recent fraudulent activity at street fair via Square app

[MomAlmighty]

It's been reported in my local news that merchants at a street fair have been taking Square payments from a group of suspected criminals. The fraudsters make the Square app appear to show the transaction as complete and approved but later the merchants found out that no such activity occurred. Square says they can't help because they have no record of any transaction. The merchants are out the items and the money. I am just about to start my season as a vendor, and I have some expensive one-of-a-kind items that I would be devastated to lose in such a way. How can I protect myself from this? Has anyone else experienced this crime?

[JK_Fiber_Art]

Interesting - I'm wondering how the not so honest people make the Square App appear to show the transaction ??   Seems that does not make any sense if you are the one selling - all the details would be on your device and you would know if you made a sale.  There seems to be more to this story however.  If you have more info - reference to a news story, etc., that would be helpful for others here. 

[MomAlmighty]

That's all I know. It was on the local Facebook news page. There were a couple of photos of the perpetrators that the local police had asked the admin to post to help ID them. I have questions, too. I'd be interested to know if the merchants were using the dongle, a freestanding POS, or direct through their phone (like I do) and if the method may have more to do with hack. It's really unsettling as a seller.

[ryanwanner · Accepted solution]

I saw this video about a week ago when it was posted in a Square FB group. The reporter and sellers were very vague in what type of device they were using.

My thoughts on this: if you're using the terminal or stand, during checkout there is a back arrow button in the upper left. If the seller isn't using PIN code security, there is no way to prevent someone from using that button to back out of the sale and close it to whatever other payment method they want. Currently all sales close to the same "All Done" screen, so if the seller isn't paying attention they won't know something happened until long after the fact.

Is this something that needs to be improved upon? Absolutely. I've already brought this up to @maxpete and he's sent it up the chain to see what can be done. He and I can't figure out any other way that a buyer can change the payment type methods outside of this back arrow--there is no known way to make the app think that a different payment type was selected while on the cc input screen.

In the meantime, I highly encourage all sellers to enable PIN security on their devices. One of the options is to require a PIN to back out of a sale: this will require a PIN every time that the back arrow button is pressed. If the option to require a PIN after every sale is unchecked, you won't notice a difference in selling for the most part. Plus, a little inconvenience for PIN entry certainly beats getting scammed out of $700 in sales!

YouTube video

[MomAlmighty]

Thank you, Ryan. I am glad you posted this video. I've been hunting the Internet for more on the story and couldn't find anything. This report was in San Dimas, the incidents I referred to happened in Riverside County, so the scam is 'out there.' I will look into adding the PIN feature.

[Candlestore]

@MomAlmighty ;

Is this only for Square or are other Tap to pay merchants also being effected?  Everyone seems to be getting Scammed by Skimmers or even at Tap to withdrawal banks or Zelle transfers these days.  Just google Scams on you tube.

I have not been scammed using Square, but I am aware of others having been scammed in different ways.  My suggestion for ALL Square users is:

1.  Make Sure ALL Credit Card and Tap payments go through completely before handing over your merchandise.
2. Verify Name on Card Matches a State Issued ID
3. Check your Transactions you should see the amount Charged immediately on the Device used, could take longer to see on another device.  Meaning if sale was made on your stand the Transaction will show on the Stand, but if you check Transacations on your Cell linked to your Square account this could take a few minutes for your Cell to get the update from Square of the Sale.
4. Print out all receipts for the Transactions.  You can quickly look to see if the items were paid or if there is an amount due and how it was paid.  If the receipt shows Other or Cash but they tapped, you know its a scam.

Your receipts when printed should look like the below image.  Left was a Cash payment, Middle was a Tapped Credit Card, Far Right was a Split Payment $20 cash the rest was on a Credit Card.  The thing I do not like about the Split Receipt is it does not show how much is still owed.

[MomAlmighty]

In this video, it appears the merchants believed it to be a TAP issue, but in the news story I read, the merchants were in consensus that it was a Square thing. Unfortunately, both can be true.

[Steam_and_Gears]

I travel for my business and recently stopped at 2 different places to get gas that are no longer taking tap payments as they were scammed.  One clerk told me there is a phone app that allows you to link to the seller's account while tapping so you can steal funds from their account.  Has anyone else heard of such a thing? Is this now an issue we should worry about?

[Candlestore]

@Steam_and_Gears ;

Did the sellers state if the Tap to pay that scammed them was done by a Credit Card or that it is only done by Cell type devices...Cell Phones and or possibly watches?  We started only taking Tap by a Credit Card once we heard of this.  When someone only has the ability to tap paying by a Cell Phone, we explain that we print out a receipt for our records because of this scam.  Most people do not mind, but once and awhile younger people argue and then just say forget it.  Now were they just trying to scam us or did we loose a legitimate sale?  I figure when we print out the receipt it shows how it was paid and a transaction number, which then is also logged in Squares Transactions file.  If the customer says I want that Receipt too, I just click Transacations to make sure the sale is there too, before giving them their 2nd receipt.  From what I have read and seen, when a person Taps to pay it changes the Payment to cash or Other, instead of charging a Credit Card.  Now my readers are wired through USB and not bluetooth connected to my Square stand, I am not sure if that has anything to do with sales as a street or Pop up vendor.  So yes I agree more details on how the person being scammed was taking payments would be helpful.

Banks come out with all these great security features to protect users and make their cards secure, but I always wondered how tapping a cc was more secure than having the users photo on the card or a signature that would match the customers signature to the CC companies file.  If someone 'Finds' a CC that has Tap features what is to stop a person from Tapping it for Gas or any other type of purchase?  What makes Tapping more secure?