I was reading The Wall Street Journal this morning and came across Walt Mossberg’s review of a new service from Square, a popular mobile payments processor. With just an email address, Square Cash lets you send up to $2,500 a month with no fees from one debit card to another. Immediately the gears in my head started to turn. Could this be a new Amazon Payments?
Amazon Payments is a convenient way to send $1,000 a month electronically to another person. I send a payment to my sister every month and she writes me a check. (Don’t try sending the money back to the same person using Amazon Payments.) But that’s only $1,000. Bluebird allows you to manufacture up to $5,000 per month in artificial spend. The problem is we can’t easily buy Vanilla Reload cards here in the Pacific Northwest, so Bluebird involves the hassle of buying prepaid Visa gift cards, assigning a PIN to make it function as a debit card, and driving to a physical Walmart location.
My goal in this experiment was to buy the same prepaid Visa debit card but instead of driving to Walmart I would send the money using Square Cash. The money would be delivered straight to my checking account by linking to an actual debit card on the other end. And I could then use the funds in my checking account to pay off my credit card bill. I would be able to send $2,500 a week, or $10,000 per month — better than the $5,000 allowed by Bluebird — and I wouldn’t have to make the drive. I also think it would be pretty easy to get several email addresses and bank accounts to leverage this system on a grand scale, all from the convenience of your home.
When testing an idea like this, it’s usually a good idea to start with small denominations. Instead of the usual $500 gift cards I buy, I got one for $25 — it also had a lower $3.95 activation fee. Otherwise it was the same kind of card I always use: issued by U.S. Bank National Association and sold at QFC (Kroger).
After assigning a PIN over the phone and registering the card online with my address (Square Cash asks for a ZIP code), I followed the instructions on Square Cash’s website to send myself the money. No registration is required. Instead you just send your friend an email with the dollar amount in the subject line and with a Cc delivered to firstname.lastname@example.org. Here’s what happens next:
- Your friend receives your email, just as you sent it.
- Square sends you an email asking you to link a debit card to your email address. It will use this account to withdraw the funds. You need the account number, expiration date, and ZIP code.
- Square sends your friend an email asking him or her for the same information. It will use this account to deposit the funds.
All proceeded as expected, but when I tried to enter my prepaid Visa gift card’s details, it was rejected. Boo!
Square obviously knew this was a prepaid card, which can be determined by the first few digits of the card number. Apparently Walmart/Bluebird and Amazon Payments haven’t yet invested the effort in shutting down this loophole in their systems, though I imagine they will eventually.
There was a lot of opportunity, but unfortunately Square managed to spot this opportunity for fraud and block it before it became an issue. Maybe other prepaid cards will work, and I’d be interested in your feedback if I should have done anything differently. Square Cash could still be an improvement on Amazon Payments for legitimate transactions, and those with miles-earning debit cards should give it a go. There aren’t as many and they don’t earn as much as they used to, but they will likely work where I have failed.
There may also be a lot of risk. Square says it accepts no liability for fraudulent payments, and if it suspects fraud it can reverse the transaction. But what if you’ve already thrown away the prepaid gift card? And what if your account information falls into the wrong hands?
Consider someone who finds your wallet (or just steals it). That person would have a driver license with your ZIP code and the account number and expiration on your debit card. That’s all he or she needs to send up to $2,500 to another account. Or if they already know you have a debit card linked to an email address, they could hack into your email or create a spoof email that only looks like you sent it. Situations like these are why Square says it can unilaterally reverse a transaction, but they don’t make me very comfortable.
Check out the commentary on Slashdot. If you think travel blogs bring out the angries, you haven’t spent enough time on Slashdot. They can be quite the opinionated bunch.