How can I tell if this email came from Square?

[Yeps]

We received an email saying we charged a card $500 and the customer disputed the charge and square will take it out of our account. Looking on our app, there was not a charge for such an amount. How do I find out if this is a fraudulent email?

[GlassJudy · Accepted solution]

This is quite likely a scam, but it should be taken seriously.  First, look at the sender's email address.  If it doesn't end in ...@messaging.squareup.com (or possibly ....@squareup.com), it's not from Square.  You should forward the email to spoof@squareup.com.  They will look into it and get back to you.

Very important, though, is that you don't click on any links inside the email.  If it tells you log into Square, it will provide a link that will not take you to your Square account, but someplace where they're trying to get your login information.  Only log into your Square account by going to squareup.com/dashboard! 

Unfortunately, it's very easy these days to copy the look of a real company's documents, and scammers are always trying to cash in on that fact.

[Viewfront]

noreply@messaging.squareup.com

If you have doubt simply log in from your browser and that will take you directly to your dashboard and give you whatever message they want you to have

[kayteeS]

The "spoof at squareup dot com" address no longer works for me-- I get a failure notice when I try to forward suspected phishing/spoofing emails.

Is there a new e-address for that?

[_Violet]

Hi there @kayteeS, The email address to forward Phishing Emails is still spoof@squareup.com. 

Without exposing any sensitive or personal information, could you please share a screenshot of the error you're seeing? This will give me a better idea of what's going on. 

I'll keep an eye out for your reply!

[kayteeS]

That was the email I used to forward the phishing emails; this is a cut/past of the message and header of the reply and the phishing email (this program won't allow the HTML of the body of the phishing email):

(MAILER-DAEMON@aol.com)To:you Details

Sorry, we were unable to deliver your message to the following address.

<spoof@squareup.com>:

550: 5.7.1 The user or domain that you are sending to (or from) has a policy that

5.7.1 prohibited the mail that you sent. Please contact your domain

5.7.1 administrator for further details. For more information, please visit

5.7.1  https://support.google.com/a/answer/172179 a20-20020aed2794000000b003a816c0d9c7si4236812qtd.562 - gsmtp

---------- Forwarded message ----------

-----Original Message-----
From: Squαre <no-reply@recitynetwork.org>
Sent: Mon, Dec 19, 2022 7:02 am
Subject: $1,300.00 payment - Square Payment Suspended

[JJ_]

In this case, it seems that AOL was able to detect the Phishing content on the email and stopped it @kayteeS. Thank you for reporting here. 

[kayteeS]

The original phishing email came through to me, to my inbox, not my SPAM folder.  It's just the forward to Square that bounced.

Also, I've received similar purporting to be from Amazon, banks, PayPal, etc., and there is no problem forwarding them. It's just the ones I try to forward Square that bounce.

[JJ_]

I will let our security team know about this. Would you mind sharing a screenshot of the email contents? It might help me track down this account and report it to the Account Services Team @kayteeS

[kayteeS]

this was an attempt at a screen shot-- not all of it was captured. The part cut off the top: 

$1,300.00 payment - Square Payment #ffv1In2LmMBAkt6gY0jWPyMF

The headers are in an earlier post. My security program won't allow me to download it to a PDF.

[JJ_]

Sorry for the delay in my response @kayteeS.  I was able to investigate this and the reason this email is bouncing is that our Security Team has already flagged this email in our inboxes as a phishing scam. Thank you for taking the time to report this.