On Thursday March 30th, Block released a statement in an effort to address several of the issues we raised in our report released on March 23rd.
Rather than refute the key issues, Block’s response instead confirmed much of our analysis and avoided addressing the rest of it.
Critically, Block’s response disclosed for the first time that the company has internal estimates of the number of users on the Cash App platform that differ widely from the number of “transacting actives” disclosed publicly to investors as its key user metric.
Yesterday, Block disclosed that Cash App users comprise 39 million unique Social Security Numbers (SSNs) and 44 million verified accounts. The verification process is done through Block’s internal Identity Verification (IDV) program, which it also disclosed for the first time.
These disclosures differ sharply from the misleading “transacting actives” metric Block has previously reported to investors. For example, in September 2022, Block’s CFO Amrita Ahuja touted the company’s 80 million annual transacting actives as a justification for its acquisition of Afterpay, calling it:
“an incredible opportunity for us, particularly when you think about leveraging that capability across Cash App 80 million annual actives.”
Based on the new 39 million to 44 million user counts reported yesterday, we now know that the cited 80 million annual user metric was inflated by 82%-105%.
Block’s newly reported internal estimates also show that its previously reported 51 million monthly transacting actives as of December 2022 represented a 16%-31% inflation of its actual estimated internal user counts.
Block’s new estimates give Cash App the benefit of the doubt by assuming that all the Social Security numbers used to access the platform are being used by their rightful owners and represent legitimate accounts, a highly unlikely scenario given compliance lapses detailed in our report.
As also noted in our report, overstatement of user metrics has implications for the calculation of customer acquisition costs (CACs), which the company has previously touted as being industry leading and a key indicator of its success, saying its CACs are:
“a fraction of what other financial applications across our industry typically pay and a miniscule fraction of what traditional financial institutions have historically paid to acquire a new customer.”
Block’s latest disclosure makes clear that customer acquisition costs had been artificially lowered by inflation of the number of users on the platform. It also makes clear that claims of Cash App’s powerful network effects have similarly been overstated based on the same metric.
Block’s justification for its use of the flawed “transacting actives” user metric was that other competitors use even more misleading metrics, saying “some companies include any account that opens their mobile application or loads a webpage on a browser as an active account.”
This fails basic logic. Most banks and financial services companies report metrics on actual individual users, such as number of deposit holders, because it is easy to report given the information available to them and because it makes sense. Block’s own disclosure showed that 97% of the actual Cash App inflows were driven by verified accounts.
Given that Block has these metrics available, we think it should continue to report verified user counts and individual SSNs to investors going forward—there is no reason why the company should hide its own internal, more accurate, user estimates while reporting a fluffed-up metric to investors.
Our report detailed specific compliance gaps that resulted in Block facilitating an estimated billions of dollars in pandemic relief fraud. Those gaps included obvious lapses such as single accounts being permitted to accept unemployment payments on behalf of numerous individuals in different states.
In its response, the company provided only a high-level defense of its compliance policy, while acknowledging that it “saw an increase during 2020” of risk loss, a measure it uses to assess fraud costs that is partially lumped into “sales and marketing” expenses. [1] The referenced losses appear to refer to only a subset of losses associated with peer-to-peer transactions, while other fraud-related losses, for example those related to Cash Card chargebacks, remain obscured.
Beyond that, the company made no estimate of the loss to the government and American taxpayers as a result of the facilitation of illegitimate pandemic relief payments. As noted in our report, every bank processed some fraudulent pandemic payments, but fraudulent payments associated with Cash App’s partner bank were disproportionately high. Investors and taxpayers deserve transparency on this issue.
In our report we highlighted that “interchange fees” comprised an estimated 35% of 2021 Cash App revenue, based on a Credit Suisse report, a material amount that the company doesn’t specifically report to investors. We also showed how this amount is reliant on avoiding regulation meant to cap interchange fees, and how the company may be subject to an SEC investigation on the issue.
The company failed to mention any of the above: (i) how much of Cash App’s revenue is comprised of “interchange fees” (ii) details on its reliance on claiming a “small bank” exemption in order to charge merchants higher fees and (iii) whether the company is subject to an SEC investigation.
Block’s response also highlighted how every financial services firm faces issues of fraud and illegal activity. This of course is true—but the mitigant to those activities is generally a strong compliance program that flags suspicious activity and takes quick corrective action.
As detailed thoroughly in our report, Block seems to take the opposite approach by welcoming non-compliance. One of the more vivid examples of this was evidence showing that Block paid to promote a song and video called “Cash App” by 22Gz. The song detailed how easy it was to use Cash App to pay hitmen to murder rival gang members.
We also asked what other songs Cash App paid to promote, in order to understand whether it was sponsoring other content that encouraged illegal activity on its platform.
If we were off-base with any of this, we would have expected Block to have easily addressed this, with something along the lines of:
“Block has a strong culture of compliance and would never pay to promote a music video celebrating the use of Cash App to facilitate murder. Here’s a list of content we paid to promote, which all encourage only legal use of the platform.”
The company has said nothing and instead reported metrics on how it “denylisted” 2.4% of transacting actives in 2022. Denylisting is a form of account restriction. The metric says nothing of how many accounts should have been denylisted, metrics in previous years, or really much of anything.
We think these are relevant questions, particularly in the context of the other signs of rampant fraud on the platform and the compliance gaps we raised that have thus far gone unaddressed.
Legal Disclaimer Use of Hindenburg Research’s research is at your own risk. In no event should Hindenburg Research or any affiliated party be liable for any direct or indirect trading losses caused by any information in this report. You further agree to do your own research and due diligence, consult your own financial, legal, and tax advisors before making any investment decision with respect to transacting in any securities covered herein. You should assume that as of the publication date of any short-biased report or letter, Hindenburg Research (possibly along with or through our members, partners, affiliates, employees, and/or consultants) along with our clients and/or investors has a short position in all stocks (and/or options of the stock) covered herein, and therefore stands to realize significant gains in the event that the price of any stock covered herein declines. Following publication of any report or letter, we intend to continue transacting in the securities covered herein, and we may be long, short, or neutral at any time hereafter regardless of our initial recommendation, conclusions, or opinions. This is not an offer to sell or a solicitation of an offer to buy any security, nor shall any security be offered or sold to any person, in any jurisdiction in which such offer would be unlawful under the securities laws of such jurisdiction. Hindenburg Research is not registered as an investment advisor in the United States or have similar registration in any other jurisdiction. To the best of our ability and belief, all information contained herein is accurate and reliable, and has been obtained from public sources we believe to be accurate and reliable, and who are not insiders or connected persons of the stock covered herein or who may otherwise owe any fiduciary duty or duty of confidentiality to the issuer. However, such information is presented “as is,” without warranty of any kind – whether express or implied. Hindenburg Research makes no representation, express or implied, as to the accuracy, timeliness, or completeness of any such information or with regard to the results to be obtained from its use. All expressions of opinion are subject to change without notice, and Hindenburg Research does not undertake to update or supplement this report or any of the information contained herein.
[1] Block provided some new detail around its fraud costs that are buried in SG&A expenses, which are clearly material. The company didn’t detail the actual cost, but based on the new disclosures showing that fraud losses comprised 0.12% of overall inflows, and reported 2022 inflows of $204 billion, we estimate $245 million in 2022 P2P fraud losses.