Slashdot Mirror
Square Debuts New Email Payment System
cagraham writes "Mobile payment company Square — best known for their smartphone credit-card swipers — has launched a new payment service called Square Cash. The service doesn't require users to sign up or make an account. Instead, they just email the person they'd like to transfer money to (with the amount as the subject), and CC 'cash@square.com.' Square asks the sender for their debit card info, and then sends a link to the recipient, who can transfer the money into any account they want within 1-2 business days."
This has got to be the most insecure payment system ever.
Account details over email and 1-2 business days?
Why not just put cash in an envelope and send USPS? At least that way you can't lost more than the cash you send.
Isn't this exactly the same thing as an Interac e-Transfer?
I've been sending money via email for many years this way.
MABASPLOOM!
Obviously this is a front for the NSA so they can get rid of the traditional means of tracking bank transactions and just lump it all into the haystacks of email data the already collect! Government efficiency at it's finest! Brilliant!!
So the From:, Subject, To:, and Cc: headers are what makes this work?
Not a bad idea, really, except that it can all be trivially spoofed, and the resulting set up/confirmation emails can be trivially intercepted and abused at will. Plus, of course, no easy drop-in encryption, and in the end it piggybacks on existing systems, so all the risks associated with them (like credit cards) will be neatly folded into the deal too.
I still prefer the Bitcoin schemes. Now, if I only had some bitcoin to toss around :(
Time Bomber the Book coming soon.
If they charge you by debit, the assumption is that you need a bank account somewhere. Most bank accounts already allow one to send an "Interac E-Transfer" to any email address for a relatively low fee. I've done it multiple times. Maybe it's just a Canadian thing.
Why would I want to introduce a third party into this, when I can already do it through my existing bank?
What's stopping Eve from sending herself an email from a novice computer user and having said user give out their card info? Since anyone can send an email using any email address, this feels problematic.
So all I need to do is email some anonymous database my credit card information? What could go wrong?
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
And why on Earth would I trust Square?
See, banks have mechanisms in place to do this. And banks are regulated.
Square wants to become a middle-man for these transactions, but they aren't a bank and aren't regulated like one.
Which means when (not if) Square fucks up, you'll be dealing with a company in terms of their EULA which says "we're not a bank, and not actually responsible for anything". With a bank you have some recourse.
Given how video game companies have been faring with security and protecting of this kind of information, my first thought is "how long before they have a security breach, and what recourse will you have".
Sorry, but I'll stick with using banks to transfer money.
Lost at C:>. Found at C.
It's not secure banking information over email. The email contains a link that takes you to a redemption site. No sensitive information is in the email. Everything is contained on secure servers - just like your bank account.
Why does the US have such an antiquated banking system? Hell, a lot of places still need checks because they won't take plastic!
I've had bank accounts in the UK, Australia, Germany, Canada and the US.
Canada is basically the US in this context..banks are no better. They do have email money transfers though.
Which is something every other damn country has. A way to transfer money between bank accounts of individuals securely and free. The only option in the US has been paypal or chase quickpay.
Not to mention the reliance on checks (ridiculous!) and the problems with ACH fraud. Again, in no other country has my account number been secret information which I have to protect. The worst thing people could do is put money into my account.
So many issues....
If you ignore ACs because they are anonymous - you're an idiot.
No banking information is sent over email with Interac E-Transfer. That would be dumb. The recipient only gets a link and a user-chosen hint for a one-time password. In most cases, one can simply enter a bogus hint and tell the recipient the password over a more secure channel, like face-to-face.
Drug Deal!
Except Drug Dealers don't keep Bank Accounts. Its a cash and you are carrying business.
This requires you to give Square Your debit card info, and makes your recipient give you THEIR bank details.
Seriously, the NSA couldn't have dreamed up a move invasive scheme. What could possibly go wrong with that?
Left unsaid in the linked article, (and also the Square website) is how square is going to monetize this, other than by
*cough* losing one out of a hundred payments. They claim the service is free. FAQ Here to both parties. So, how do they finance that, other than getting a piece of the debit card fee? (Senders have to use a Debit card).
One wonders just how much the debit card fee is jacked up to allow Square to assume the risk for this type of service, and handle the deluge of complaints and lost payments claims. And how many will be suckered into handing over their bank info to a 419 email purportedly from Square.
World Plus Dog is rushing to mobile payments, but I'm not so sure this is well thought out.
Sig Battery depleted. Reverting to safe mode.
