Verify Cash App Account Ownership Before Reporting Fraudulent Activity

Amanda Smith faces criminal charges and potential imprisonment of up to six years due to a Cash App account opened under her identity. According to first-hand research from Malwarebytes Labs, Smith maintains she never created the account. The incident underscores how stolen personal data can lead to severe legal consequences beyond financial loss, including wrongful arrest and detention for crimes an individual did not commit.

The risk

Law enforcement obtained account information from Block, the parent company of Cash App, which included Smith’s Social Security number and date of birth. Police arrested her in Pennsylvania for an alleged scam in Arkansas, a state she claims she has never visited. She spent three nights in jail before the discrepancy became apparent. The risk here is not just monetary; it involves the misuse of government-issued identifiers to create a digital persona that authorities initially attribute to the victim.

Who is exposed

Individuals whose Social Security numbers and dates of birth have been exposed in data breaches are at risk of having financial accounts opened in their names. 404 Media reports that the phone number linked to the fraudulent Cash App account was associated with an Amanda Smith in older breach data. Furthermore, investigators found a Venmo account created with the same phone number but under a different name. This suggests that threat actors are combining data from various leaks to build convincing, albeit fraudulent, identity profiles.

Cost and compliance

The source material does not specify financial penalties, regulatory fines, or compliance violations related to this incident. It does not state whether Block faced any regulatory scrutiny for providing the data or for the account verification process. The focus remains on the personal legal costs incurred by Smith, including jail time and the burden of proving innocence. No specific compliance frameworks or statutory requirements are cited in the reporting by Malwarebytes Labs or 404 Media.

Our take on the response

Smith encountered a significant barrier when attempting to investigate the account herself. She reported that Cash App refused to provide information because she could not prove ownership of an account she did not create. She only received the necessary account records through the ongoing criminal case. This suggests that victims of identity theft may struggle to access evidence from financial platforms without law enforcement intervention, complicating personal defense efforts.

What defenders should look for

Security operations teams should monitor for anomalies in account creation patterns, such as mismatches between registered addresses, device fingerprints, and known user behavior. Look for alerts indicating rapid transaction activity on newly opened accounts, especially those linked to compromised credentials. Check for inconsistencies in multi-factor authentication methods or recovery email addresses. Initial containment usually involves freezing the account to prevent further transactions while verifying the legitimacy of the user through out-of-band channels.

Background: Multi-factor authentication

Multi-factor authentication fatigue occurs when users approve too many login requests without verifying the device or location. Attackers exploit this reflex by sending rapid, legitimate-looking prompts. You stop this by teaching users to check device details and by switching to phishing-resistant authentication methods that do not rely on manual approvals.

Read the full guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast

What to do and how to stay safe: Cash App

• Check your credit reports from major bureaus for unfamiliar accounts and consider placing a free credit freeze to prevent new accounts from being opened in your name.
• If you discover an account opened in your name, contact the company’s fraud department through its official website and report the identity theft immediately.
• Keep copies of all reports and correspondence, and request written confirmation when the fraudulent account is closed to protect your legal standing.
• Use a breach-checking service to identify if your email address or phone number has been exposed in known data breaches, allowing you to take preemptive protective measures.

Step-by-step guide: Cloud Logging and Monitoring Best Practices for Detection

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why was Amanda Smith arrested in Pennsylvania?

Police arrested her in Pennsylvania based on account information from Block that linked her Social Security number and date of birth to a Cash App account used in an alleged scam in Arkansas.

Did Cash App help Smith prove her innocence?

No, Smith stated that Cash App refused to provide her with account information because she could not prove she was the owner of the account she denied creating.

How did investigators find the account details?

Investigators obtained the account information, including Smith’s Social Security number and date of birth, directly from Block, the parent company of Cash App.