So one day you get an email that you got $100 and all you need to do as a recipient is to click on a link and enter your full credit card details? Sounds like a phishing paradise.

Not even a credit card - a debit card!

In the US at least, these are not covered by the $50 limitation on losses on unauthorized transactions. In practice the banks often honor that anyway, but AFAIK they don't have to.

In this case however, it appears the bank could argue that when you got phished, you gave access to a third party.

Wow. I would never do this. It's a good practice never to use a debit card online, and it's unclear to me whether the service here offers any enforeceable assurances to participants.

I'd risk a debit card on this technology only if there was a small amount in the account and no overdraft capability.

I just found a major limitation with this thing. It blocks payment from any prepaid Visa/Mastercard - even reloadable cards attached to virtual checking accounts that support ACH (payroll cards, Netspend, etc). That eliminates payments from a huge section of the population.

http://prntscr.com/1xm5le

Another issue: if you make a mistake on the initial email, and want to send a different amount, you're out of luck. When you send a corrected email from the same address and go to the payment page, it adds any previously unfinished transactions from your email to the amount being sent, with no way to cancel the mistaken one. So just never make a mistake, and never do a test transaction you don't intend to finish, or you'll be required to finish and pay for all of it when you finally do have the correct amount and want to send a transaction (which you can only send with a small subset of the debit cards in existence).

These payment companies are always introducing interesting new things and then they hobble them with basic oversights and fundamentally flawed policies. In the last hour I've gone from excitement to disappointment with this service. It had promise based on the description, but this particular service (probably not Square itself) will fail very quickly.

>> I just found a major limitation with this thing. It blocks payment from any prepaid Visa/Mastercard - even reloadable cards attached to virtual checking accounts that support ACH (payroll cards, Netspend, etc). That eliminates payments from a huge section of the population.

.. Aaand it's not an accident either.

Is that to meet the money laundering/auditing requirements?

Sounds like this is probably more of a security feature. Prepaid cards are harder to track, and would be more suspect to fraud.

You know what's at least as hard to track and prone to fraud? Actual cash. I really dislike the idea that e.g. children shouldn't be able to pay for things over the internet because their identity can't be verified. Let's see some more support for prepaid cards.

Are pre-paid cards the only option for children in the states? I'm in the UK and I've had a debit card (attached to a bank account) since I was a young teenager.

I had a checking account under my Dad with a debit card when I was a minor. When I turned 18, I just called them, and they made it my current checking account. I'm not sure what the difference was.

Actual cash is nearly impossible to fraud/counterfeit.

Are you a parent? I do not have want to my kid buying products unfettered.

I hate to break this to you, but they can already buy things in physical stores.

And if you legitimately have a $20 bill, I can walk into a store, represent that it's mine, and buy things with it, never encountering an obstacle along the way. That's the same fraud you're worried about in prepaid cards.

I also wish the limitations would disappear, but there are two reasons keeping them in place:

1) Government wants to ensure it can track all digital transfers (many pre-paid cards require activating with SSN)

2) Failing to approve certain transactions is the equivalent of a financial firewall because banks and payment processors know they haven't hardened their servers enough to prevent another one of these: http://www.nytimes.com/2013/05/10/nyregion/eight-charged-in-...

Now, if policy-makers were convinced the online-children-purchases market were bigger than the drive-by-ATM fraud, we would see the rules changed tomorrow.

Of course they can, but as a parent, I find it easier to supervise their store purchases than their online purchases, because they have to physically go there, and I can notice it.

Frankly, if you're that interested in tracking what your children have and haven't bought, online purchases are likely to be easier, in that they come to your home through the mail.

The general categories of things that children are commonly restricted from buying:

- Drugs. These are all black market, so availability of prepaid cards is unlikely to change how they're bought.

- Alcohol. I've never tried to buy this online; I know eBay Now wanted to sell it and concluded that the cost of legal compliance was too high. Even assuming they could find mail-order booze, it would arrive in the mail, easily detectible.

- Pornography. This can be consumed directly on the computer, raising possible detection issues. However, if you're afraid of children buying it over the internet, I've got some very bad news for you...

- Birth control pills? I'm running out of ideas.

Are you afraid they'll buy digital goods? Why?

> - Birth control pills?

Exactly the kind of thing teenagers should be able to buy without their parents' consent.

You won't find me disagreeing with that, but the fact is birth control pills are controlled.

you need a prescription from a doctor to buy that ;)

> in that they come to your home through the mail.

Says who? Who says they couldn't send a package to a friends house, or a workplace?

If they have a workplace, all hope is lost.

How would you react to receiving a package in the mail for your son's friend?

Oh I know how I would react, but that doesn't mean every parent would react that way.

> with no way to cancel the mistaken one.

I see a "cancel" link in the email Square Cash sends me.

I did notice that there is a cancel link in the original email - a very small link at the bottom - but they should make it possible to remove any of the transactions it tries to compile together on the sending screen. Having to go back, find the email, and hit the cancel link after you realize that they are including transactions that you had no intention of completing isn't exactly intuitive. There is also nothing anywhere that says that this is the procedure required.

" and hit the cancel link after you realize that they are including transactions that you had no intention of completing"

Why are you starting transactions you don't intend on completing anyway? I haven't tried it, but from what I've read so far the workflow seems perfectly reasonable for the vast majority of transactions. It's not like when I pay a friend the 10$ back he fronted me last week in the bar when I forgot my wallet, that I give it to another friend first and say 'hold on to this for a bit while I ponder whether to actually go through with this 'transaction''.

I didn't even bother trying. I knew it wouldn't do what it said because I'm not in America. I've sent cash to other countries before but this isn't cash so it can't possibly work. IT would be nice if they clearly listed who can't use it to save people's time.

