Easy to Use, Mobile Payment Apps Are Also Easy to Misuse

The use of mobile payment services has surged — along with worries about financial risks.

Services like Venmo and Zelle let people pay others or receive payments almost instantly, with a few taps on their phone. To use them, you typically download the app and link it to a bank account or credit card. Well over half of Americans use the payment tools, according to a 2022 survey by Consumer Reports.

But while they’re fast and easy, the apps can have serious drawbacks. Users can lose money if they accidentally pay the wrong person, mis-type a dollar amount or succumb to a fraud or a scam that tricked them into making a payment. About a quarter of bank customers in an October survey by J.D. Power said they or a close relative had experienced fraud via a peer-to-peer service. And according to Consumer Reports, 12 percent of frequent payment app users reported sending money to the wrong person.

Users are mostly on their own in those situations because payment apps fall into a regulatory “gray area” and lack the robust loss protections of credit and debit cards, said Delicia Hand, director of financial fairness with Consumer Reports. “It’s kind of a user-beware situation,” she said.

In an analysis published this week, the consumer magazine determined that none of the four popular payment apps — Apple Cash, Cash App, Venmo and Zelle — reimburse users when a payment is mistakenly sent to the wrong person, because such transactions are considered “authorized.”

The report said the apps also wouldn’t compensate clients if a criminal tricked them into sending money — perhaps by impersonating someone the users know or pretending to represent their bank — because the users, in a sense, had approved the transaction.

When contacted, representatives of the apps did not directly challenge Consumer Reports’ characterization of their reimbursement policies. But they indicated that they do encourage customers to reach out to them for help if they encounter a problem or suspect fraud.

“Each situation is reviewed on a case-by-case basis, as we strive to help any customer experiencing challenges resolve their issue,” a spokesperson for PayPal, Venmo’s parent company, said in an email.

The apps are more likely to reimburse users when they are the victims of fraud and didn’t actively authorize the payment in any way — such as when their phone or password was hacked or they lost their device. Several cap your loss at $50 if you notify them quickly, but your potential loss may rise to $500 after a few days. And if you wait longer than 60 days, you may get nothing. (Venmo says it covers the full amount if you notify the company within 60 days.)

Representatives of the apps said they had taken steps to protect customers and help prevent payment mishaps, and they urged users to follow advice on the app websites.

All advise using the tools only with friends, family or others who can be trusted, and the apps all include safety reminders or warnings. Apple Cash, for instance, sends a warning if users try to send money to someone outside their contact list. Venmo sends a “flag” if the app detects that the user may not know the recipient. The sender may get a pop-up prompt to verify the last four digits of the recipient’s phone number.

“The security and privacy of all Venmo customers and their information is a top company priority,” PayPal said in a statement.

Formal changes may be coming. Zelle, which is owned by a group of seven big banks through a company called Early Warning Services, is said to be weighing new rules that would reimburse customers duped by certain kinds of scams. And the Consumer Financial Protection Bureau is considering issuing guidance that could make banks bear more liability for customer losses on peer-to-peer transactions.

The report also raised concerns about privacy risks because the apps may collect and share personal information widely, often for “vague” purposes, and some make it difficult for users to delete their data, Consumer Reports said. (Apple Cash states clearly that it does not sell data to third parties, the review found.)

In general, “slow down when using the apps,” said Rachel Gittleman, financial services outreach manager for the Consumer Federation of America. Their speed is handy, she said, but it’s easy to slip up.

Before hitting the button, confirm the recipient’s user name, phone number or email address. “Double, triple and quadruple check” that you are sending the money to the right person, Ms. Hand said.

It’s also wise to send a small “test” payment — say, $1 — and confirm the correct person received it before sending a large sum.

Think of the payments as cash, said Jennifer White, senior director of banking and payments intelligence at J.D. Power. “You would not hand someone you did not know cash, and so you shouldn’t send cash to anyone you are not personally connected with.”

Other tips: Use the identity verification options your app offers, like two-factor authentication, Ms. White said. They may slow things down a bit, but they can help avoid problems.

Check your accounts at least once a week to see if anything looks amiss. And if you no longer use an app, delete it from your phone so it won’t be vulnerable to hacking.

While people may leave funds in the apps indefinitely and use them as a payment source, it’s wise to transfer funds into your own bank account as soon as possible. But consumers may be reluctant to do so quickly since some apps may charge fees for “expedited” transfers, Ms. Gittleman said.

Here are some questions and answers about payment apps:

What should I do if I pay the wrong person by mistake?

The apps offer suggestions on their websites. Venmo, for instance, advises sending the person a request for payment, in the same amount that you paid, along with a note asking the person to repay you the money you sent by mistake. This “may help you get your money back faster” than contacting Venmo support, the website says. If that doesn’t work, the site says, contact support — “and we’ll do our best to help.”

But the do-it-yourself approach depends on the cooperation of the recipient. And some may be skeptical because banks also warn mobile app users to be wary of requests to refund mistaken payments, as they could be fraudulent. The American Bankers Association, for example, advises users to “never” send a payment to someone who says you got an accidental payment via one of the payment services. Instead, it says, contact the payment app about the error.

How can I avoid falling for a potential scam?

Be suspicious of unexpected requests for payments, the Federal Trade Commission advises, such as someone pretending to be a loved one needing quick cash for an emergency. Confirm, by speaking to the person, that the request is real and not from someone who hacked into the person’s account.

Be aware that some scams may use messages that appear to come from your bank or from the transfer app itself. Apple Cash, for instance, warns about scammers posing as Apple tech support claiming to have found a problem with your device. They may ask you to test the device by sending a payment via Apple Cash. “You shouldn’t make this payment,” Apple Cash’s website says.

What should I do if I am a victim of a scam using a payment app?

The American Bankers Association recommends contacting both the app and your bank, as well as the Federal Trade Commission. Complain to the Consumer Financial Protection Bureau and to your state attorney general’s consumer fraud office, Ms. Gittleman advised.