How does Square Cash work technically?
Answer by Brian Roemmele:
The New Square
I was asked to answer this question and can only address information that is not confidential and is generally available. From a technical perspective there are two active parts to the process: the consumer facing side and the backend processes. I will break this down into two sections.
The Consumer Facing Side
Square operates RFC 5321 compliant SMTP mail server(s)  that translates and acts upon a transactional email between two parties, the sender and the recipient. Square currently achieves this through the Square Cash iOS and Android app and works in conjunction with the resident email app on the device to send the precomposed email message. The transaction is limited to 48 states in the US (TN and HI are excluded)  and requires a US issued debit card with a Visa Or MasterCard logo. A successful first time transaction involves four steps:
- The sender completes a form to a recipients email address for a stated amount. Square then composes an email message that presents the amount to be sent in the subject line of the email with the recipient address in the “to:” field andin the “cc:” field. The sender can send a message in the body of the email.
- The sender, recipient and Square receives a copy of the original email. Square in turn creates two new email message: one for the sender and one for the recipient.
- The sender must respond to the email by clicking on a link and completing a form that requests a US Bank issued debit card for instant withdrawal of funds.
- The recipient must respond to the email by clicking on a link and completing a form that requests a US Bank issued debit card for up to two day deposit of funds.
If all goes well, the funds will transfer within a window of time that can span up to two days :
As a Recipient, you will need to create an account with Square, and link your Eligible Transaction Account. Once you link your Eligible Transaction Account you will generally receive the funds that are sent to you within 2 business days. You will also e enabled to send funds to other Recipients after you receive funds using the Service. You agree that we will not be liable in any way for any Payments that you may receive, regardless of whether you authorized the Sender to send them to you.
Funds that are not claimed have an interesting fate :
You understand and agree that when you initiate a Payment Instruction from an Eligible Transaction Account using the Service, the processing of the Payment Instruction will begin and the debiting of your Eligible Transaction Account will occur as early as the day of such initiation. However, we will only begin to process the requested transfer of funds once the Recipient has provided all required information, and you hereby authorize and direct us to retain such funds until the earlier of such time as the Recipient has provided all required information or fifteen (15) days.
Payments not claimed by a Recipient will be cancelled automatically fifteen (15) days after the processing of the Payment begins, and we will attempt to return any unclaimed, refused, refunded, prohibited, or denied Payment along with the Service fee to your Eligible Transaction Account. If we are not able to return the amounts to your Eligible Transaction Account we may use other reasonable efforts to return such Payment to you as permitted by law.
Square states that only US issued debit cards with Visa and MasterCard logos can be used for this system . They explicitly state that no other payment card can be used. However in my tests I was very surprised by a glaring oversight in this limitation.
After the sender and recipient link their respective debit cards to the associated email address, this link is stored in Square’s computers and at this point there is no way for either party to unlink the association between the email address and the debit card. This means that if you have many debit cards you need new correlated email account to accommodate these Square Cash transactions. Square does not restrict the number of debit cards and email addresses you use.
The Backend Side
To perform this type of money transfer function in the US a bank is required. In my early tests of Square Cash in June, 2013 I determined that my test transactions were processed by Chase Bank. This was not a surprise as Chase is also the Visa and MasterCard Acquiring bank for Square. Chase is also a Square early stage investor.
Square built a number of processes on top of the STMP mail servers that connect to internal systems that run a number of services from PostgreSQL, Ruby, Java, WebSocket Protocol and other systems. These systems prepackage information that is sent to the Visa Personal Payments API . MasterCard has an equivalent service however I will focus on the Visa API. Square is also using a third method I will call this the Purchase Refund method.
"Purchase refund? I did not buy anything." A Taxing Problem
In my tests I have also detected that Square is using a method that can best be discribed as kludged together and not the API method. They issue a "purchase refund" as a method to pay the recipient's debit card. This method is quite trival to implement and uses the standard payment card network but send a "purchase refund" for a transaction that had no purchase. The problem is this creates mountains of confusion as the recipient tries to reconcile the checking account statement. It also has a rather large tax impact to the recipient. In an audit the IRS will question were the funds originated from that created this "purchase refund". The sender is also confused as they are charged for a "purchase". It all sounds like a witty solution but it will turn bad very fast. I am rather certain Square has not thought of the tax issues this will cause, or the legal problems that can result.
The other issue is that not all banks will allow an "unbalanced trasaction", knowingly. I spoke to a risk executive at one of the top largest US banks and they said they would have a dim view of this system and may challenge it. All refund transactions should be balanced with purchase trasaction. If you operate a merchant account please do not try to experiment with this method, you will lose your account. This method is also limited to only US accounts. Finally this is really not a sustainable method for quite a number of other reasons and therefore Square would ultimatly have to use an API that was designed for this purpose.
Visa has several mandates about unbalanced and unmatched refunds and recommends both card issuers and merchant acquirers to monitor them:
Credit and Refund Restrictions (ID#: 010410-010410-0001710)
A U.S. Merchant must not:
Process a Credit Transaction Receipt without having completed a previous retail Transaction with the same Cardholder, except as specified in "Credit Transaction Receipt Delivery – U.S. Region."
