Square's war against PayPal continues with a new free service that lets you transfer small amounts of money between friends using nothing more than email.
Called Square Cash, the new service is available now to anyone with a U.S. bank account and is dead simple to use. Seriously: It couldn't be easier. Unlike PayPal, Square Cash doesn't require you to sign-up for a Square account first, and all funds are transferred directly between bank accounts with no third-party holding account.
But while the service sounds fantastic, its simplicity also gives us pause. We can't help but think that scammers are rubbing their hands in glee over the possibility of using phony Square Cash emails to steal your identity.
How it works
To send a Square Cash payment you have to follow Square's simple email format. Let's say Brad wanted to send me a $1 payment.
Subject line: $1
Here's that buck I owe you, thanks for buying the sodas after the seminar.
Next, I would receive a nice looking email notifying me that Brad had sent me a $1 payment and that I would receive a link to deposit the payment once Brad had entered his debit card details with Square.
At the same time, Brad receives another nicely designed email that indicates who he wants to send money to and how much he's sending.
Then he clicks on "Link Debit Card," enters his debit card details at square.com and that's it. He'll also receive a confirmation email, but at this point Brad's work is done.
Finally, I receive a similar email prompting me to visit a site to enter my debit card details or link directly to my bank account, and that's it. After a few days the money would be directly deposited in my account. That's it!
Square Cash also offers an Android and iOS app to make it easier to send email payments to friends, though it only supports debit cards at this time and does not work with other forms of plastic payment (such as credit cards).
There doesn't seem to be a significant minimum limit on how much you can send, as we tested the service using a $1 amount and never received any warnings about the amount being too little.
Square Cash does max out at $2,500 and any amount sent over $250 will require identity verification, according to Square's terms and conditions.
While Square certainly seems like a handy way to ship money to people you know, this service also feels like it's just a massive phishing attack waiting to happen. Phishing attacks are when a scammer tries to trick you into revealing personal information, like a debit card number, by setting up a phony Website.
Phishing attacks are why so many security pros advise you to never click on a link in an email asking you to reveal your personal data, which is exactly what Square does.
Here's how a Square Cash phishing attack could conceivably happen: a hacker sends out a phony Square email with the appropriate styling and then sets up his own site to look as close to Square's as possible. Then he just sits back and waits for all those suckers to click on the phony link in the scam email and then enter their debit card information into his phony site.
After all, who wouldn't love receiving some free money in their email inbox? Our savvy hacker could even go one step further by checking out your Facebook friends list and then send you an email claiming to be from them. That would require a little more targeting, but it's not impossible.
We've sent a note to Square and ask them to respond to our concerns about phishing. We'll update this story should the company respond.
Dead simplicity requires serious caution
All that said, Square Cash is dead simple to use and if you need to send money between friends it appears to be far more convenient than using PayPal or other methods such as Chase QuickPay. You'll just need to be careful out there.
Make sure that all emails claiming to send you money are coming from a square.com address. Most importantly, when you click on that link in the email, make sure that it sends you to Square.com and not, for example, something like "square.com.BigScam.net.". And hey: When you receive a supposed Square Cash email from a friend and you're not expecting a payment, there's nothing wrong with calling them to make sure it's legit.