How to use money transfer apps safely

Peer-to-peer (P2P) payment services can make splitting bills with friends and paying for goods or services easy and convenient. Money transfer apps — like Venmo™ and PayPal™ — allow users to send money from their mobile devices through a linked funding source.

But their convenience is why scammers find them so attractive. Unfortunately, digital money movement fraud is rising, and it can be difficult to trace and recover funds.

Here's what you should know about how P2P apps work and mobile payment security.

How do money transfer apps work?

P2P money transfer apps let you send money conveniently — like a wire transfer but without the hassle of going into a bank or paying wire transfer fees. Transfers are usually made and received in minutes and can be tied to a phone number, email address or debit card.

Let's say you need to give your sister money for your parents' anniversary gift. You would open the mobile payment app, select your sister from your contacts and enter the amount you want to send. Within a few moments, she'll receive a notification that you've paid her. Your sister can then leave the money in the app or transfer it to her bank account.

Are money transfer apps safe?

P2P payment apps are generally considered safe, but they're not foolproof. A mistake could cost you when sending money.

With P2P payments, it’s important to understand that you may not get that money back. Payments you authorize to send may not be recoverable in the network. It’s best to treat a P2P app like you are using cash.

"Sending P2P payments is an electronic version of offering cash as payment. You want to ensure you know exactly who you are sending the payment, that you have their accurate ‘token’ (user name, phone number) to receive the funds, and you are not engaged in a scam. Criminals use P2P payments to get funds and move them across accounts quickly. Be extra vigilant in sending P2P payments. If you wouldn’t trust giving this person the same amount in cash, you should confirm the payment,” explains Jen Martin, Senior Vice President and Head of the Fraud and Claims Department at Citizens.

All apps aren't created equal. Each has varying security measures in place to help prevent honest mistakes and dishonest fraud. It's important to do your research before choosing an app.

So, is there risk involved with mobile payments?

P2P apps are easy to use and secure, but unfortunately, scams are possible. Criminals can impersonate a bank and make you believe your account is in jeopardy or pose as a business asking for payment for a product you never received.

"The primary risk today is bad actors contacting customers via call, text or email pretending to be from their bank or a company they do business with and convincing the customer to provide information like online banking credentials or a one-time passcode, which we would never request unless the customer initially contacted us, not if we contacted them," Martin notes.

4 mobile payment security risks to watch for

1. Public Wi-Fi networks

You should never do online banking or anything sensitive using public Wi-Fi. These open networks could allow others to monitor and potentially hack into your device based on security vulnerabilities. By connecting to public Wi-Fi, you are broadcasting your web activity even if you aren't aware.

2. Phishing scams/social engineering

Phishing and social engineering are common security risks that occur mostly through email and text. Someone may pretend to be a reputable organization or individual and request sensitive information from you via a link that takes you to a fraudulent copycat website with the intent to steal your login credentials or other sensitive information. It's important to verify the email address hidden behind a display name requesting you input login information or reset your password or claiming that fraudulent activity has taken place on your account. Similarly, it's important to verify the number you receive from text alerts claiming to be your bank, a P2P transfer confirmation and even your social media accounts.

3. Losing your phone

Many times, our phones are the keys to our digital lives and wallets. We authenticate activity via security codes, apps or text messages that grant us access to social media, banking accounts and more. If you lose your phone, it's important to immediately take action to shut it down remotely, replace it if necessary and detach access to payment sources and accounts connected to your phone number.

4. Password problems

It can create security risks via security leaks if you tend to use the same passwords for multiple accounts or don't regularly change your passwords. Also, using passwords that are too simple or easily guessed is a risk to your security. It's important to adhere to the security recommendations in crafting a password but also make sure not to overuse that password in multiple locations to limit the exposure risk that comes with a compromise.

How can I protect myself when sending money?

While "quick and easy" is the basic premise for P2P, taking a few extra seconds to enable security features can save you a lot of stress and money.

Here are a few things you can do to help protect your money:

• Enable additional security settings. Many apps will default to the lowest security settings, which means if someone has your phone, they may be able to send money to anyone without being asked for a PIN, fingerprint or password.
• Double-check the recipient's info. Before you press send, confirm the username, phone number, photo or other identifier. Some platforms offer to send a special code to confirm that the person you're sending money to is your intended recipient.
• Turn the notifications on. Some platforms do this automatically. If not, go to the app's settings and turn on notifications. You'll get an email or text anytime there's a transaction on your account.
• Use two-factor authentication or an authentication app. With two-factor authentication, you receive either an email or text message with a code to enter in addition to your password to verify your identity within a certain amount of time. Authentication apps display a rotating security passkey that you enter at the same time as your password. This creates a double layer of security because you usually have to have your own phone, tablet or laptop to get the code. Do not give out two factor authentication codes to someone who calls you for them. A common P2P fraud scheme is a bad actor calling you claiming to be the Citizens Fraud Department and that you have fraud on your account.  They will ask you for your personal information and two-factor authentication code. Citizens will not call you in this way for suspected P2P fraud and will not allow the transaction to process. You must call Citizens instead to process the payment.

These variables can increase not only your mobile payment security but also your overall security when using technology.

What can you do if you fall victim to a scam?

As much as you like to think you're staying a step ahead, things happen.

"If a customer feels that they have been a victim of a scam, they should contact their bank immediately to attempt a recall on the payment and remove the payee from their app. They should change user names/passwords/PINS for online banking and mobile applications, and have impacted accounts reissued."

What to remember

Money transfer apps are a great way to simplify your life — if you use them safely. It's important to do some research and find an app that you trust. Unfortunately, fraud happens, so do your best to safeguard yourself and your personal information when sending and receiving money.

Learn more about digital banking with the Citizens mobile app*.