insecure payment system ever.
I thought all the kids these days were shunning email.
Account details over email and 1-2 business days?
Why not just put cash in an envelope and send USPS? At least that way you can't lost more than the cash you send.
Isn't this exactly the same thing as an Interac e-Transfer?
I've been sending money via email for many years this way.
MABASPLOOM!
Obviously this is a front for the NSA so they can get rid of the traditional means of tracking bank transactions and just lump it all into the haystacks of email data the already collect! Government efficiency at it's finest! Brilliant!!
So the From:, Subject, To:, and Cc: headers are what makes this work?
Not a bad idea, really, except that it can all be trivially spoofed, and the resulting set up/confirmation emails can be trivially intercepted and abused at will. Plus, of course, no easy drop-in encryption, and in the end it piggybacks on existing systems, so all the risks associated with them (like credit cards) will be neatly folded into the deal too.
Request for debit card information over e-mail. What could possibly go wrong?
We've been able to do this in Canada for quite a while now using Interac e-Transfer. http://www.interac.ca/en/interac-etransfer/etransfer-detail
It's incredibly convenient, and only takes a few hours to transfer funds.
I think they have underestimated the desire for instant gratification.
unless of course they can make the recipients phone immediately make some noise designed to invoke an involuntary Pavlovian response
I still prefer the Bitcoin schemes. Now, if I only had some bitcoin to toss around :(
Time Bomber the Book coming soon.
If they charge you by debit, the assumption is that you need a bank account somewhere. Most bank accounts already allow one to send an "Interac E-Transfer" to any email address for a relatively low fee. I've done it multiple times. Maybe it's just a Canadian thing.
Why would I want to introduce a third party into this, when I can already do it through my existing bank?
What's stopping Eve from sending herself an email from a novice computer user and having said user give out their card info? Since anyone can send an email using any email address, this feels problematic.
So all I need to do is email some anonymous database my credit card information? What could go wrong?
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
And why on Earth would I trust Square?
See, banks have mechanisms in place to do this. And banks are regulated.
Square wants to become a middle-man for these transactions, but they aren't a bank and aren't regulated like one.
Which means when (not if) Square fucks up, you'll be dealing with a company in terms of their EULA which says "we're not a bank, and not actually responsible for anything". With a bank you have some recourse.
Given how video game companies have been faring with security and protecting of this kind of information, my first thought is "how long before they have a security breach, and what recourse will you have".
Sorry, but I'll stick with using banks to transfer money.
Lost at C:>. Found at C.
Why does the US have such an antiquated banking system? Hell, a lot of places still need checks because they won't take plastic!
I've had bank accounts in the UK, Australia, Germany, Canada and the US.
Canada is basically the US in this context..banks are no better. They do have email money transfers though.
Which is something every other damn country has. A way to transfer money between bank accounts of individuals securely and free. The only option in the US has been paypal or chase quickpay.
Not to mention the reliance on checks (ridiculous!) and the problems with ACH fraud. Again, in no other country has my account number been secret information which I have to protect. The worst thing people could do is put money into my account.
So many issues....
If you ignore ACs because they are anonymous - you're an idiot.
Thanks for all the money, folks!
Chase has QuickPay. Venmo exists.
What's the big deal.
Drug Deal!
Except Drug Dealers don't keep Bank Accounts. Its a cash and you are carrying business.
This requires you to give Square Your debit card info, and makes your recipient give you THEIR bank details.
Seriously, the NSA couldn't have dreamed up a move invasive scheme. What could possibly go wrong with that?
Left unsaid in the linked article, (and also the Square website) is how square is going to monetize this, other than by
*cough* losing one out of a hundred payments. They claim the service is free. FAQ Here to both parties. So, how do they finance that, other than getting a piece of the debit card fee? (Senders have to use a Debit card).
One wonders just how much the debit card fee is jacked up to allow Square to assume the risk for this type of service, and handle the deluge of complaints and lost payments claims. And how many will be suckered into handing over their bank info to a 419 email purportedly from Square.
World Plus Dog is rushing to mobile payments, but I'm not so sure this is well thought out.
Sig Battery depleted. Reverting to safe mode.
Interesting idea that Square have come up with.
