Woman Faces Six Years in Prison Over a Cash App Account She Never Opened: Identity Fraud, Plea Pressure, and Platform Liability

A Pennsylvania woman spent three nights in jail and faces up to six years in prison after a scammer opened a Cash App account in her name using her Social Security number and date of birth. The case, first reported by 404 Media and summarized by TechSpot, illustrates how identity fraud can turn an innocent person into a criminal defendant, and how little technical evidence it can take to charge someone with operating an account they never controlled.

What happened to Amanda Smith

Amanda Smith was at her home in upstate Pennsylvania in April when officers arrived with a warrant for her arrest. The alleged crime had occurred in Arkansas, more than a thousand miles away, in a state she had never visited.

She was taken to a local jail and held for three nights. Her bail was initially set at $50,000, but Smith says authorities told her that paying it would accomplish little because they intended to extradite her to Arkansas regardless. After her release, Smith and her husband drove to Arkansas themselves for a court appearance, where she was fingerprinted and photographed. A second bail of $20,000 was imposed before she could return home.

Smith is charged with computer fraud, unlawful use of a communication device, and theft of property. The maximum exposure described in the reporting is six years in prison.

"They're trying to turn it into my problem [...] that I need to prove that I'm innocent," Smith told 404 Media. "That's not what I grew up believing was the way it worked."

How the fraudulent Cash App account was created

The scheme that led to Smith's arrest ran through Facebook Marketplace. A buyer found items listed for sale and messaged the seller, who instructed them to send money to his wife's Cash App account. The name on that account was Amanda Smith.

The seller's Facebook account had been hacked. There were no items for sale. The Cash App account had been created just before the scam took place, using Smith's Social Security number and date of birth.

The victim sent $1,000. Cash App records showed what happened next: within hours of the $1,000 arriving, the money was divided into smaller amounts and forwarded to a network of other accounts. Some of those accounts appeared to be controlled by scammers, while others had changed their usernames, a move that potentially made the funds harder to trace.

Smith describes herself as not tech-savvy and says she had never used Cash App.

The evidence that contradicted the account-ownership theory

Police obtained Smith's personal details from Cash App through a search warrant. A detective then obtained her driver's license and checked her information using Accurint, a LexisNexis database used by law enforcement. But records showing someone's details on an account do not establish that the person operated the account, and reporting by 404 Media identified several discrepancies.

Address: The address on the account was one where neither Smith nor her husband had ever lived.
Network connections: The account had been accessed through Verizon connections. Smith says she uses AT&T and has never had a Verizon plan.
Device and OS version: Cash App's records showed an iPhone running iOS 16.1.1, an operating system dating to 2022. Smith provided evidence that her iPhone 13 mini was running iOS 26.5.2.
Phone number history: Smith said she might have used the phone number associated with the account years earlier. 404 Media found the number linked to her name in historical data breaches.
A second account: Someone had used the same phone number to create a Venmo account under a different name roughly a week before the fraudulent Cash App account was opened.

A private investigator hired by Smith has questioned whether police established that she actually controlled the account. Her lawyer is trying to have the case dismissed. Neither Cash App nor the prosecutor responded to requests for comment.

Why Cash App initially refused to hand over the account data

A key obstacle in Smith's case was that Cash App refused to provide her with details of the account opened in her name, because she could not prove she was the owner. She eventually obtained the data through the discovery process in her criminal case.

The company is not a neutral party in the broader context. TechSpot notes that Cash App previously reached a $45 million settlement over an alleged failure to protect users from fraud.

The plea deal and what happens next

Authorities have offered Smith a plea deal that includes a $1,000 fine, $1,000 in restitution, and three years' probation. She has refused it, saying she is innocent. A hearing is scheduled for November.

This is part of a pattern, not an isolated error

The Cash App case follows a similar incident in which a grandmother was jailed for six months after facial recognition technology falsely linked her to a bank fraud case. She is now suing the City of Fargo and a Fargo Police Department detective for $10 million over the incident.

What Hacker News commenters argued about

Discussion on Hacker News focused on three questions: why the investigation stopped where it did, whether plea bargains function as a mechanism for closing cases rather than finding the truth, and who should absorb the cost when a fintech platform's onboarding is abused.

The plea bargain as a system of pressure

Commenter benjiro29 argued that the plea deal itself is the objective, because a plea lets the state avoid admitting error:

"This is the goal ... They know they are at fault but admitting they made a mistake is damaging to careers. In a lot of cases a carrot is dangled in front of people ... You can wast a lot of time (and money) fighting for your innocent, and take the risk your still going to get convicted. Or you can take the plea deal, and it absolves us from our mistakes."

