When a stolen identity becomes evidence: CashApp must own this

What do you call a system in which the person whose identity was stolen is the one asked to prove she didn't do it, while the company holding the evidence says she can't see it because she can't prove she owns the account? Efficient, if you're the company. Kafkaesque, if you're her.

That is the situation described by 404 Media. Amanda Smith opened her door one afternoon in April to a sheriff's department in upstate Pennsylvania. They had a warrant for computer fraud, for something allegedly committed in Arkansas, a place she says she has never been. She spent three nights in jail.

According to the report, a scammer got someone on Facebook Marketplace to send $1,000 to a CashApp account that the scammer controlled. The account was opened with Smith's Social Security number and date of birth. She says she has never used CashApp. Six months later, the case is still open, and CashApp reportedly refuses to give her any information about the account because she couldn't prove she was its owner. All of this is her account of events as reported; we haven't seen the charging documents.

An identity is a claim, not a proof

The core mistake here is treating two data points, a Social Security number and a date of birth, as if they were the person. They aren't. They are things that can be known, bought or stolen. If an app accepts them as enough to open an account that moves money, it is making a business decision: low friction, more signups. That is fine until the friction it removed lands on someone else.

And here it landed on Smith. The platform's sign-up check was good enough to open the account, apparently, but not good enough for her to be believed when she says it isn't hers. In our view, that asymmetry is the whole story. The company trusted the identity when it was convenient and distrusts the real person when she asks questions.

The Catch-22 is a design choice

Look at the loop. To see the account's data, she must prove she owns it. She doesn't own it, which is precisely her defense. So the one record that might help clear her, such as how it was opened or where it was accessed from, stays out of her reach. Privacy rules exist for good reasons, but a policy that locks out the person whose name is on the account in a criminal case isn't protecting her privacy. It's protecting the company's process.

Prosecutors deserve their share of scrutiny too. An arrest warrant issued across state lines for a woman who, by her telling, was never near the scene suggests that a name on an account was treated as a strong link. We think the sensible reading of a payment-app case should begin with the question "could this be identity theft?" That is hardly exotic in a world where, as Cash App's own safety page says, impersonation scams are the most common type of fraud reported to the FTC.

Who should carry the burden

Cash App's guidance tells users that scams work because they are designed to bypass people's instincts, and that falling for one doesn't make you naive. We agree. But the same logic should apply upward. Smith didn't fall for anything. She didn't even use the product. If a fraud-prevention story puts so much weight on user vigilance, it can't also tell a person who never signed up that she should have prevented this.

What would a fair rule look like? Our proposal, as opinion rather than law: when a platform is told that an account may have been opened with stolen credentials, it should be obliged to preserve the records and share them with the named person and with investigators quickly, and it should flag to law enforcement that identity theft is plausible. Companies that profit from easy onboarding should fund the cost of verifying who is actually behind an account, and absorb the cost when they don't.

Verdict

Smith's case is one account, and we don't know how the case will end. But it's trending for a reason: almost everyone reading it can imagine their own Social Security number sitting in someone else's sign-up form. Until payment apps are held responsible for who they let in, the cheapest suspect will keep being the name on the account. That is backwards. The party that designed the door should answer for who walked through it.