This will only be their first step. The next goal will be to have all transactions take place using their own currency denomination, Gil (G). From there, they can bypass the online gambling ban and provide real-time Chocobo Racing streamed into the home.
How many times must people be hit in the head with a clue bat before they understand that this is a Bad Idea[tm]
Time flies when you don't know what you're doing
telnet random.openmailrelay.com 25 HELO victim.domain.com MAIL FROM: victim.email@victim.domain.com RCPT TO: dummy.prepaid.card.email@badguy.com DATA CC: cash@square.com SUBJECT: $1,000,000 Here is the payment I promised. . QUIT Profit!
To use this system, I get an email, purportedly from Square, asking me for my debit card information. What could possibly go wrong?
And could someone please tell me why we can't just do bank-to-bank transfers like they do in Europe? We're getting closer now. Through B of A, I can send money to a phone # or email address (is this just PopMoney?), but I've never tested the UX on that to see if it's a pain in the ass for the recipient.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
They claim the service is free. FAQ Here [squareup.com] to both parties. So, how do they finance that, other than getting a piece of the debit card fee? (Senders have to use a Debit card).
The get the 1-2 days of float on the translation. That may be enough to enable them to make a little profit.
I don't have a debit card - and never will. They're evil, and unnecessary/stupid for people that have a CC and pay it off every month...
It must have been something you assimilated. . . .
Simply click this link and input your debit card details! I promise nothing bad will happen.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Thankfully...I don't have/use a Debit Card. I ask my bank for a plain, simple non-debit ATM card.
I use that when I need cash to carry around for the week...and I'm good to go.
I still prefer the anonymity of cash, and since it doesn't abstract the spending of your money (much like chips in a casino)...I have a better feel where my money is going every week for living expenses (groceries, etc).
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Probably because someone doesn't think BTC is going to go up enough to offset the cost of wire transfers in and out of the USD-BTC exchanges.
Square requires your debit card info and SQUARE gets the recipients bank account details not the guy paying.
Starting this past May or so, many Gmail users received a new "Attach Money" option that lets them send money through a Gmail email. It's integrated with their Google Wallet, which stores credit card info and uses that for payment. You can see more details at: https://support.google.com/mail/answer/3141103?hl=en I saw the "attach money" option appear just last month for me, while composing a new email. It seems a lot more convenient than registering for a new Square account and using their strange "subject and cc" method. I'd expect the Gmail version to be much more likely to catch on than this Square one.
Given how video game companies have been faring
From what I understand Square is a credit card processing service
I think it might have been a pun on Square Enix, the company behind Rad Racer and Chocobo Racing.
Square requires your debit card info and SQUARE gets the recipients bank account details not the guy paying.
Yes, good catch, that't what I meant to type, but my fingers occasionally get ahead of me.
Still, Square ends up knowing a whole hell of a lot about people who may use the service exactly once.
We can only hope they have good security, because a break-in of their site could cause wide spread
financial chaos.
They have to keep lots of backup, simply to protect themselves and research transactions. Presumably all of their data is heavily encrypted, and they have off-site backups other than the NSA.
Sig Battery depleted. Reverting to safe mode.
I don't know about having a better feel where your money is going. I can get an exact list of everything I purchased in an easily accessible online format. It is hard to have a better idea where my money is going than that. Granted, I use credit cards only as the consumer protection laws are far better for credit cards than debit. Someone makes off with your debit card, you are screwed, someone makes off with your credit card, as long as you report it reasonably quickly, you owe nothing for charges that aren't you.
That said, you have to have the personal responsibility to not spend more than you have, but if you can do that, you get great credit from great companies with great perks. I save 1% on everything I purchase and 5% on all my gas purchases, and when I go to buy a house, my credit is so good it will save me serious money on interest rates. It also got me a 1.99% interest rate on my car purchase, which is cheap enough to mean that I'm better off investing money rather than paying off my car early.
AJ Henderson
If you like the cash lifestyle, it's a lot easier to get a few thousand out of the bank at a time.
It's not really anything more than you provide with any credit card processor. You give Paypal as much or more.
Just how stupid are you? They gave you exactly the same card with exactly the same functionality as everyone else. Then they told you your card is special, and you bought it?
The only thing special is you... In a short bus kind of way.
If I were God, wouldn't I protect my churches from acts of me?
Except Drug Dealers don't keep Bank Accounts. Its a cash and you are carrying business.
