Fake Customers Appearing in Customer Directory

[ccc4me]

I have 3-5 new fake customers per day getting added to my Square Customer Directory. This has been going on for months, and I finally caught on after noticing my marketing subscription cost seemed to be rising astronomically due to the number of "subscribers."

I spoke to Square technical support about the issue, and they were completely useless. After an hour on the phone, all they could do was escalate my issue to another department. A day later, that department sent me a generic form message advising me to turn on "3D Secure", which was already turned on. I responded to that email and then they never answered back. 

I'm at my wit's end with this problem. I've already disabled the only online payment form that I have, and the issue has continued, so I've been resigned to just deleting fake customers every single day. All of them follow the same pattern - random first and last names recycled over and over with email addresses that have the first name and then some random numbers after them (see screenshot below). They all come from a "third-party" source. Is anyone else having this issue? It is so completely frustrating that Square's technical support is no longer helpful, and I have to resort to this community for every seemingly straightforward problem. Any tips would be appreciated. 

[Candlestore]

@ccc4me ;

I would contact the 3rd party that is having these fake accounts added to your Square Directory.  Since they are the ones that keep adding the fake accounts.

[ccc4me]

I would love to do that, but I have no idea who the 3rd party is. Square just says a "3rd party" is the source of the customer, but doesn't provide me with any further details beyond that. 

[Candlestore]

@ccc4me ;

You may have to check all settings for all your Third Party apps.

Meaning if you use Doordash check with them to see if they sign people up or if there is a setting in their app for that. Then go to your next 3rd party and do the same.  This is one reason I do not like having all 3rd parties connected to everything because its difficult to see which ones are doing what.  

Square would assume that since you gave the 3rd party app access to add customers you would know which one that is.  

Anyway to track which customers came from which app through the app of the 3rd party?

Like go to the 3rd party and see if they have the subscriber you posted above as a customer to you?

Good luck at figuring out where these are coming from.

If you need more help maybe call support at my number below, let them know and see if they can get someone to figure out which integrations are adding customers.

[ccc4me]

Thanks for the tips. I believe the only third party I have linked to my square account is Zapier.  I also searched and searched in the square administration pages and couldn’t find anyplace where it would simply list what integrations are currently active. Most other cloud based services do this, and I don’t understand why square wants to handcuff its customers from being able to perform a basic security audit of their account - especially when their customer service has gone downhill so much. In any case, I will

keep trying, thanks for your help! 

[ACEtutor]

Hi, Did you ever resolve this issue? I am having the same issue. I have deleted my online payment form on my website, the only possible third party source.  The issue continues. I have resorted to deleting everyday, which I really don't have time for. 

Thanks in advance for your feedback.

Robin

[MayaP · Accepted solution]

Hi @ACEtutor - I see this is your first post in the Seller Community, so I'd like to officially welcome you! 🎉👏

Your third-party software could certainly be the culprit. You can check any integrations you have connected through your dashboard under My Applications. If you continue to have issues I would reach out to support, so we can look into this further. 

[ACEtutor]

Thank you for this information. 

[ccc4me]

Actually, after weeks of fruitless back and forth with Square support, the issue just suddenly stopped in mid-December. I highly doubt anything they suggested or did actually helped, as they were still in the process of "escalating" my issue at that time. The only thing I can think of is that perhaps the more draconian measures I took in the "Risk Manager" finally discouraged the scammers. I set it up to block all $1 payments and all foreign credit cards.  I'm still getting hit with 100 fraudulent payment attempts per month even though I have absolutely NO third party integrations nor any payment forms where people can even type in a custom amount. Square's security (and their tendency to try to blame these problems on their users) seems to be completely inept, Maddening, considering how great a platform it is otherwise. 

[ACEtutor]

Thank you for your reply. I will be vigilant and patient and hope my issue stops. 

[RKLMT]

I recently noticed that I'm having the same issue. Support sent me a generic response that answered ZERO questions or concerns. I just figured out how to disconnect the third-party apps. Luckily, I do not have a marketing subscription or any of the extras beyond the free software. So I'm not having much of an issue aside from 200-some random names in my customer list. But my mind keeps questioning WHY is this happening to my business. I've actually tried calling some of the recently added customers, and literally no one answers the phone or it's not a working number. 3 of the recent additions were numbers from Canada. I can easily delete these fictitious profiles but it is tedious work, unless I bulk delete the filtered list. If anyone can offer perspective or pointers, I'm all ears!

[ACEtutor]

I found that they are connected to attempted fraudulent charges. It seems someone is using my square account to make fraudulent charges to credit cards. The bank has declined these charges but the contact info is added to my directory.  I have gone through the list and deleted/blocked all of the credit cards and the ip addresses used. I am still getting these. Some are being blocked but some are still getting through.  I don't know what else to do but to keep deleting and blocking. Im up to over 100 in the last 2 months. I have received no help from square.  They don't see this activity on their end.

[ccc4me]

That's what I discovered too. I just deleted 158 new fake customers. All in the format "firstname.lastname@gmail.com/yahoo.com/hotmail.com". All of them last visited "Never". In my case, the fraudulent charges usually don't even go through (they get blocked by my risk manager). Yet somehow the people attempting them still get added to the customer directory. Very convenient that Square Marketing charges you based on how many customers you have, and at times is charging me more money for the fake customers entering the system due to a vulnerability they have yet to fix. 

[tifholmes]

Just adding a comment here (in addition to here: https://www.sellercommunity.com/t5/Square-Appointments/What-are-third-party-created-customers/m-p/71...) to escalate this issue. I'm also gaining a few dozen new subscribers each day. No idea how. The only "third party" plugins I have remaining are for the Square Seller Community. I've removed everything else. No forms on my site. No more gift cards. I'm at a loss as to how they're adding these fake subscribers, and it's very troublesome to me. 

[ccc4me]

Totally agree, especially because it's a sign of a potentially serious IT security vulnerability in their platform that they are not addressing. At this point I'm contemplating writing a letter to directly to Square's board. Maybe that will get their attention. 

[ACEtutor]

This is my last comment here regarding this issue. I will take this on to someone higher if I can figure out who/where. I will also begin researching other options to Square.  Their lack of response to this issue is very troubling.  I have made every effort I can to keep my data safe. It is their job to do the same.  Some one is using our square accounts to defraud others. It may not be doing much damage to us monetarily but it is certainly annoying/time consuming.  It has made me lose confidence in Square's ability to keep my information secure.  I do not want a generic post guiding me through some tips to keep my site safe. I have done all I can (and should have to) do. I would really like a response here with some real answers, if not a direct contact to me personally. I want to know how they will fix the issue in order to keep my business. I will not wait long.