Square today rolled out a potentially game-changing new service in the form of Square Cash, which allows anyone with a Visa or MasterCard debit card to send money to anyone else with a Visa or MasterCard debit card, via email. Square, Jack Dorsey’s San Francisco payments startup, charges no fee and the money will arrive sometime between instantaneously and one day later. Reviews of the service are very positive. You can transfer up to $2,500 a month via Square Cash, which means it could be useful for everything from settling up with friends to paying rent.
But there is a giant caveat to Square Cash that the company is going to have to deal with in its communications to the public if it wants the service to take off: There is no limit to your liability for fraud from the use of Square Cash. So what happens if someone hacks into your email account? Sending cash with Square is as easy as emailing someone with a dollar amount in the subject line and CC-ing “firstname.lastname@example.org”. Square replies to the email and sets the transaction in motion, transferring from one debit card to another, directly.
Square says it will reverse fraudulent transactions, but what if that money is already gone, because it’s been transferred elsewhere by the recipient or withdrawn? This is a question Square has yet to answer with sufficient clarity.
Update: Square says “All communication from Square is safe and secure and we have a world class risk and fraud team that uses sophisticated risk visualization tools to stop and prevent bad actors. We always protect the safety of our customers and can reverse a payment if necessary.”
The optimistic view is that Square will pursue money on your behalf no matter what their terms of service say, because a few high-profile cases of fraud would ruin the reputation of this nascent service. But the way Square makes it explicit, at least in its legalese, that it’s not liable for fraud, suggests the company is prepared to defend itself from unforeseen circumstances.
Square says that its service is super secure. And in order to transfer more than $250 a week via Square Cash, you have to give them information about yourself including your Facebook account, to verify you’re a real human. (Good luck to you if you’re a social media conscientious objector.)
I’ve reached out to Square for clarification on its security procedures and fraud protections, and will update this article once it responds. But right now it looks like using Square Cash at least opens people up to the possibility that a hacker could empty their checking account.