Funny, you clearly have no idea what you're talking about. The majority of "deals" are made between friends. Yes, Street corner guys can't use this, but if you're been buying from "John" for the past 15 years, you're not going to really worry about a paper trail. The quicker people realize that this isn't some secret underworld invisible to normal people, and that its really just all of US going about our daily lives, the better off we all will be. It's a lot like the common notion in the 50s that women didn't have children outside of wedlock. It's laughable now.
A web based catheter system, where is it?
"If any question why we died, Tell them because our fathers lied."
What prevents someone from spoofing an e-mail from you to send themself money?
Let's say you meet up with some guy in a parking lot to conduct some sort of craigslist transaction. You agree to pay him using Square and you e-mail him the cash. At this point he knows you have a debit card linked to your Square account, so what prevents him from forging an e-mail from the e-mail address you used to send him cash, to him, CC'ing cash@square.com and putting 5000 in the subject line? Will Square then deduct the $5k from your bank account and send it to him?
Sure you can argue that SPF and such exist to prevent e-mail spoofing, but in reality a lot of e-mail domains don't implement SPF and even if they do a lot of recipients don't check it. E-mail seems like a horrible mechanism to control financial transactions because it is inherently insecure.
Except I can receive money in my paypal account as long as they have my tax id for tax purposes, and I can spend that money directly out of that account at a large number of merchants without giving access to my bank account.
Sig Battery depleted. Reverting to safe mode.
The majority of "deals" are made between friends.
Maybe in your little upper middle class world scoring you pot for the weekend.
In the real world Street Corner Guy does most of the business.
And neither John nor Street guy puts any of that money in the bank.
Sig Battery depleted. Reverting to safe mode.
Do you have a bank loan at 1.99% for your car, and pay the dealership in cash, or did you get the 1.99% through the dealership. In many cases, the "low" interest rates you get from the dealership are only offered because the price of the car is high to compensate. Tell the dealership you'll pay cash, and the price of the car will drop significantly.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
"Square
AKA: Final Fantasy I thru X
"The service doesn't require users to sign up or make an account."
Yep, but they make you grind harder than ever for credits...
Do you have a bank loan at 1.99% for your car, and pay the dealership in cash, or did you get the 1.99% through the dealership. In many cases, the "low" interest rates you get from the dealership are only offered because the price of the car is high to compensate. Tell the dealership you'll pay cash, and the price of the car will drop significantly.
This is really only true when you're talking about manufacturer subsidized loans ("0% financing through GMAC with approved credit!"), which usually are not available in conjunction with manufacturer rebates--which almost EVERY car on the market has (even Toyota these days). In some cases, the rebates are absurdly large (pickup trucks) so you can see massive swings in the price of the car if you forego the manufacturer financing. Overall, dealerships typically MAKE money on finance deals (kickbacks from the banks/credit unions for writing the loans).
That said, walking into the dealership with a cashier's check DOES tend to short circuit the negotiating process... not because the dealership is somehow losing money on a loan, but rather because the finance manager is no more immune to having cash waved under his nose than anyone else is.
What part of "shall not be infringed" is so hard to understand?
in the mid 2000's use to do that with Beam Cash although you needed an account http://www.hyperwallet.com/consumer/help/beam-cash-email-money-transfers.html
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Just how stupid are you? They gave you exactly the same card with exactly the same functionality as everyone else. Then they told you your card is special, and you bought it?
The only thing special is you... In a short bus kind of way.
Some (though not all) banks (for example, Bank of America) still offer cards that only work with a PIN in the ATM, and do NOT work as debit or credit cards. Your abusive post above merely proves that you're not only an asshole, you're also an ignorant one.
What part of "shall not be infringed" is so hard to understand?
Parent's claim meets most peoples common sense. Do you have any evidence otherwise?
Google lets me send money to other people. How is this different? I may have missed an important detail.
So you believe that a software flag that says your card wort work at the ATM somehow makes your card different?
I stand behind my assessment of your stupidity.
If I were God, wouldn't I protect my churches from acts of me?
I think you will find that common sense isn't all that common.
John, usually works for Street Corner Guy anyway.
Sig Battery depleted. Reverting to safe mode.
