Con Watch: The Dangers of Payment Apps

Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams. See Steve’s other Con Watch articles.

Peer-to-peer payment services such as Zelle, Venmo, Apple Pay, PayPal, Cash App, and Popmoney are popular ways to quickly and conveniently send money electronically from your credit card or bank account. According to eMarketer, 148.8 million Americans use payment apps. Unfortunately, these services also provide easy ways to quickly and conveniently be scammed, and unlike scams targeting your credit cards, you may not have as much protection under the law.

One woman in California lost more than $18,000 via Zelle when crooks used texts and phone calls pretending to be her bank.

A report issued in October by Senator Elizabeth Warren that analyzed Zelle use at seven banks over the last 18 months indicated that there were 192,878 fraud cases totaling $213.8 million, but that the banks reimbursed their customers in only 3,500 cases.

Zelle originated in 2017 and is operated by a consortium of banks. It may appear on your mobile banking app. Sending money through Zelle requires you to enter only the recipient’s phone number or email address. This makes it simple for victims to unwittingly pay for worthless items. Scammers may also send emails or text messages that lure you into providing your Zelle username, password, and PIN, so they can then take over your bank account.

In a Money Crashers survey of users of payment apps, they found the disturbing statistic that 52 percent of users were not even concerned with security.

How to Protect Your Account

• Before signing up for any payment app, you should familiarize yourself with their fraud protection rules. In the fine print of many services, you may find that you have little, if any, protection if you use the account to purchase something that ends up being a scam. These services should be used only to transfer small amounts of money to people you know.
• Always use a PIN or other dual factor authentication whenever your particular service offers it.
• If your account is tied to a credit card, you should be able to get the amount fraudulently taken refunded from your credit card company in accordance with federal law. You are always safer using a credit card rather than having your bank account or debit card tied to your payment app. Check to make sure your payment app allows you to use a credit card; not all of them do.
• If your app is tied to a bank account, you should be able to get the money refunded if you report it immediately, pursuant to the Electronic Transfer Act. However, if you delay in reporting the fraudulent use of your debit card, you risk losing your entire bank account. However, as shown in Senator Warren’s report, banks are taking the position that the Electronic Transfer Act does not apply to many victims of Zelle scams.
• To avoid having your account being taken over by scammers, never provide your username, password, or PIN in response to any email, text message, or phone call. These requests for this information are never legitimate. You can confirm this by contacting your bank or other company by calling them at a telephone number you know is authentic.
• Know how spoofing, phishing, and smishing scams work.As one example, here is a copy of a Venmo smishing text message:
  

  “Venmo User: You have been selected to receive a free gift worth at least $125 for a 2 minute survey:  distinguishsjstartxxxxxx.com“

  Note that the initial part of the link doesn’t have any apparent relation to Venmo, which is a good indication that this is a scam. Venmo is not offering $125 to people to take a survey. No one is.

  Never respond directly to these text messages. Don’t text “stop” or “no” as sometimes suggested. Doing so only alerts the identity thieves that they have a real and active cellphone number. Instead forward the text to 7726, which spells SPAM on your keyboard.

• A good rule of thumb is that if the message is sent to you (vs. you contacting them), assume it’s a scam.