Consumer complaint received 2022-09-28
Company: Block, Inc.
State: CO
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Other features, terms, or problems
Sub-issue: Privacy issues

Complaint:
A month ago I visited a friend in another state, and he ordered food to-go online from a restaurant 's webpage. When we arrived, I used my credit card to pay for the food using the restaurant 's SQUARE payment terminal/register. 

A few weeks later after I returned to Colorado my friend emailed me asking whether I had a credit card ending in XXXX. I said yes but why. Then my friend told me he had been receiving numerous emails for the last few weeks of all of my transactions at SQUARE payment terminals in coffeeshops, bakeries, etc. 

I called my credit card company and said they didn't have my friend 's email listed on my credit card. 
At no time had I given SQUARE my friend 's email address, nor had I given them permission to email me, or him my receipts. In fact I always push the no recipe button at the end of every transaction. 

For some reason, SQUARE 's Artificial Intelligence system had taken it upon itself to associate my credit card number with my friend 's email ( possibly getting it from the restaurant 's online ordering system??? ) and started sending my credit card transaction data to him WITHOUT MY PERMISSION! God only knows how many other strangers my credit card data may be going out to as well. 

My friend forwarded a copy of one of the numerous emails he had gotten, and there is a link to push at the bottom of the email saying " not my receipt ''. I pushed that button and it takes you to a FAQs webpage for SQUARE and then below that it asks you to sign in. My friend had never signed up for an account with SQUARE, so he had no reason to sign into an account he didn't have a password for. In any case, WHY AM I DEPENDENT ON MY FRIEND, LET ALONE A STRANGER TO JUMP THROUGH ALL THESE HOOPS TO PRESERVE MY DATA PRIVACY????!!!!!!!!!!!!! 

I went to SQUARE 's website and they describe this process, and say that if you have problems with this then you can call their customer service number and one of their agents can fix the problem. I called their overseas call center, and struggled through the language barrier to explain the problem several times, and even asked to speak to a supervisor. They said they couldn't do anything about it since it was my friend 's email address, EVEN THOUGH IT WAS MY CREDIT CARD DATA THEY WERE SPREADING! 

In my opinion this is fraud or at a minimum a violation of data privacy. 

We already know from the reports to Congress a few weeks ago by an insider cyber security exert whistle-blower about the terrible cyber security within XXXX, which is also owned by XXXX XXXX just like SQUARE. Are you also going to turn the other way while this same guy plays fast and loose with our financial data?! 

I've attached a link to the XXXX XXXX XXXX Article from XX/XX/2019 about this same issue. 
https : XXXX In that article SQUARE says they include a link on each receipt which will fix the problem. But they didn't explain needing to log into an account you never created with a password you never created. You should be able to push the link on the receipt and the email should be disassociated from that card immediately. 

I've also alerted the XXXX reporter who wrote the original article that this issue can not be resolved as simply as SQUARE implied. He's currently re-investigating this issue. 

XXXX XXXX XXXX XXXX XXXX XXXX. 
XXXX, CO XXXX XXXX

Company response to consumer: Closed with explanation