A scammer opened a Cash App account with her Social Security number, and she's the one charged with computer fraud

The sheriff’s deputies showed up at Amanda Smith’s door in upstate Pennsylvania one afternoon in April, holding an Arkansas warrant for computer fraud. She’d never been to Arkansas.

“I was completely confused,” Smith told Joseph Cox at 404 Media, who reports that by her own admission she “was not a very tech savvy person.” They let her grab her contact lenses. Then she went to the local jail in handcuffs and stayed three nights.

The case behind the warrant was a Facebook Marketplace scam. A buyer was tricked into sending $1,000 to a Cash App account in Smith’s name that, per 404 Media, the scammer controlled, set up with her Social Security number and date of birth. Smith says she has never used Cash App.

So the name on the account pointed at her. The one company that knows who actually opened it, and from where, is Cash App, which “refuses to provide her any information about the account because she couldn’t prove that she was the owner.”

To clear her name she needs the account’s records, and to get the records she’d have to claim the account she’s trying to prove was never hers. 404 Media’s headline says she faces years in prison, and the case is still open.

Why it matters

Anybody can type your name into a sign-up form. All it takes is the Social Security number and birth date to go with it. When that account becomes evidence, the person those numbers belong to inherits the scammer’s paper trail, and the police come to their door.

Arkansas already said the sign-up was easy to abuse. In July, Arkansas Attorney General Tim Griffin announced a $45 million multistate settlement with Block, Cash App’s parent, brought by “my office, along with 45 other attorneys general.” The release states, “Block’s sign-up process was designed to be fast and frictionless, with minimal identity verification.” Arkansas’s share is $453,754.

The settlement covers users. Block has to keep support that can “resolve fraud complaints, account lockouts, and other problems” and “investigate fraud claims and reimburse users for unauthorized transactions.” The release lists no requirement covering a person whose identity was used to open an account they never touched.

Steal this

If police, a debt collector or a court ever names an account you never opened, ask your lawyer about getting that account’s sign-up records (IP address, device, linked bank card) through the case itself, since the company may refuse to talk to you directly. It’s like asking the hotel for the security tape instead of arguing with the clerk about whose name is on the room.
On Facebook Marketplace, pay at pickup, in person, after you’ve seen the item. The name on a payment account tells you nothing about who gets the money, and the $1,000 buyer in this story learned that the expensive way.
If you build sign-up flows, keep the device, IP address and verification results from account creation for as long as the account exists. That record is what clears the person whose name a fraudster borrowed. Kind of like a notary’s logbook, boring right up until somebody’s freedom depends on it.

Payment apps tend to treat “who is this account” as a fraud-team question about money, settled between the company and its own customer. Smith’s case shows the other side: the person whose identity was borrowed isn’t a customer, so there’s no door for her to knock on.

That’s the gap the next round of attorney general complaints is likely to aim at, since the July settlement covered phone support and fraud claims for users but said nothing about people outside the app. Somebody, a court, a regulator or Block itself, will have to decide whether the person named on a fraudulent account gets to see it.

The nearer question is Smith’s. If her defense pries the account’s sign-up records loose, they’ll show which phone and which network opened an account in her name, and whether anyone checked before the warrant went out.

More Security