LIVE · cybersecurity feed
Live wire
cash appmedium

Cash App Owner to Pay $45 Million Over Lax Security Claims

Block, Inc., the owner of Cash App, has agreed to pay $45 million to settle allegations that it misrepresented the security protections offered to its users. State attorneys general stated that the company incorrectly claimed Cash App provided the same level of security as traditional banks.

zeroday.news · 24d ago

Block, Inc., the parent company of the Cash App payment service, has agreed to pay $45 million to settle allegations from 46 state attorneys general concerning the app's security practices and user disclosures. The states claimed that Cash App misled users about its security measures, failed to adequately protect them from fraud, and did not provide promised dispute resolution.

According to the allegations, Cash App incorrectly suggested it offered the same protections as traditional banks. State officials stated that the company was lax in its verification standards, lacked a phone number for customer support for an extended period, and used deceptive social media promotions that left users vulnerable to scammers.

Investigators found that the absence of an official customer service phone number led users to search online and inadvertently contact fraudulent numbers set up by scammers. The report indicates that Block was aware of this issue but did not warn users or establish a legitimate phone line until 2021.

Further claims suggest that Cash App's signup process did not require a Social Security number or date of birth, and there was no limit on the number of accounts an individual could create. This, according to the allegations, enabled malicious actors to operate networks of fraudulent accounts. The company also allegedly delayed internal fraud investigations and imposed unwarranted account lockouts, preventing victims from recovering stolen funds.

As part of the settlement, Block is required to maintain live customer support 24 hours a day, with at least 13.5 hours of that coverage provided by a human representative. This agreement reaffirms a separate federal settlement from January 2025, where Block agreed to pay between $75 million and $120 million to states under an order from the Consumer Financial Protection Bureau.

New York Attorney General Letitia James stated that the company failed to assist users who were victims of scams and did not provide the fraud protection mandated by law. Texas Attorney General Ken Paxton noted that Cash App's practices exposed users to fraud and that the company's response to internal investigations and account issues left victims without recourse. Texas is set to receive $5 million from this settlement, while New York will receive $1.6 million, with smaller amounts allocated to states with lesser populations.

Block, Inc., founded by Jack Dorsey, also owns the payment technology company Square and the music service Tidal. As of the announcement, neither Block nor Cash App had released an official statement regarding the settlement.

cash appblock incsettlementsecurity claims
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG

vulnerabilitycritical

Rails patches critical Active Storage flaw with RCE potential

A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). [...]

malware

Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens

Microsoft says Russian hackers hijacked hotel Wi-Fi portals to spread malware and steal Microsoft 365 tokens from travelers. Microsoft Threat Intelligence disclosed CaptiveCrunch, a campaign it attributes to Storm-2945, an operational sub-cluster of Midnight Blizzard, the Russian SVR-linked group also known as APT29 and Cozy Bear. Since early May 2026, Storm-2945 has been manipulating DNS […]

CVE-2026-48449critical

Adobe fixed a maximum-severity vulnerability flaw in Campaign Classic

Adobe fixed a maximum severity vulnerability in Campaign Classic that could let attackers run code remotely without user interaction. Adobe has addressed a critical vulnerability, tracked as CVE-2026-48449 (CVSS score of 10.0), in Adobe Campaign Classic, the company’s enterprise marketing automation platform. The flaw is caused by incorrect authorization and could allow attackers to execute […]

security

Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments

The funding round was led by SYN Ventures, with participation from existing investors DataTribe and TEDCO. The post Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments appeared first on SecurityWeek.

vulnerabilitycritical

Ruby on Rails Patches Critical Vulnerability

The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE). The post Ruby on Rails Patches Critical Vulnerability appeared first on SecurityWeek.