The same commenter added that if a defendant refuses a plea, resources are then directed at obtaining a conviction regardless of guilt, and that the burden of proving innocence falls hardest on people without financial means.

squidbeak reacted to the same detail more bluntly:

"Meanwhile, authorities have offered Smith a plea deal including a $1,000 fine, $1,000 in restitution and three years' probation. She has refused, saying she is innocent. This is nuts. Is it possible US prosecutors give so few shits about justice?"

The missing IP subpoena

ashleyn pointed to a specific investigative step that appears not to have been taken:

"Police never thought to subpoena the ISP for the IP address associated with the cashapp login? This seems like an egregious omission in the investigation. Even if it were a VPN, you could subpoena her email to find payment receipts to the provider, etc."

The same commenter argued that treating an account as belonging to the person named on it is an enormous evidentiary leap given how common identity theft is.

giantg2 framed the legal threshold as the core problem, arguing that the bar to charge is low and that nothing in law requires the thorough investigation that department regulations nominally call for:

"All you need to charge someone is to show by a preponderance of the evidence that the elements of the offense were committed. Account being in your name and used in the crime meets that criteria. The problem is that many times a 'thorough investigation' was not performed."

Who should bear the cost of fraud

Several commenters argued that liability is misdirected. rawgabbit wrote that Cash App facilitated the scam and the buyer lost real money, yet the platform faces no repercussions, adding: "There is something horribly broken when tech companies who are ruining people's lives have zero responsibility but are making money in the process."

creativeSlumber asked whether Smith has a civil case against Cash App for allowing a criminal to open an account with someone else's Social Security number. fjni answered that she should sue "for millions and millions of dollars."

Good4boothee questioned the signup process itself, asking how Cash App verifies new users and whether the company should be required to block signups when verification is that lax, noting that a bank in the same position would face money laundering charges.

Arubis made the broadest structural argument, casting "identity theft" as a category that shifts risk away from financial institutions:

"The actual crime is classic fraud and it's directed at the banks and financiers. By inventing 'identify theft', the financial sector shifts responsibility and financial consequences from themselves to the uninvolved, innocent, and frequently totally unaware individuals that fraudsters represent themselves to be."

gaiagraphia made a related point, noting that Block Inc profits from frictionless signups while the costs of failed verification are externalized: "Computer fraud, unlawful use of a communication device, and (identity) theft describe what Cash App helped facilitate rather than anything she did."

Hackbraten offered a sardonic take on corporate security messaging:

"Meanwhile in our inboxes: 'We take the security and privacy of our users very seriously' and 'We have no reason to believe that social security numbers in our user database were accessed.'"

The counterargument: what should police have done instead

mattw2121 pushed back on the presumption that the arrest itself is the scandal, asking what the alternative process would be:

"If the police show up (not saying they did all the due diligence they should have) to arrest you for a crime and the person says 'Nope, wasn't me.'...is that sufficient for police to drop everything and walk away? She's been accused of a crime. Yes, she was arrested and had to bail out. This is normal process. How else does anyone propose this work?"

Roark66 proposed accountability as the mechanism for change, writing that the pattern will continue "until prosecutors/police become liable for gross negligence."

bluefirebrand described the case in terms of deterrence, arguing that visible punishment of an innocent person signals risk to everyone else:

"Occasionally the system just ruins someone's life even though they're innocent, and the rest of us have to watch it so we learn just how thin ice we're all on."

Textualism versus common sense

hliyan raised a comparative-law hypothesis for why the case progressed as far as it did:

"I wonder whether this type of situation is an artifact of the US system of law being focused on codification / literalism / textualism, as opposed to the UK and similar systems where common law or judge made law has more weight, which permits the injection of some level of common sense into situations where a literal interpretation of the statutes would lead to ridiculous outcomes."

uveson linked to the original 404 Media investigation as the primary source, and ChrisArchitect flagged the story as a duplicate with an earlier Hacker News discussion.

Key facts at a glance

The fraudulent Cash App account was opened using Amanda Smith's Social Security number and date of birth.
The scam ran through a hacked Facebook Marketplace seller account and defrauded a buyer of $1,000.
Smith was jailed for three nights, faced a $50,000 initial bail and a $20,000 bail in Arkansas, and faces up to six years in prison.
Charges are computer fraud, unlawful use of a communication device, and theft of property.
Cash App refused to release account details to Smith because she could not prove ownership; she obtained them through criminal discovery.
Discrepancies include a never-lived-at address, Verizon connections despite Smith using AT&T, an account created on iOS 16.1.1 versus Smith's iOS 26.5.2 device, and the same phone number used to open a Venmo account under a different name.
The offered plea deal was a $1,000 fine, $1,000 in restitution, and three years' probation. Smith refused it. A hearing is scheduled for November.