A woman sitting at a New York City café was approached by two kids selling candy for a supposedly worthy cause. That’s when the two candy scammers went to work pulling her into their scheme. The end result for the victim was having all the funds in her banking account stolen; not just $5 for a candy bar. That’s how easily this scam started, and she learned the hard way about smartphone scam security and P2P (peer-to-peer) payment apps like Zelle.

Zelle is a handy tool that many financial institutions have implemented into their mobile apps and websites to help their customers and members make transactions directly from their accounts. It’s handy and generally secure, but as we learned from this story, there are risks.

Fortunately, we can learn from her experience about what not to do in cases like this. It’s important to note that the victim did agree to donate $5 to their organization using her Zelle account. Once she agreed, she mentioned not being completely familiar with how to use Zelle. So, one of the kids offered help and asked to see her phone. She allowed it. Although the kid briefly held it, he was able to redirect the funds in her account to him, using Zelle. The $5 donation along with the remaining $1,800 in her account were gone before she knew it.

Candy Scam Lessons Learned

It’s important to know that using apps like this, the money transfer is nearly instantaneous. Once you complete that transaction, the money is gone out of your account. Also, there is some grey area about whether or not your financial institution must or will reimburse you for “authorized transactions.” As we mentioned, the woman did authorize the payment.

So, remember a few tips for safe mobile device and app use:

Never hand your phone to a stranger. Our phones have become a mobile home for our PII (personally identifiable information). Contacts, banking and other apps, photos, login passwords, and more get stored there. If you think no real harm can be done handing your phone to a stranger, even for a few seconds, the victim of this scam would tell you it’s time to think again.

The candy scam and others like it show it’s impossible to know the motives of strangers, including kids. As such, handing your phone to someone you don’t know could end with them running away with it. If a stranger asks to use your phone, even in an emergency, offer to make the call for them. That way, the phone never leaves your hand and nothing gets risked or stolen.

Only use your payment transfer apps with those you know and trust. It’s an important lesson from this scam, including using Zelle and other P2P payment apps like it. Zelle doesn’t offer purchase protection like payment cards and PayPal do. As a result, her financial institution didn’t reimburse the $1,800 even though it was lost to fraud. So, before you choose a payment app, check the purchase protections they do and don’t offer including for scams and fraud, then decide what works best for you.

This scam is a tragic example that scams and scammers are everywhere, and can involve those you’d least expect, like kids. This candy scam victim would be the first to agree.