Security

A stolen SSN pinned a $1,000 scam on the wrong woman; Block settled Cash App fraud claims for $12 million

A Pennsylvania woman faces six years over a scam account opened with her stolen SSN, and Block has agreed to a $12 million settlement over Cash App's fraud controls, all in the same week its analysts see a rerating ahead.

Vincent JiangVincent Jiang · 3 min read
Share
Jack Dorsey, Block's co-founder and chief executive, testifying before a Senate committee in Washington in September 2018
1 / 6Slide 1 of 6
Jack Dorsey, Block's co-founder and chief executive, before a Senate committee in September 2018. The same week Block agreed to a $12 million settlement over Cash App's fraud controls, BMO upgraded the stock to Outperform.

Amanda Smith, 47, was arrested at her Pennsylvania home in April on a warrant out of Arkansas, a state she says she has never visited 23. The charge: computer fraud in a $1,000 Facebook Marketplace scam 23. The evidence against her was a Cash App−2.64% — Cash App, down 2.64 percent today account, $Smithy5687, opened at the end of January with her Social Security number and date of birth 23. That was enough for investigators to put her name on the case. 23

She spent three nights in jail. Her lawyer, Jason Horton, is moving to dismiss before trial; a hearing comes in November, and Smith has refused a plea deal carrying three years of probation for a crime she says she did not commit. 23

The records pointed at her, everything else pointed away

Investigators got the account records from Block, Cash App's parent company, under a search warrant. What came back implicated her by SSN and birth date, but the rest of the record points elsewhere. The account ran iOS 16.1.1 on a Verizon−1.49% — Verizon, down 1.49 percent today mobile IP; Smith's iPhone 13 mini runs iOS 26.5.2 on AT&T−6.75% — AT&T, down 6.75 percent today, where she has never been a Verizon customer. 23

The Philadelphia address on the account is not one she or her husband ever lived at. A Venmo account under a different name used the same phone number a week earlier. When Smith herself asked Cash App for information, the company refused: she could not prove she owned the account. Block did not respond to questions about how it verifies who is behind an account. 23

The same week, Block put a price on its identity checks

On October 9, plaintiffs David Tucker and Lucille Moragne asked the Northern District of California to preliminarily approve a $12 million settlement of a class action alleging Block failed to maintain the Bank Secrecy Act's identity checks, transaction monitoring and suspicious-activity reporting on Cash App 1. Block won dismissal in December 2025, lost on the amend, and settled after a June mediation and twelve more weeks of talks. 1

Roughly 160 million current and former users get a notice email; Judge Maxine Chesney takes up the motion on November 13. 1

The $12 million fraud fund sits inside a loss line Block reports every quarter

  • Estimate
0200400600Proposed fraud settlement fund12Street: Q3 transaction and loan losses559BMO: Q3 transaction and loan losses569BMO Borrow gross profit tailwind180–400
Data
ValueRange
Proposed fraud settlement fund12—
Street: Q3 transaction and loan losses559—
BMO: Q3 transaction and loan losses (estimate)569—
BMO Borrow gross profit tailwind (estimate)180180–400
Millions of US dollars. The settlement fund is proposed, pending a November 13, 2026, preliminary-approval hearing. Q3 loss figures are analyst models for Block's third quarter, not reported results. The Borrow tailwind is BMO's estimate for next year, shown as the $180 to $400 million range the firm states. Sources: Claim Depot (2026), Investing.com via Yahoo Finance (2026).1,4

The bull case and the fraud docket land in the same month

BMO upgraded Block to Outperform on October 22 with a $101 target, modeling third-quarter transaction and loan losses of $569 million against the Street's $559 million 4. If Cash App Borrow's loan limits are recalibrated through 2027, the firm estimates the six-week loan structure could add $180 million to $400 million of gross profit next year, with the stock's multiple stuck at 15 to 18 times earnings since February. 4

The ledger cuts both ways: an account opened with a stranger's SSN and birth date was enough to identify Smith, and the same identity checks sit under the class action. The $12 million fund prices what juries charge when that control fails, and Smith's case shows the cost can land on the customer, not the shareholder 41. Watch Block's third-quarter transaction and loan losses, modeled by BMO at $569 million 4, then the November 13 approval hearing. 1

What happens next

XYZ

Whether the fraud charges are dropped before trial, and whether she accepts the three-year probation plea deal she has so far refused

The case for

BMO upgraded Block to Outperform on October 22 with a $101 target

The case against

The $12 million settlement alleges Cash App skipped the Bank Secrecy Act's identity checks, transaction monitoring and suspicious-activity reporting

  1. November 2026Hearing on the motion to dismiss the charges against Amanda Smith.
  2. Fri Nov 13, 2026Preliminary-approval hearing on the $12 million Cash App class action settlement. Whether Judge Maxine Chesney preliminarily approves the $12 million fund and the notice to roughly 160 million users

Get our follow-up when these land

Free. We'll email you when we publish on Block, and send our free weekday newsletter. Unfollow in one click.

Loading XYZ…

Reader comments

0 comments

    More in Security

    All in this topic →

    Security

    Tenable gave PHP's 9.2 flaws its highest rating, then patched PHP out of its own scanners

    The Nessus maker gave the PHP2Shell flaws its highest concern rating, then spent October 22 patching PHP out of its own appliances. Its next bet is selling exposure data to AI agents; one launch partner already runs an autonomous security center on top of it.

    Security

    CrowdStrike says four hacking groups now run AI agents on their own; its AIDR line grew 79-fold

    CrowdStrike's threat-intelligence unit has documented four hacking groups running AI agents as autonomous operators. The same firm sells the detector, and the early-December fiscal Q3 print is the first dollar test of whether documented fear becomes disclosed revenue.

    Security

    Zscaler hit the Street's $233 target before its new sales chief reported a quarter

    An AI-found flaw in PHP, eleven price-target raises and a $270 bull call have carried ZS back to the Street's $233 mean at 47 times forward earnings. Late November brings the first quarter under the sales chief who inherited the machine.

    Security

    AI found the flaw under most of the web; Fastly is selling a wall it has not finished

    PHP shipped emergency patches on October 21 for two flaws found by AI audits, with attacks already visible on Fastly's network. The company selling the filtering launched its network-layer shield a week earlier with the automated engine unfinished and no price published.

    Security

    Palo Alto Networks has no PAN-OS fix for PHP2Shell, calls it 9.2 and sells a paid virtual patch

    Every version of Palo Alto's PAN-OS firewall software is on the PHP2Shell affected list with no fix shipped. The company scored its own products a notch below the emergency number its blog uses to sell virtual patching.

    Security

    Fortinet's customers must patch blind: fixes shipped October 22, flaws named November 10, earnings October 28

    Fortinet shipped fixes for five product lines on October 22 and will not name the flaws until November 10, thirteen days after its earnings report. Its own chief information security officer says AI can turn a released patch into a working exploit within hours or days, and that makes the wait itself the exposure.

    Get the newsletter

    The day's AI and market news, in your inbox every weekday.