Online fraud is on the rise: Ask us anything about keeping your account safe! 🔒

[Tom]

It's that time of year again … time to gather, spread joy with decorations, give gifts, and — if you're like me — that includes a lot of online orders. With all of the coming and going, it's also a time for fraudsters to make their own moves: This can look like a bogus online order form, fake charity account, or a phishing scam.

But what else should we keep in mind this year? Account takeover fraud has increased 133% in 2022. In the United States alone, individuals who have experienced an account takeover have lost an average of $12,000 USD. For more information on how online fraud impacts countries across the globe, have a look at this article: Global Statistics in Account Takeover Fraud for 2023.

Rest assured that we've got your back! Square has rolled out a bunch of new security features and we were glad to have @MimiW on the Square Account Security team host a Q&A on Wednesday, November 30th. Read on below for a summary of topics that came up.

Here are some example questions: 

• As a buyer and a seller, what is the best way to keep my information secure online?
• Is two-step verification worth the hassle?
• I was directed to a different website to complete a gift purchase. How do I know that it's safe to enter my credit card information?
  
  

[MimiW]

Hello @CleaArthur,

That is indeed a frustrating experience. You can add an Authentication app such as Authy, Google Authenticator or Microsoft Authenticator as a backup 2FA method when you have issues with receiving SMS or other issues with using your cell phone.

In your particular case where you don’t want to depend solely on your cell phone, I would recommend downloading the Authy Desktop app for Mac or PC. The initial setup for the Authy app on your computer will involve a phone number (cell phone or landline) but using it to generate 2FA codes will not require phone access. Follow these steps to Enable an Authentication app as your Square account’s 2FA method.

Although not available yet, we are working on 2-step verification delivered via an automated voice call. Look out for product updates as we can then deliver these codes to your business’s landline phone number.

[Harlequins]

Would appreciate if Square can come up with another way other than text message for two-step verification. My small company does not have a company cell phone and the Square App continuously asks for a cell number for the added verification process.

[MimiW]

Hello @Harlequins,

As an alternative to 2-step verification to a cell phone, you can add an Authentication app such as Authy, Google Authenticator or Microsoft Authenticator. In your particular case where you don’t want your staff using their cell phones, I would recommend downloading the Authy app for Mac / PC or iPad. The initial setup for the Authy app on a computer or tablet will involve a phone number (cell phone or landline) but using it to generate 2FA codes for logging in will not require phone access.

Follow these steps to Enable an Authentication app as your Square account’s 2FA method. Once you do, you will no longer be prompted to add your phone number as a 2FA method.

Although not available yet, we are working on 2-step verification delivered via an automated voice call. Look out for product updates as we can then deliver these codes to your business’s landline phone number.

[Giblet37]

For real 2FA (SMS is not secure), can Square use an actual (or virtual) hardware key or dongle with FIDO2 or challenge+response OTP, such as an RSA-ID or Yubikey...

[Ellen70]

Hello. I noticed today a purchase made in another city on a card I no longer have with an address that is 10 years old where I no longer reside. How do I proceed with this?

[MimiW]

Hi @Ellen70,

Is this related to a Square Card? If so, please send me a private message.

If it’s related to a different card, I would recommend contacting the card issuer directly (usually a bank or AmEx, for example). Since you don’t have the card anymore, you can try the issuer’s official website and look for their support center phone number.

[Brad9]

Do banks have trouble recognizing square websites as fraud?

Some of my customers get their order automatically cancelled right after placing it.  I see that there's been around 1000 cancelled orders, this past year, that I didn't even know about. Go to Risk Manager > Blocked payments.  

If you use the filter then you can see that the Banks are the ones canceling the order because they don't like something from my square website. I'm not the only square user that has this. I've lost potential tens of thousands of dollars and no one from Square support has gotten back to me.

[MimiW]

Hi @Brad9, we took a look at your payment declines YTD and almost 80% of them were due to either human error (buyer put in the wrong card info and bank declined it) or manually voided. Do you have any set up on your end that voids payments? You can respond to me by private message if you want to take the conversation off of this public forum.

[brown17]

Hello.  First and foremost thank you for keeping up on fraudulent activity.   I get several emails a day  from scammers posing as square.   That being said my account apparently had suspicious activity on now under review all happening on a weekend.   Would be nice if there was someone to take care of these things rather than waiting the weekend.   This is a holiday weekend and we rolled out a black Friday sale that we are now missing out on cause none of our services are working, not to mention our card is locked.   

[Thebarndoor]

Same thing is happening to me. I’m hoping it resolves and my funds become available again before the first of the month so I can pay my rent! 

[MimiW]

Hi @brown17, thanks for bringing this to our attention.

You can forward these spoof emails to spoof@squareup.com to report the incident. Do not include any other information in the email you forward. The appropriate team will investigate and take action if needed.

Sorry to hear that due to the suspicious activity review, you were unable to use your card over the holiday weekend. We are continuously making improvements to the way we block fraudulent login attempts, detect account takeover fraud and lock the bad actors out of our sellers’ accounts. We are also investing in an enhanced self-service recovery experience so that sellers can unlock their own accounts on their own time, without having to call Square support.