Just a note, for most countries, the best non-cash way to send money is an international wire transfer (sometimes called a telegraphic transfer). This is _not_ western union. which is ludicrously expensive, it's done bank to bank.

Every international wire transfer I've seen offered by my banks has costs at least $15 - $25.

Here in NL, its so much each to use send someone money: They tell you their IBAN, you grab your Random Reader and enter you pin and get a secure code to authorize the payment, and it's done. There's not even a market for companies like Square, since the banking system is designed to handle these typical situations. People here look at me like I'm crazy when I say that if I want to give someone money I either have to use PayPal/Square or just cash.

>" It blocks payment from any prepaid Visa/Mastercard - even reloadable cards"

This is to prevent money laundering and tax fraud.

It also doesn't work with pure ATM cards that lack a Visa/Mastercard logo. Maybe I am a bit over-paranoid, but I don't like the idea of staring at a zero bank balance while some fraud department promises to fix things up real quick now if I just stay on hold.

If you don't trust your bank to fix fraud, than you need a better bank.

I actually laughed at that. Every bank here is the same and we supposedly have some of the safest banks in the world. Im limited to an 8 character password, and the other banks here are little better. New Zealand.

Really? I've been impressed with Kiwibank's balancing security and usability. Rabobank NZ have two factor authentication too.

Of course if you're with one of the four majors, well... they're owned by Australians, what did you expect?

It's safe in NZ because even with access to your internet banking, a thief can only transfer money to another NZ account and they're fairly reliable at verifying the identities of account holders.

Which bank are you with? Having had accounts with 4 major banks here (Kiwibank, ANZ, Westpac, ASB), I can confirm that you are allowed passwords more than 8 characters. Also, several of them offer a second protection level for logging in.

ASB. How did you get a long password? It just deleted the characters at the end when I tried (6 months ago).

Thank you for taking the time to try it out and for reporting the results back to HN.

> The automatic-authorization appears to only apply when it's between two previously validated parties.

This doesn't feel quite right, as you describe it you'd validated that it's ok to receive money from them, not send it. I'd be more comfortable if it was validated in some way when you first send something to a person. Receiving money doesn't mean I trust a person.

I could send you a dollar, and when you accept it I could fake an email back giving me 100. I hope this only happens with signed emails.

About DKIM, does it stop someone from repeating an email? Could I fake an identical email that has been sent before? If so, that's something that normally wouldn't be an issue (duplicate emails aren't really a problem, you can't inject any information, change links to dodgy sites) but would be huge for sending money.

EDIT - from the DKIM site

> DKIM does not protect against re-sending (replay of) a message that already has a valid signature; therefore a transit intermediary or a recipient can re-post the message in such a way that the signature would remain valid, although the new recipient(s) would not have been specified by the originator.

EDIT2 - Squares security page is brief and, well, sounds odd

> detects suspicious behavior in real-time, and in many instances, even before it happens.

How do you detect behaviour before it happens? Isn't that inherently impossible?

You bring up an excellent point about simply replaying the same message. I'm curious what mechanisms are in place to prevent that.

And yes, the exchange was B -> A which gave automatic authorization for an A -> B transmission, which I do agree is a bit presumptuous on their part.

You're right, DKIM doesn't sign the message-id, which is the obvious de-duplication mechanism. What a half-arsed oversight.

> How do you detect behaviour before it happens?

Didn't Minority Report answer that question?

I posted up a detailed screen flow of the entire process on my own site if anyone is interested:

http://blog.charleyma.com/square-cash-initial-thoughts-scree...

Overall though, extremely impressed with Square's offering and it was also instantly debited to my account. Curious to see if the value increases to a somewhat significant amount if this "instant transfer" translates into 1-2 business days.

Even if Gmail is the reason I hope they'll add an option to verify the transfer anyway. It looks like something that is easy to use other vulnerabilities to mount an attack.

There's a pretty straightforward SMS confirmation thing you can enable by logging in to your Square account. Tested and it seems to work well. Also note that the weekly transfer limit is $250 if you don't verify yourself, so the risk is somewhat limited.

Out of curiosity: Do you know whether the $1 is listed as "available funds"? Some (all?) banks list pending transactions like check deposits and include those funds in your account total, but then have a separate header for "available funds" that are actually usable to spend or move.

In my bank (Capital One 360, formerly ING Direct) the deposit is listed as cleared & available. The $1 I sent him back is in a pending status (and thus removed from my available balance)

This is almost exactly the same system as Interac in Canada. Will work well until the fraudsters figure out they can steal with it then limits will happen. Wonder what the merchant fees are and if they seize accounts for receiving an arbitrary amount of payments

There are no fees by the looks of it; it's completely free.

No it isn't, somebody is paying something to someone. Square is just not charging the people who exchange money... yet.

That's like saying Facebook isn't charging people yet.

There are monetization strategies which don't involve charging the end user anything for the service provided.

It looks like how it lets you claim your money without your bank account details is by processing a refund. Don't know how they did it, but it's very cool.

You mean email account, and not address, right?

Prevention is less important than detection and reversal before withdrawal, which Square and other payment methods companies are pros at.

I agree that security could and should be a huge concern. With your credit card you're protected from fraudulent transactions. But this is not the case with ATM. If someone gets a hold of your ATM + PIN, you're just plain out of luck.

Not sure how that translates to this service, but if something is compromised, you might just end up with an empty bank account.

Email verification would be done with SPF and DKIM. I would sure hope that this is required!

The issue is also that people will just squat on compromised accounts and then nick funds as they appear. Low probability I suppose, and that's what they're betting on.

What are the verification steps for sending money to a previously unknown party? Is it SMS verification, or do you have to re-enter your card details?

I agree. Security is definitely a major concern for me. Still a cool concept though