How Can I Confirm If This Email Is from Square?

[osd]

Today I get this unusual email (with my info blocked out) after going through a verification process 3 times in the last couple weeks:

The rest of the email states this:

Mike, We’re writing to inform you that due to industry-wide changes in legal requirements for processing payments, you must reverify your identity to continue processing payments. Please complete this by December 31, 2024, or your account will be deactivated. The process is simple and will take you less than 10 minutes. To verify your identity, we need one of the following government-issued documents: • Passport • Provincial / Territorial ID Card • Driver’s License • Residence Permit Next, visit your dashboard notifications and select the message instructing you to reverify your identity to continue taking payments—that’s it. By clicking on “Complete verification” below, you consent to providing your ID scan and biometric data to Veriff, our vendor, to verify your identity using facial recognition technology. Learn more in Veriff's Privacy Policy. Alternatively, you may also reach out to our Customer Success team to request a manual review here.

For the first time in the email header, it states "If you’ve already reverified your account, please disregard this message.".

Is it me, or did square update their system so everyone now receives emails like this every month even if the government did not address the regulatory changes to the public on their website?

Anyways, clicking on the link led me to a long link beginning with: https://kjfjb2yk.r.us-west-2.awstrack.me/L0/https:%2F%2Flinks.squareupmessaging.com  which redirected to a link beginning with https://app.squareup.com/payon-fe/remediate?mt= with the document title "Square web application". and in the latest firefox, all I ger is this screen with the spinner constantly spinning and nothing else happening:

With the setup, I'm wondering if someone is collecting information behind the scenes due to the initial link with the domain ending in awstrack.me

The title of this thread has been edited from the original by a Community Moderator to help with searching threads. 

[RobynR · Accepted solution]

Hey @osd,

Thanks for reaching out to the Community.

This email wasn’t sent by us, so it’s important not to click any links or open attachments in the message you received. If you’ve already entered your credit card information, please contact your bank or card issuer right away to secure your account.

Official emails from us will always come from an @squareup.com, @weebly.com, or occasionally from our parent company Block, Inc., using an @block.xyz address.

To help us investigate, please forward the suspicious email to spoof@squareup.com, mark it as spam, and then delete it from your inbox.

You can also find tips on identifying and reporting phishing scams in our Square Support Centre.

Let me know if you have any other questions— I am here to help!