[alesya]

My card being charged from different stores with different amounts and it was declined due to lacking funds. We don't keep much on card for safety reasons. Well how can I mark that some transactions are not mine... Like I never got those Taco from TacoBell yesterday but someone did on my card.. I don't want cancel card that's the problem 

[MimiW]

Hi @alesya and @Thebarndoor (who had a similar question), if you suspect that your card was used by somebody else, please contact us via phone at your earliest convenience to proceed with the account review.

We will work with you to do what it takes to keep your account and funds safe and issue a new card quickly. We are also working on an enhanced self-service recovery experience so that sellers can unlock their own accounts on their own time, without having to call Square support.

[Marjirawson]

I had 2 part verification (my cell number ) in place when I had an account takeover. The thief changed the phone number to their phone number so when i tried frantically to login, the code went to the thief. The thief also did this over the weekend so it was even HARDER to get ahold of a person at Square. PLEASE make it easy for us to speak with a PERSON. We are in full blown panic when someone is trying to steal our money .It took my hours and hours (using a friends account ) to get to a person at Square.  Make it difficult or something to change email and/ or phone number. . This person tried to open up a Square credit card which would have allowed them to steal every penny from me. Thankfully, Square caught it and closed it down. This has not helped me have confidence that Square can and will keep my money secure. BTW, you had the thief's phone number! Why didn't you prosecute ?

[MimiW]

Hi @Marjirawson,

We’re sorry to hear that you had this negative experience. Now we can’t go into specifics about your case on this public forum, but feel free to send me a private message and we can schedule time for a call.

As you mentioned, 2-step verification is a highly recommended defense against account takeover fraud. While 2-step verification to a mobile phone number is the easiest method, we recommend downloading and using an Authentication app as the stronger method.

We also recommend setting a long, unique password for Square (and all your online accounts). This way, if another website has a data breach and your email address and password are leaked, the bad actors would not be able to use that password to get into your Square account. Password managers make it easy to generate long, unique passwords for all of your online accounts and store them for easy retrieval later. Learn more about password best practices here.

We are continuously making improvements to the way we block fraudulent login attempts, detect account takeover fraud and lock the bad actors out of our sellers’ accounts. We are also investing in an enhanced self-service recovery experience so that sellers can unlock their own accounts on their own time, without having to call Square support.

[Marjirawson]

i would like to talk to you about these options to better secure my account. I am not the most technically savvy person, so i would be really grateful if we could discuss and implement over the phone. How can this be accomplished ?

Thank you! 

Marji Rawson 

[Headphonz]

Google has my weebly site blocked as a Phishing scam. I haven't touched it in months! I've never had this happen before Square bought them! How can I fix this?? It doesn't seem to have affected anything else and nothing has changed on the site as far as I can tell.

[MimiW]

Hi @Headphonz, I was able to find your Weebly site on Google and access it today. Were you able to resolve the problem since then?

[ajeyakum]

I was hoping to hear from someone about how square protects merchants from carding attacks and bin attacks.

[MimiW]

Hi @ajeyakum, great question!

Square is dedicated to working with sellers to ensure that your ecommerce sales are protected from buyer fraud. There are three forms of protection available for Square sellers:

1. Our Account Services Team: We want to prevent you from dealing with a payment dispute, so we periodically review your transactions to help protect you from fraud. If we determine a transaction(s) on your account is likely to be the work of scammers, we’ll alert you via email. Once you receive an alert via email, we ask that you refund/not process the order(s) being investigated and decline further payments from the customer in question until you hear back from us. In the meantime, we’ll look into the details of your transaction(s) and compare them with other known fraud patterns we’ve identified.This review process is typically completed within 1 business day. We’ll send a second email to let you know the outcome of the review, or if we need any additional information from you.
   
   
2. Machine Learning Systems: To keep your account safe, Square uses machine learning to look at payments from across our ecosystem and adjust our algorithms to account for new trends in fraud. Live transaction monitoring and human expertise work hand-in-hand to adapt our technology to the shifting fraud landscape every day. Our team of fraud experts contact you if we notice anything unusual.
   
   
3. Risk Manager: Square understands ecommerce sellers want other ways to manage their risk profile. Square’s Risk Manager feature is a tool that helps you spot and manage potential fraud from online payments processed with Square. You can create rules in Square Dashboard to trigger your own fraud alerts or to automatically decline suspicious payments. When you set up risk alerts, you can view additional details about suspicious payments, as well as options to issue a refund, block the payment card, or dismiss the alert. Risk Manager also gives sellers the option to implement rules that trigger 3D Secure on qualifying purchases.

[Tom]

Thank you to everyone who participated today! While the time to ask new questions and offer feedback for this event is now closed, the Account Security will address the remaining posts within the next week.

Appreciate your patience and keep watch for notifications as we circle back with more details, as well as a summary of the topics discussed. 🙏🏻