Original Adjustment through VisaNet (ID#: 010410-010410-0008880)
An Acquirer may initiate a credit Reversal only to correct inadvertent processing errors.
The Acquirer must process a credit Reversal or a debit Adjustment within thirty (30) calendar days of the Processing Date of the initial credit Transaction.
Credit Transaction Receipt (ID#: 010410-010410-0008605)
A Merchant may, at its discretion, prepare a Credit Transaction Receipt when a valid Transaction Receipt
was previously processed and the Cardholder either canceled the Transaction later or returned the goods.
At the time of the Credit Transaction, the Merchant must:
1) Prepare a credit that includes the Credit Transaction Receipt date and identifies the original Transaction.
2) Deliver a completed Credit Transaction Receipt to the Cardholder.
3) Deposit the Credit Transaction Receipt within five (5) calendar days from the date that the credit
4) In the U.S. region, the Credit Transaction Receipt must describe the merchandise returned, services
canceled or adjustment made.
A Merchant must not:
1) Accept payment from a Cardholder for the purpose of depositing funds to the Cardholder's account
2) Process a Credit Transaction Receipt without having completed a previous retail Transaction with the same Cardholder
The loading of value to a Visa Prepaid Card that has been designated for participation in the Visa Prepaid Load Service by the Issuer is excluded from these restrictions.
Effective 27 January 2013, in the U.S. Region, or in a U.S. Territory, the Merchant must refund any U.S. Credit Card Surcharge assessed on the Credit Transaction amount. For partial refunds, the U.S. Credit Card Surcharge amount must be pro-rated.
It will be interesting to see if this method is well received by the recipient banks if the service becomes very popular. However something tells me they will continue to use this "purchase refund" method for a while.
The Visa API Method
Visa Personal Payments (VPP)  is a payment service that lets people send money to millions of eligible Visa accounts around the world through the Original Credit Transaction. Visa created this API a number of years ago and forms the basis of quite a number of programs that member banks have created. The API system is not perfect and is still working out issues with some member banks. This API is really quite powerful and has features that are far more simplex then what Square is currently using. Some functions of this API is:
- VPP Money Transfer: Consumers can send funds to their Visa account or to another person’s Visa account.
- VPP Prepaid Load: Consumers can load/reload funds to a Visa reloadable prepaid card in participating countries.
- VPP Credit Card Bill Pay: Consumers can pay a Visa credit card bill.
Example of a program flow chart using the VPP API.
There are a number of steps that each transaction takes on the way to the recipient’s debit card. The VPP program uses the same systems as a standard payment card transaction. However there are a number of codes set to inform the network that this is not a merchant credit but an OCT transaction. The minimum API calls to the VPP would be Account Verification (ACNV) and/or Account Lookup (ACNL).
Example of the transaction flow of a VPP API process.
In the example above, Square is inserted on the front and back of the VPP process. Square facilitates the transaction on both sides but uses the Visa API to make it all operate.
Square Paying 10¢ Or More For People To Send Money For Free
Square would be paying 10¢ to Visa under the current Interchange Reimbursement Charts for a US based Original Credit Transaction. There would also likely be a cost charged by Chase bank on top of this fee. Thus it is safe to conclude at minimum Square is paying about 10¢ to perform a Square Cash transaction using the VPP API method or about 25¢ or more using the "purchase refund" method. Keeping score, it means they are subsidizing each and every Square Cash transaction as Square is not charging for the service at this point. Clearly this is not a sustainable business model. If Square were to charge a fee, they would lose a majority of their business to other systems.
Building Payment Cards On File
The logic here is to grow the number of users they have on file and to build a large database of payment cards held on Square servers. This can be the only reason Square would logically pay people to send money through their system. The process to grow cards on file was started with what is now known as Square Wallet and continues on with the premise of the Square Market. The Square Wallet has not performed very well and his since had the icon for the product removed from the front page of the Square website, now hidden as a gray text link at the bottom of the front page. The Square Market faces a huge and well developed sector that has thousands of competitors many that can send millions of people per hour to the commerce sites they have built. If you have a store online the one thing you seek is traffic and this translates directly to sales.
Square is hoping that the very over crowded person to person payment sector can tolerate yet another system. They face a tremendous number of direct competitors: the semi-stealth Clinkle, Google’s Gmail based person to person payment system, over 200 US banks, dozens of other companies and of course PayPal.
Square hopes that as more people register cards that in some way they can leverage this into a more appealing wallet system. However in this process they will also face Apple and the iWallet based around the spectacular success of Touch ID. As the iWallet becomes more clear person to person payments may become as simple as dropping an icon in Air Drop.