I believe this is distinctly more common with credit unions. Credit unions are covered under a different federal organization, but for most purposes are interchangeable with banks in the US. They also didn't bother to deregulate credit unions when they were deregulating banks, so most credit unions weathered the recent economic times far better than banks.
I tried a 1$ transfer using a virtual payment card (I can obtain a one time card number on my bank site limited to a specific amount, this is usefull for online purchases). I could not link this card: "Card not supported".
Too bad, i really wanted to test their service with a spoofed mail after doing first transaction normally.
There is no way I'll be providing them my real card number.
Hint: they do not brag about being PCI DSS certified (not even compliant) that certainly means they are not.
They only say: "You’re safe with us. The privacy and security of your financial information is our top priority." which is not very reassuring to say the least.
ATM cards that don't offer POS payment capabilities do exist. Why do you think otherwise?
So, no evidence?
This is what happens when 20-something year olds get funding for their great idea without understanding how stuff works first.
You're right, the cards are all the same. They're just a piece of plastic with a magnetic strip that has a bunch of software flags. Considering that the software is the entire way any of this works, yes, changing some flags makes it different.
Mostly because he's retarded...
You can certainly get a non-debit bank card.
Wells Fargo's look like this:
http://www.adamhunter.net/wallet2010/walletpics/8-atm.jpg
I do not think this phrase "any account" means what you think it means. I suspect I can not transfer money into or out of my Japanese accounts. Something I would love to be able to do.
Maybe in your little upper middle class world scoring you pot for the weekend.
In the real world Street Corner Guy does most of the business.
And neither John nor Street guy puts any of that money in the bank.
I will fully admit I and my friends fall in the "little middle class world" category, but there is no "scoring" pot for the weekend here. You base your purchase times and amounts around the harvest cycle. One to two weeks of open house, then nothing for four months. Best plan ahead.
All the "John's" accept cash, credit, paypal, even bitcoin has been mentioned on occasion.
Remember back when paypal let you select "Other" for the payment reason? It was always a blast to fill in "sexual favors" in that spot, before they started taking that seriously and locking accounts :/
If you want to argue none of us live in the "real world", then more power to you I guess...
But that Street Corner Guy is dangerous as fuck, and best to not involve yourself with if at all possible.
Of course it isn't always possible, and for anyone in that situation - I'm sorry
But Street Corner Guy, bank account or no, could be a fed, and decidedly does not procure product out of his asshole (at least one hopes) - He gets it from a grower - An upper middle class dude with a bank account and a house suitable to contain such an operation.
Poor dude having to stand on the corner is desperately trying to make a few tiny bucks while not getting arrested or robbed... That is not where its at, and real world or no, no one that can avoid it wants anything to do with that.
So your own homework son.
Sig Battery depleted. Reverting to safe mode.
Left unsaid in the linked article, (and also the Square website) is how square is going to monetize this, other than by *cough* losing one out of a hundred payments.
No need to get paranoid there. Many online services are introduced for free and fees are added on later. Unless I'm horribly mistaken, PayPal started out that way, too.
Assorted stuff I do sometimes: Lemuria.org
At work we developed something better. Text the amount and phone number to a short code and we'll debit that from your account and credit it to the recipient.
But alas, Europe only because the US has an archaic banking system.
What the hell fun would it be not getting paranoid on Slash dot?
Sig Battery depleted. Reverting to safe mode.
Nope, no drug dealer in the world (illegal anyway) will sell drugs for a credit card* or a check and they wouldn't use this. They want cold hard cash.
* they do take LINK
Free Martian Whores!
It works. You have to give them credit - the process is extremely simple. I could see it taking off. From a security perspective, it's not great. But it's also not as bad as some people here are making out. You don't send any information over email other than the email addresses of the sender and receiver, and sender's intent to send $x to seller. Phishers are likely to pattern "you've got money" emails off of these Square emails to people. But these are just another variation on "give me info/money, so I can send you money" scams. Same common sense defenses apply--If you aren't expecting money from somebody, don't give out personal info. And then there are more sophisticated man-in-the-middle attacks combined with spoofing the "you've got money" email or replacing content in it. Those are the ones I'd worry about, but they are also much harder to set up. When you go to your online banking website, do you worry about someone spoofing the whole site (or at least the login) and making the DNS point towards the spoofed site? I do, but not enough to stop using it.
