Email scam targeting Square credit card readers used by small business owners

Investigators with the Federal Trade Commission and Better Business Bureau have uncovered a pattern of imposters using email to pose as representatives of the Square credit card reader system.
 
Holly Salmons, president of the BBB in Central Florida, said the scheme sets a trap with a claim that a transaction has failed or that a customer wants to cancel a purchase.

Salmons said the scammers are counting on busy shop owners to simply glance at their smart phones and click.

“If you receive an email that appears to come from Square or their service, take the time to review the message on a desktop (computer) or larger device," Salmons said. “If all else fails, just don’t click the link.”

The “lookalike links” allow malware into computer systems owned by small business owners that use Square as payment device.

According to the company’s website, Square’s credit card processing allows company owners to “accept all major cards and get deposits as fast as the next business day.”

Salmons said Square is a popular device used by many small businesses. For a small fee on each transaction, Square turns a smartphones or iPad into a payment station.

The systems are used by hair stylists, food truck owners and other small business professionals.

“If you are a user of this device, and you do receive one of these emails, you should immediately go into your Square account and change your password," Salmons said. “Delete the email. That’s the best way to protect yourself.”

A spokesperson with Square issued this statement:

"Any company that communicates with customers via e-mail needs to be aware of the risk that phishing poses to internet users. We make sure to educate sellers on how to protect themselves from phishing scams (see here and here,) includes encouraging them to forward any suspicious emails to spoof@squareup.com."
 
To find out more about how phishing scams work and how to avoid them, at BBB.org/phishingscam.
Square users who have been targeted by a phishing scam can help others avoid the same fate by reporting their experiences on the BBB Scam Tracker.