I know a lot of people who have the bad habit of sending everything to everybody in their contact list. Wouldn't it be funny if they sent money to dozens of their friends by mistake, and then those friends cc (they never use bcc) to everybody in their contact list and so on?
Interesting idea that Square have come up with.
This will only be their first step. The next goal will be to have all transactions take place using their own currency denomination, Gil (G). From there, they can bypass the online gambling ban and provide real-time Chocobo Racing streamed into the home.
How many times must people be hit in the head with a clue bat before they understand that this is a Bad Idea[tm]
Time flies when you don't know what you're doing
telnet random.openmailrelay.com 25 HELO victim.domain.com MAIL FROM: victim.email@victim.domain.com RCPT TO: dummy.prepaid.card.email@badguy.com DATA CC: cash@square.com SUBJECT: $1,000,000 Here is the payment I promised. . QUIT Profit!
Simply click this link and input your debit card details! I promise nothing bad will happen.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Square requires your debit card info and SQUARE gets the recipients bank account details not the guy paying.
Yes, good catch, that't what I meant to type, but my fingers occasionally get ahead of me.
Still, Square ends up knowing a whole hell of a lot about people who may use the service exactly once.
We can only hope they have good security, because a break-in of their site could cause wide spread
financial chaos.
They have to keep lots of backup, simply to protect themselves and research transactions. Presumably all of their data is heavily encrypted, and they have off-site backups other than the NSA.
Sig Battery depleted. Reverting to safe mode.
"Square
AKA: Final Fantasy I thru X
"The service doesn't require users to sign up or make an account."
Yep, but they make you grind harder than ever for credits...
in the mid 2000's use to do that with Beam Cash although you needed an account http://www.hyperwallet.com/consumer/help/beam-cash-email-money-transfers.html
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
I tried a 1$ transfer using a virtual payment card (I can obtain a one time card number on my bank site limited to a specific amount, this is usefull for online purchases). I could not link this card: "Card not supported".
Too bad, i really wanted to test their service with a spoofed mail after doing first transaction normally.
There is no way I'll be providing them my real card number.
Hint: they do not brag about being PCI DSS certified (not even compliant) that certainly means they are not.
They only say: "You’re safe with us. The privacy and security of your financial information is our top priority." which is not very reassuring to say the least.
It works. You have to give them credit - the process is extremely simple. I could see it taking off. From a security perspective, it's not great. But it's also not as bad as some people here are making out. You don't send any information over email other than the email addresses of the sender and receiver, and sender's intent to send $x to seller. Phishers are likely to pattern "you've got money" emails off of these Square emails to people. But these are just another variation on "give me info/money, so I can send you money" scams. Same common sense defenses apply--If you aren't expecting money from somebody, don't give out personal info. And then there are more sophisticated man-in-the-middle attacks combined with spoofing the "you've got money" email or replacing content in it. Those are the ones I'd worry about, but they are also much harder to set up. When you go to your online banking website, do you worry about someone spoofing the whole site (or at least the login) and making the DNS point towards the spoofed site? I do, but not enough to stop using it.
I sent my girlfriend $5 to try it out. It went down like this.
Send an email to her composed as such:
To: girlfriend@gfmail.com
Cc: cash@square.com
Subject: $5
Body: Ladida whatever
She received the email, and immediately afterwards we both received an email stating I was sending her funds.
My Email: http://imgur.com/f264wIG
Her Email: http://imgur.com/F8GhpJ9
When I hit the link card button, it brought me to a secure site and asked for my debit card #, expiration date and zip code. No name or anything else.
Once I filled in the info and hit confirm we both received another round of emails.
Mine: http://imgur.com/vDFnETA
Hers: http://imgur.com/nEaJdd5
She clicked on the link to deposit cash and was given the same screen asking for a debit card number, exp. date and zip code. Nothing else.
After she confirmed, another round of emails went out.
Mine: http://imgur.com/4shFvyz
Hers: http://imgur.com/88Xprw4
The charges appeared instantly on our two accounts as follows.
Mine: http://imgur.com/bNHDB5u
Hers: http://imgur.com/Pz6V7On
I sent another $5 to her account to catch screens from the website. Turns out when you're already linked an account to your email, you just get an email asking to confirm instead of having to relink your bank account. Once you hit the confirm button, money is sent.
My confirm email: http://imgur.com/vxoiS7t
She received an email waiting for me to confirm and an email saying that funds were deposited with the same text as before. She didn't have to do anything for the second payment and it was deposited into her account once i confirmed.
There were no charges or fees at all.