Square's security is solid for most transactions, but safety depends on how you use it

Square uses encryption, fraud detection, and PCI compliance to protect card data during payment processing. Your card information is encrypted before it leaves your device, and Square doesn't store full card numbers on their servers. For peer-to-peer payments through Square Cash (now called Cash App), the app uses similar encryption and requires identity verification for larger transfers.

That said, Square's safety record is not perfect. The company has experienced data breaches—most notably in 2019 when attackers accessed some seller accounts through credential stuffing (using stolen passwords from other services). Square also processes payments for high-risk merchants, which means scammers sometimes use Square to collect money from victims. Your risk depends on whether you're sending money to someone you trust, paying a legitimate business, or transferring to an unknown recipient.

Key Takeaways

  • Square encrypts card data in transit and complies with PCI standards, making it safe for legitimate transactions with known merchants.
  • Square has experienced breaches in the past, so using a unique, strong password on your Square account reduces your personal risk.
  • Scammers actively use Square to collect payments, so never send money to someone you don't know or haven't verified through another channel first.
  • Square offers buyer protection for certain transactions, but coverage is limited and you must report fraud within a specific timeframe.
  • If you're paying a business, confirm their Square account directly with them before sending money—don't rely on links in emails or texts.

How Square protects your card information

When you enter a card number into Square—whether through their app, website, or in-person reader—the data is encrypted using TLS (Transport Layer Security) before it leaves your device. This means the card number is scrambled and unreadable to anyone intercepting the transmission. Square also tokenizes your card, converting it into a unique identifier that merchants can use for future charges without storing your actual card number.

Square is PCI DSS compliant, which means they meet the Payment Card Industry Data Security Standard. This is a set of requirements enforced by Visa, Mastercard, and other card networks. Compliance includes regular security audits, encryption requirements, and restrictions on who can access card data. Square's compliance is verified by third-party assessors, not just by Square itself.

However, compliance does not mean breaches never happen. In 2019, Square disclosed that attackers accessed some seller accounts by reusing passwords from other data breaches. The attackers didn't steal card data directly—they accessed seller dashboards and transaction history. Square notified affected sellers and required password resets, but the incident showed that even compliant companies can be targeted.

Fraud detection and dispute resolution

Square uses machine learning to flag suspicious transactions in real time. The system looks for patterns like unusually large purchases, transactions from new locations, or rapid repeated charges. If a transaction is flagged, Square may decline it or ask for additional verification. This catches some fraud before it completes, but not all.

If you're the buyer and a transaction is fraudulent, your options depend on the payment method. If you paid with a credit or debit card, you can dispute the charge with your card issuer—this is separate from Square and usually takes 30 to 90 days. If you sent money through Cash App or Square's peer-to-peer service, Square offers a dispute process, but coverage is limited. Square states that peer-to-peer payments are generally not reversible, especially if you sent money to someone you know or authorized the transfer yourself.

The key difference: card disputes are handled by your bank or card network, which has strong buyer protections. Peer-to-peer disputes are handled by Square, which has weaker protections because these transfers are meant to be final once sent.

When scammers use Square to collect money

Scammers frequently use Square to collect payments because the platform is easy to set up and doesn't require extensive business verification. A scammer can create a Square account, generate a payment link, and send it to victims within minutes. Common scams include fake rental listings, job offer scams, and romance scams where the scammer asks for payment through Square.

If you send money to a scammer through Square, recovery is difficult. Square's dispute process for peer-to-peer transfers is not designed to reverse payments to unknown recipients. Your best protection is to never send money to someone you haven't verified through a separate, trusted channel. If a rental listing, job offer, or person you met online asks you to pay via Square, that is a red flag.

If you've already sent money to a scammer, report it to Square immediately through their app or website. Square may be able to freeze the recipient's account and recover funds if the money hasn't been withdrawn yet. You should also report the scam to the FTC at reportfraud.ftc.gov and to your local police, though recovery is unlikely.

Protecting your Square account from unauthorized access

Your Square account is only as secure as your password. If you reuse your Square password on other websites and one of those sites is breached, attackers can use that password to access your Square account. This is exactly what happened in the 2019 breach mentioned earlier.

Use a unique, strong password for Square—one you don't use anywhere else. A strong password is at least 12 characters and includes uppercase letters, lowercase letters, numbers, and symbols. If you use a password manager like Bitwarden, 1Password, or Dashlane, it can generate and store a unique password for you.

Enable two-factor authentication (2FA) on your Square account if you're a seller. This requires a second form of verification—usually a code from an authenticator app or a text message—when you log in from a new device. 2FA makes it much harder for attackers to access your account even if they have your password.

Differences between Square, Cash App, and Square's business payment tools

Square operates several payment services, and security varies slightly between them. Cash App is the peer-to-peer service for sending money to friends and family. Square Online is for businesses accepting payments on a website. Square Reader is the in-person card reader for small businesses. Each has different security features and different levels of buyer protection.

Cash App transfers are encrypted and require identity verification for larger amounts, but once money is sent, it's difficult to reverse. Square Online stores card data on Square's servers (encrypted), so your customers' card information is not stored on your website. Square Reader encrypts card data at the point of swipe, so the card number never touches your phone or register unencrypted.

For business payments, Square's security is stronger because merchants are verified and their accounts are monitored for fraud. For peer-to-peer payments, security is good, but buyer protection is weaker because these transfers are meant to be final.

What to do if you suspect fraud on your Square account

If you notice a transaction you didn't authorize, act quickly. Log into your Square account and review your transaction history. If you're a seller, check your deposits and look for unfamiliar transfers. If you're a buyer, check your card statement for charges from Square.

Contact Square's support team through the app or website and report the unauthorized transaction. Provide details about the transaction—the amount, date, and merchant or recipient. Square will investigate and may freeze the account if fraud is confirmed. If you paid with a card, you can also dispute the charge with your card issuer, which often has a faster resolution.

Change your Square password immediately and enable two-factor authentication if you haven't already. If you reuse your password on other websites, change those passwords too. Check your other financial accounts for unauthorized activity.

Frequently Asked Questions

Can someone hack my Square account if they have my email address?

No, they need both your email and password. However, if you reuse your password on other websites and one of those sites is breached, attackers can use that password to access your Square account. Use a unique password for Square and enable two-factor authentication to prevent this.

Is it safe to pay a business through a Square payment link?

Yes, if the business is legitimate and you initiated the link yourself. Verify the link directly with the business—call their phone number or visit their website—rather than clicking a link in an email or text. Scammers send fake payment links that look like they're from real businesses.

What happens if I send money to the wrong person through Cash App?

Cash App transfers are generally final once sent. If you sent money to the wrong person, contact them and ask them to send it back. You can also report the transaction to Square, but they cannot reverse peer-to-peer payments. If the recipient refuses to return the money, you have limited options for recovery.

Does Square protect me if I'm scammed?

It depends on the type of payment. If you paid with a credit or debit card, your card issuer offers fraud protection and can reverse the charge. If you sent money through Cash App or peer-to-peer transfer, Square's protection is limited. Square may freeze the recipient's account if you report fraud quickly, but recovery is not may provide.

Is Square safer than PayPal or Venmo?

All three use encryption and fraud detection, so security is comparable. The main difference is buyer protection: credit card disputes offer strong protection, while peer-to-peer transfers on any platform (Square, Venmo, PayPal) offer weaker protection. Choose based on the type of transaction and who you're paying.