The case of a Pennsylvania woman facing up to six years in prison for a Facebook Marketplace scam carried out using her Social Security number and date of birth shows how the “know your customer” (KYC) rules ultimately fail everyone.
Amanda Smith, 47, was arrested in April at her home on an Arkansas warrant and spent three nights in jail, charged with computer fraud, unlawful use of a communication device and theft of property. The case rests on a Cash App account, used to take $1,000 from a Facebook Marketplace buyer, that was opened with her Social Security number and date of birth.
The rest of the account information did not belong to her: the address was one in Philadelphia she has never lived at, the phone number was one she may have last had in the early 2000s, the iPhone was running iOS 16.1.1, from 2022, while she uses an iPhone on iOS 26.5.2, and the account had a history of Verizon connections, while Smith has always had AT&T. The account’s username, $Smithy5687, was also not hers.
“They’re trying to turn it into my problem [...] that I need to prove that I’m innocent,” Smith said. “That’s not what I grew up believing was the way it worked.”
The identity check that was meant to stop fraud is what pinned it on her. Know Your Customer (KYC) rules require Cash App to collect a host of personal data, including Social Security numbers, “to, ironically, protect against fraud,” as 404 Media put it.
That is the first front on which these rules fail: by making the numbers something to steal.
Cash App’s terms say that the company may require a “legal name, email address, text-enabled mobile phone number, street address, zip code, date of birth, social security number, a government issued form of identification.”
The terms say: “We verify your identity on our own behalf and to facilitate certain of our partners, including our banking partners, in meeting their own obligations.”
Those obligations are the federal customer identification rules for banks, which require a taxpayer identification number from US customers. This is why every service that implements these rules, known as (Know your Customer) KYC, asks for a Social Security number. But every new place that collects these numbers is a new place for them to leak from.
Smith believes her Social Security number was compromised in a data breach, such as that of National Public Data, a background check firm that in 2024 exposed not only Social Security numbers but also names, dates of birth, phone numbers, and addresses.
The second front on which KYC fails is that the check only matches data, and does not identify the person. The federal rule asks for procedures that let a bank “form a reasonable belief that it knows the true identity of each customer.”
It allows checks done by “comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source.”
The same check that was done when the account was opened became the evidence that implicated Smith. The police served a warrant on Block, which owns Cash App, and the account data came back with her Social Security number and date of birth.
The case record says: “The information received from Cash App showed the account receiving the $1000 belonged to D.”
The detective then confirmed it with her driver’s license and “by also running her information through Accurint” – a tool made by LexisNexis that, according to the company, helps police “swiftly identify individuals, their assets, addresses, phones, relatives, and associates” by searching “billions of records and thousands of independent data sources.”
This is the same kind of check – matching the data against public databases and consumer reporting agencies – and it is what confirmed that the Social Security number and date of birth belonged to Smith.
And when Smith asked Cash App to see the account, the company told her she could not have that information because she was not able to prove she was the account owner.
Meanwhile, the only way to get the data was through discovery in her criminal case. Smith’s private investigator Max Ponte said that “the central issue is the distinction between identifying a person by name and establishing that the person actually operated or controlled an account.”
404 Media checked the account details using commercial breach data, including tools like District 4 Labs, which sells “one of the world’s largest repositories of compromised records” to police and investigators, and OSINT Industries, which searches accounts on apps “like Strava, CashApp and AirBnB.”
This case shows that the current system of collecting and using people’s most sensitive personal data as a means to verify their identity is broken. It does not achieve its goal of preventing fraud, and instead turns people’s lives upside down, while still putting the burden of proof on the victim.
The numbers are collected by banks and other financial institutions, and then shared with third parties, and eventually leak through data breaches.
