Mobile payment apps are easy to misuse

The use of mobile payment services has surged — along with worries about financial risks.

Services like Venmo and Zelle let people pay others or receive payments almost instantly, with a few taps on their phone. To use them, you typically download the app and link it to a bank account or credit card. Well over half of Americans use the payment tools, according to a 2022 survey by Consumer Reports.

But while they’re fast and easy, the apps can have serious drawbacks. Users can lose money if they accidentally pay the wrong person, mistype a dollar amount or succumb to a fraud or a scam that tricked them into making a payment. About a quarter of bank customers in an October survey by J. D. Power said they or a close relative had experienced fraud via a peer- topeer service. And according to Consumer Reports, 12% of frequent paymentapp users reported sending money to the wrong person.

Users are mostly on their own in those situations because payment apps fall into a regulatory “gray area” and lack the robust loss protections of credit and debit cards, said Delicia Hand, director of financial fairness with Consumer Reports. “It’s kind of a userbeware situation,” she said.

In an analysis published recently, the consumer magazine determined that none of the four popular payment apps — Apple Cash, Cash

App, Venmo and Zelle — reimburse users when a payment is mistakenly sent to the wrong person, because such transactions are considered “authorized.”

The report said the apps also wouldn’t compensate clients if a criminal tricked them into sending money — perhaps by impersonating someone the users know or pretending to represent their bank — because the users, in a sense, had approved the transaction.

When contacted, representatives of the apps did not directly challenge Consumer Reports’ characterization of their reimbursement policies. But they indicated that they do encourage customers to reach out to them for help if they encounter a problem or suspect fraud.

“Each situation is reviewed on a case- by- case basis, as we strive to help any customer experiencing challenges resolve their issue,” a spokesperson for Paypal, Venmo’s parent company, said in an email.

The apps are more likely to reimburse users when they are the victims of fraud and didn’t actively authorize the payment in any way — such as when their phone or password was hacked or they lost their device. Several cap your loss at $ 50 if you notify them quickly, but your potential loss may rise to $ 500 after a few days. And if you wait longer than 60 days, you may get nothing. ( Venmo says it covers the full amount if you notify it within 60 days.)

Representatives of the apps said they had taken steps to protect customers and help prevent payment mishaps, and they urged users to follow advice on the app websites.

All advise using the tools only with friends, family or others who can be trusted. The apps all include safety reminders or warnings. Apple Cash, for instance, sends a warning if users try to send money to someone outside their contact list. Venmo sends a “flag” if the app detects that the user may not know the recipient.

Formal changes may be coming. Zelle, which is owned by a group of seven big banks through a company called Early Warning Services, is said to be weighing new rules that would reimburse customers duped by certain kinds of scams. And the Consumer

Financial Protection Bureau is considering issuing guidance that could make banks bear more liability for customer losses on peertopeer transactions.

Think of the payments as cash, said Jennifer White, senior director of banking and payments intelligence at J. D. Power. “You would not hand someone you did not know cash, and so you shouldn’t send cash to anyone you are not personally connected with.”

Other tips: Use the identity verification options your app offers, like twofactor authent icat ion, White said. Check your accounts at least once a week to see if anything looks amiss. And if you no longer use an app, delete it from your phone so it won’t be vulnerable to hacking.