TikTok is flooded with videos promising free money. The latest craze claims you can exploit a hidden glitch on Cash App to instantly pocket $100. It sounds easy. Too easy, in fact. Cybersecurity experts are now warning that this viral trend is actually a highly sophisticated trap designed to drain the bank accounts of unsuspecting teenagers.
The scheme spreads through short, slickly edited videos. Creators show off massive account balances or screen-record themselves apparently receiving cash out of nowhere. To get the money, viewers are told to click a link in the bio, download specific sponsored apps, or scan a QR code.
But there is no glitch. Instead, security researchers say scammers are using these dummy landing pages to execute a technique known as session jacking.
How the Session-Jacking Scam Works
This is not a typical phishing scam where someone simply steals a password. It is much more insidious.
“They aren’t just looking for your password,” says David Vance, a digital forensics researcher who has been tracking the trend. “They are trying to hijack your active login session.”
When a target follows the link, they are prompted to sign into their account through a fake portal that looks identical to Cash App. Once they log in, the site intercepts their session token. This is the digital file that keeps a user logged into an app so they do not have to type their password every single time.
Once the hackers grab this token, they can:
- Bypass two-factor authentication entirely.
- Log in as the victim from a remote device.
- Unlink the victim’s debit card and link their own.
- Drain any existing balance and pull funds from the linked bank account.
Why Teens Are Falling for It
Teenagers are the primary targets for a few reasons. Many are active on TikTok, looking for quick cash, and lack the financial experience to spot a sophisticated cyberattack. Because Cash App is incredibly popular among Gen Z for splitting bills or receiving allowances, it has become a goldmine for bad actors.
Social proof makes the scam even more convincing. Automated bots flood the comment sections of these TikTok videos, claiming the trick worked for them. Fake accounts write comments like, “Just got my hundred bucks, do it before they patch it!”
“Kids see hundreds of positive comments and assume it is safe,” Vance explains. “They do not realize those accounts are compromised or completely automated.”
How to Protect Yourself
Cash App’s parent company, Block, has repeatedly warned users that no representative from the company will ever ask for a sign-in code or request a payment to verify an account. They urge users to keep their security settings tight and never click on suspicious external links.
If you or your child fell for this trick, you must act quickly. Go to your Cash App settings, force-close all active device sessions, change your PIN, and contact your bank immediately to freeze any linked cards. When a session token is stolen, every second counts.