Email As A Person To Person Payment System Is From 1994
On October 20, 1998 a payment company that predated PayPal and x.com was issued a patent for a remarkable new way to pay, via email called “Computerized system for facilitating transactions between parties on the internet using e-mail” . This may sound very familiar as this company not only invented the very first viable internet payment system, they built it around STMP mail servers:
A payment system and method are disclosed for processing financial exchanges over a network between a merchant and a buyer. For example, receiving from a merchant, over the network, information associated with a financial transaction and non-financial data relating to a buyer involved in the financial transaction. Authorizing payment, associated with the financial transaction, to the merchant on behalf of the buyer using the non-financial data related to the buyer. A notification of the authorized payment on behalf of the buyer is sent to the merchant over the network. Upon notification from the merchant that the buyer has committed to completing the financial transaction, processing payment to the merchant on behalf of the buyer.
Security is maintained by isolating financial and credit information of users' cardholder accounts from the front end portion of the payment system and by isolating the account identifying information from the associated e-mail address.
I became great friends with the primary author of this patent in late 1994 and continue to be in regular contact with him. His name is Nathaniel S. Borenstein  and is by every definition a polymath and true scientist. Nathaniel and I spent hours speaking about the future of payments and his company First Virtual  was the Square of 1996. CEO, Lee Stein appeared on the front cover of Fortune and Business week at the same time. There was high hopes for First Virtual just like there is for Square today.
First Virtual’s Simple MIME Exchange Protocol was built to scale and allowed sellers to verify accounts and buyers to initiate payment transactions. The system was linked to a payment card on the buyer’s side and a checking account on the seller’s side. However there was a movement to link buyer’s and seller’s payment cards to gather through First Virtual’s payment system. This was a decade before the Visa VPP was thought of.
This patent from First Virtual and about a dozen other patents may present Square with some rather large challenges. There is clear prior art and if the patent holders express control of this method, it may have an impact on how Square’s current system may need to change.
Guess Who Owns The First Virtual Email Based Payment Patents?
There is a rather deep irony to the ending of First Virtual and how it relates to Square today. First Virtual was too far ahead of its time. And just as they began to gain traction the start of the Internet bust was taking hold (a Series A crunch). The company was sold a number of times and wound up with Double Click in 2001. Double Click went on to sell the First Virtual patents to, drum roll, PayPal. So as it stands today, PayPal not only owns the 1998 patent “Computerized system for facilitating transactions between parties on the internet using e-mail” but also a number of other foundational patents that cover email based person to person payments.
If anyone contacted me and asked about the challenges they would face with the intellectual property surrounding this method I would have advised a far different path that would not only be more efficient, but would not encroach upon prior art, while still using an email based system. I am in no way double guessing the fine talent at Square and the wonderful lawyers they no doubt used to vet this system. I do know however that three of the best patent attorneys in late 2007 advised a startup not to use an email based method as there were too many encroachments on prior art. That company had over 10 million in funding and wound up pivoting to other things.
The New Square
Square has drifted very far from the business premise that made the company famous. The primary premise was to help micro-merchants accept payment cards. Square simple but powerful premise was a spectacular success. By constraining and editing, Square moved fast from the first transaction on a cold winter day in 2010, at Sightglass Coffee in San Francisco. At the time there were few direct competitors focused on the micro-merchant using a smartphone and a card reader,
As we approach 2014 Square has hundreds of competitors with card readers on smart phones including Square’s own bank, Chase  and of course PayPal who is offering zero cost to merchants currently compared to 2.75% at Square. These competitors have slowed the number of new merchants boarding the Square payment system and has contributed to the attrition they are experiencing. Transaction volume will grow at Sqaure, because this is how payment card companies work, but as time moves on this too will flatten if new markets are not discovered. Square is very late to expend into Europe, South America and Asia and lost first mover status to very well entrenched local and regional payment companies with very similar systems and price points.
Square has also entered into a market that is very robust and full of agile competitors by creating the Square Market. Competing with Amazon and Etsy and 1000s of other marketplaces is an interesting shift from Square’s roots.
With Square Cash, the company faces PayPal on their own turf. And PayPal has a lower cost of funds when one aggregates the money on deposit the over 150 million PayPal users accumulated. This means from a long term price point, PayPal would benefit. We are also talking about the new PayPal that will no doubt match Square point to point to such a level that from a user’s perspective they would not see a difference.
Square also faces Google and the person to person system they have created. Early and limited results show that the platform is already a mild hit with consumers. Google will methodically expand this service and it will become as common as attaching an image to your email. It just works.
Would you want to compete with Google, Apple, PayPal, Amazon and so many others even if you were the best startup the world has ever seen? These company already solved the problems that Square is trying to address.
Square Is Packed Full Of Astounding Talent
I fear that the company is now battling a multiple front war. A study of history will inform how this always turns out. Square’s ethos used to be about constraining and editing to an essence. It was also about limiting the products so that the company can focus on the really big problems that need to be solved in payments. I think Square has some of the most talented people working on these projects. I just think there are no new problems to solve in person to person payments and internet marketplaces especially when the company is facing the largest companies in the world in the process.
I have many friends at Square. Some have got to know me here on Quora. All of them know how much love I have for what they do and the company they work for.
That simple idea that started Square at Sightglass Coffee can still be kindled again. I see so many unsolved problems for this amazing talent to solve. Real problems that real merchants face every day, yet no one notices. There just needs to be the leadership and the willingness to embrace the ethos that got Square so very far. Solving the unsolved problems is how you change the world.