VeriFone Calls Out Potential Security Flaw in Square's Mobile Phone Payment App

VeriFone, the large publicly held company that makes cash registers and other payment processing devices, has issued a scathing open letter about Square, the San Francisco start-up that has gotten a lot of press recently for offering a solution to small merchants using a mobile phone.

In the letter, VeriFone’s CEO Doug Bergeron called it a “wake-up call to consumers and the payments industry….Seems like a great idea, but there is a serious security flaw that Square has overlooked that places consumers in dire risk.”

To help illustrate the vulnerability, VeriFone said it took an hour to write a test app that could steal financial and personal information right off a credit card’s magnetic stripe using Square’s card reader.

We’ve reached out to Square for comment and have not heard back. We’ll update the post as soon as we do. [Update: Square’s response can be found here.]

So, in the interim, the question is, is this a publicity stunt, or are there real threats with what Square is doing?

VeriFone claims the issue is that Square’s hardware is poorly constructed and lacks the ability to encrypt consumers’ data. In essence, there’s no way to verify that the Square dongle is connecting with the real Square application and not some knock-off. VeriFone wants Square to recall the dongles from the market.

Square said last week that it is now processing more than $1 million in transactions a day. The company, which was started by Twitter founder Jack Dorsey, recently raised $27.5 million in capital. In a recent interview we conducted with Dorsey, he explained Square’s vision to replace everything from the receipt to the register.

The open letter can be found at, where VeriFone has gone the extra mile to make the fake application available to anyone. It is also sending a copy of the app to Visa, MasterCard, Discover, American Express, and JP Morgan Chase (Square’s credit card processor) to invite their comments.

Latest Video

View all videos »

Search »

The problem with the Billionaire Savior phase of the newspaper collapse has always been that billionaires don’t tend to like the kind of authority-questioning journalism that upsets the status quo.

— Ryan Chittum, writing in the Columbia Journalism Review about the promise of Pierre Omidyar’s new media venture with Glenn Greenwald