https://squareup.com/help/en-us/article/5144-square-cash-sec...
If you use an app, they sign the mails. If you use regular e-mail, you have to confirm the transfer, which means simply spoofing a mail from you won't work.