Eh, I will stick with my preconceptions.
so if your bank lets paypal deduct money for free (mine does) then this should be free too.
If your bank is charging for electronic transactions like this, find a better bank.
it's called Interac e-Transfer
It's not free, though.
1) Rewards. Yes, this currently means that everyone is subsidizing the guys using high-rewards credit cards, because the merchants pass on the fees to everyone.
2) Extended warranty. (I've gotten hundreds of dollars of value from this alone.)
3) Price protection.
4) Some places really prefer credit cards (car rental companies, for example, or gas stations that want to pre-charge you for a fill so you can't run off without paying).
5) Ease of contesting charges. The credit card company will refund your money and go after the vendor to sort things out.
As for fees, there are many credit cards with no fees to the end-user.
Since they make money on the financing deals, they're actually happier if you finance the car than if you buy it outright.
I sent my girlfriend $5 to try it out. It went down like this.
Send an email to her composed as such:
To: girlfriend@gfmail.com
Cc: cash@square.com
Subject: $5
Body: Ladida whatever
She received the email, and immediately afterwards we both received an email stating I was sending her funds.
My Email: http://imgur.com/f264wIG
Her Email: http://imgur.com/F8GhpJ9
When I hit the link card button, it brought me to a secure site and asked for my debit card #, expiration date and zip code. No name or anything else.
Once I filled in the info and hit confirm we both received another round of emails.
Mine: http://imgur.com/vDFnETA
Hers: http://imgur.com/nEaJdd5
She clicked on the link to deposit cash and was given the same screen asking for a debit card number, exp. date and zip code. Nothing else.
After she confirmed, another round of emails went out.
Mine: http://imgur.com/4shFvyz
Hers: http://imgur.com/88Xprw4
The charges appeared instantly on our two accounts as follows.
Mine: http://imgur.com/bNHDB5u
Hers: http://imgur.com/Pz6V7On
I sent another $5 to her account to catch screens from the website. Turns out when you're already linked an account to your email, you just get an email asking to confirm instead of having to relink your bank account. Once you hit the confirm button, money is sent.
My confirm email: http://imgur.com/vxoiS7t
She received an email waiting for me to confirm and an email saying that funds were deposited with the same text as before. She didn't have to do anything for the second payment and it was deposited into her account once i confirmed.
There were no charges or fees at all.
We used this. Offered cash, on the spot. Dealer said "sure, but I for the same price you can have 0% for 4 years." They were firm on the price. We took the 0%.
Is it just my observation, or are there way too many stupid people in the world?
Just how stupid are you? They gave you exactly the same card with exactly the same functionality as everyone else. ...
Some (though not all) banks (for example, Bank of America) still offer cards that only work with a PIN in the ATM, and do NOT work as debit or credit cards.
My bank also does this. Had to ask for the ATM only card, but it was available. Card does not have Visa/MC or any network options (Cirrus or Plus).
I got a good discount and rebates. It was manufacturer backed for qualified buyers and was run by a bank loan that the manufacturer kicks towards. Bank likes the low risk investment since the collateral is worth as much as the amount of the loan and I like that I can use higher risk investments since I'm young and don't need stability in my portfolio at the moment.
Not sure what you're smoking today...but yes. The debit card has the visa symbol on it and can be used to buy things.
A regular, plain ATM card does not have the VISA logo, and it can ONLY be used with my PIN code to withdraw cash from the ATM, it cannot be used to make purchases on its own.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
I still prefer the Bitcoin schemes.
Why, aside from the fact that all the Cool Kids are supposedly Doing It?
It's a royal pain in the ass to participate in the bitcoin system, your transaction history is by definition public, and the value of the bitcoins you send to someone fluctuates like crazy. Anyone who takes bitcoins for compensation is insane.
Please help metamoderate.
Anyone who takes bitcoins for compensation is insane.
Actually, offering payments in other currencies is done because of demand. Fluctuation is something which must be always considered. If a currency has high fluctuations you add a high risk margin on top of your exchange rate to compensate the possible loss because of possible fluctuation. Treasury departments are very aware of this currency trading risks and they can calculate the risk margin very precisely.
tl;dr High fluctuation means higher prices for the customers. Bitcoin as payment currency is not insane at all, if there'll be more demand, everyone will do that.