Payment App Fraud Is on the Rise. Here’s How to Protect Yourself.

$40 million.

That’s how much money Venmo lost during the first three months of 2018¹.

Meanwhile, users of other payment apps – such as Zelle® and Cash App – filed complaints of losing money as well.

The culprit?

Payment app fraud.

Scammers are now using peer-to-peer (P2P) payment apps to make fraudulent purchases and money transfers. They rely on the apps’ speed and ease – as well as users’ lack of knowledge – to steal up to thousands of dollars within moments. Worst of all, there is no guarantee that the fraud victims will be fully reimbursed for their losses.

If you’re a payment app user, be on the lookout for scammers. Below, we’ve outlined common scam scenarios plus tips on how to protect yourself.

Scenario 1: Unauthorized Fund Transfers

I’m sorry, ma’am – your card has been declined.”

Amber sat at her favorite restaurant, confused. She knew perfectly well that there was plenty of money in her checking account. So, why did her bank decline her payment?

“Will you excuse me for a moment?” Amber asked the waiter as she logged into her mobile banking app. This must be a mistake, she thought.

Unfortunately, it wasn’t. Amber’s checking account was completely empty.

Fraught with concern, she searched through her transaction history. There, she found a series of Zelle payments totaling $3,000.

“How is this possible?!“ Amber asked herself. “I don’t even own a Zelle account!“

What Are Unauthorized Fund Transfers?

There are many forms, but, in the case of P2P payment fraud, an unauthorized fund transfer occurs when a thief uses stolen information to transfer money out of a bank account using a payment app.

While the above story is fictional, the scenario is quite common. In fact, consumers across the country have reported fraudulent Zelle payments ranging from $190 to $6,400. Although Zelle has taken much of the heat, payment apps such as Venmo and CashApp are equally susceptible to fraudulent fund transfers. Worst of all, none of these payment apps offer fraud protection for consumers.

Due to Regulation E, banks have a responsibility to protect consumers from unauthorized electronic transfers. However, once your money is stolen, it may take weeks to get it back. Plus, there is no guarantee that your bank will reimburse you for the full amount.

How Do Unauthorized Fund Transfers Happen?

For each case, it isn’t always clear how the crime occurred. However, there are a few possible scenarios:

• Credentials Stuffing: This describes when hackers acquire a list of legitimate login credentials from data breaches. Because many consumers re-use the same credentials across multiple websites, hackers can use these stolen credentials to access online banking accounts. Once access is granted, the hackers will set up fraudulent P2P payment accounts and use the stolen information to transfer money out.
• Social Hacking: This describes when a thief contacts and manipulates a person to get access to private information. In the case of payment app fraud, a scammer typically calls or emails a person with a spoofed number from a bank to “confirm” secret information. This includes temporary passcodes, zip codes, or any information that could unlock a user’s financial account. The scammer will then use the hacked information to create a payment account.
• Card Skimming/Stolen Card Numbers: Payment apps typically require users to verify bank information, but verification is not required for debit or credit cards. In the case of card skimming, a scammer will install an electronic skimmer to read and download credit or debit card information. However, electronic skimmers are not necessary for stealing card information – anyone with access to your credit or debit card can steal your information at any time. Once this information is stolen, the scammer will add it to an existing payment account and make fraudulent transfers.
• “Borrowing” Phones: In this scenario, a scammer will fake an emergency and ask to borrow a smartphone to call a friend. With access to an unlocked phone, the scammer also has access to the phone’s mobile apps. Because most smartphone users enable auto-login for their apps once the phone is unlocked, the scammer can quickly log into a payment app to transfer money out of the linked account.

How to Prevent Unauthorized Fund Transfers:

The main issue behind unauthorized fund transfers is the unauthorized access of private financial information. Payment apps are merely the vehicle to commit theft. With this in mind, use the following tips to ensure your financial information is safe:

• Create strong passwords. This point is crucial. Hackers do not need to do mental math in order to gain access to your accounts – instead, they use bots and password cracker programs to do the heavy lifting for them. To protect yourself against these brute force attacks, you must use strong passwords. This means a password with more than eight characters and a combination of letters, numbers, and symbols. Do not use common words, as hackers have dictionary tools. If you must use a word, use an alphanumerical version instead. For example, use Un!c0rNn instead of the word, unicorn.
• Use unique passwords. Reuse of login credentials allows hackers to gain access to additional accounts through credential stuffing. Create a unique password for each website. Instead of trying to remember each password, use a password manager to store them. Be sure to change your passwords at least once per year.
• Use multi-factor authentication whenever possible. If a hacker gains access to your account credentials, multi-factor authentication ensures they do not get too far. If using a temporary passcode for multi-factor authentication, be sure to keep this information private. Your bank will never ask you to provide this information.
• Stay away from public Wi-Fi. By using public Wi-Fi, you expose your devices to malicious behavior. If you must use public Wi-Fi, be sure to use a virtual private network (VPN) to keep your data secure.
• Opt for using credit cards with your P2P apps. If a thief uses your payment account to make fraudulent purchases and transfers, you’ll have an easier time getting reimbursed with a credit card. While banks have a responsibility to assist customers with fraudulent charges, there is no guarantee that the full amount will be reimbursed to you.
• Disable auto-login. If someone gains access to your mobile device, they have access to your mobile apps as well. Prevent scammers from inflicting damage on your finances by disabling auto log-in for all financial apps. If possible, enable fingerprint lock instead.