Graphic by Sarah Lu
By Alessandra Mccormack
Edited by Courtney Schneider
_____________________________________________________________________________
Introduction
In 2018, Brian Kemm attempted to send money to his mother, a Bank of America customer, via Zelle using his mobile phone, but she never received it.1 Although the $300 was transferred to a J.P. Morgan Chase bank account, it went to a separate account holder who had fraudulently registered using the same phone number as Brian’s mother.2 When Brian contacted Bank of America, he was told nothing could be done to return his money.3
Mr. Kemm, 31, a Bank of America customer in Pasadena, Calif., sent $300 to a fraudster in a misdirected Zelle paymet.
Image Credit: Melissa Lyttle for The New York Times4
Another Zelle user, Jane Butler, was duped into transferring $2,500 from her bank account through a phishing email claiming to be from Wells Fargo. She entered the username and password associated with her bank into a fraudulent website.5 After this, she received a spoofed call, in which she was persuaded to provide passcodes that allowed access to her Zelle account. Fraudsters made six Zelle transfers, all of which were fortunately refunded back to her.6
Jane Butler, a Wells Fargo customer in Downingtown, Pa., was duped into using Zelle, which she used for the very first time, to transfer $2,500 from her bank account to a scammer.
Image Credit: Bryan Anselm for The New York Times7
According to industry consultant Javelin Strategy and Research, in 2020 roughly 18 million Americans were defrauded in scams using digital wallets and person-to-person (P2P) payment systems.8 The number of frauds and scams on Zelle has increased since P2P launched in 2017. The Consumer Finance Protection Bureau (CFPB), in addition to soliciting public comment for rules under development, tracks and publishes complaints against Zelle, “a digital-payments system run by Early Warning, a consortium based in Scottsdale, Arizona, that is owned by a group of banks: Bank of America, Capital One, JPMorgan Chase, PNC, Truist, U.S. Bank and Wells Fargo.”9 According to their spokesperson, such complaints had “risen sharply” in 2022 and the agency was “working to prevent further harm.”10
Despite these consumer financial troubles, banks claim that they are not liable for fraudulent behavior on P2P platforms.11 Defrauded customers are often left frustrated by the lack of recourse to recover their stolen money.12 In 2022, victims filed separate lawsuits against Bank of America, Capital One, and Wells Fargo, that claimed they were not offered sufficient fraud and scam protection on Zelle from these banks. 13
This begs the questions: who is liable when customers are defrauded or scammed on Zelle? Who bears responsibility for fraud on P2P platforms? What recourse do victims have? Zelle is used by millions of consumers daily for fast, free, and convenient transactions; users may be unaware of the risk and lack of recourse for banking scams on the platform. When other online payment platforms, such as PayPal (launched in 1998) and Venmo (established in 2009), were criticized for not protecting customers from being defrauded, they upgraded their security systems to better detect fraud.14 Zelle, on the other hand, has not undertaken similar security upgrades. Since its launch in 2017, Zelle communicated its product’s safety risks to consumers in fine print on its website, stating that “neither Zelle nor the participating financial institutions offer a protection program for any purchase or sale conducted using Zelle.”15 Zelle expected its customers to be aware of these risks while shifting liability to the consumer.
Development and Growth of Zelle
Zelle was built atop clearXchange, a digital payments network for customers to transfer money to anyone with a U.S. bank account, in 2011.16 At first, banks saw an opportunity to charge customers for P2P transfers, hoping it would generate additional income for them.17 However, competitors quickly introduced “free” bank-to-bank transfers. 18 As a result, though Early Warning allows banks to establish user fees for Zelle, none chose to do so.19 Because sophisticated frauds and scams have been growing exponentially, bank leaders have also been receiving increased scrutiny from regulators and lawmakers over Zelle, particularly since banks are not inclined to absorb consumer losses that occur on the platform.20 This is problematic for all involved parties, as Zelle has been the preferred target for scammers due to its lack of rigor in security measures – like its user authentication requirements.21
Zelle’s Vulnerabilities
Zelle is fast, convenient, and backed by America’s largest banks to enable instant digital money transfers, making it the most widely used money transfer service in the United States.22 In 2016, banks in Zelle’s network collectively processed $55 billion in P2P transactions;23 by 2021 this had grown to $490 billion.24 By contrast, its closest competitor, Venmo (now owned by PayPal), processed $17.6 billion in 201625 and $230 billion in 2022.26 Nearly 1,700 banks and credit unions use Zelle, and customers have sent $1.5 trillion through Zelle since it began operations in 2017.
To transfer money through Zelle, the sender simply enters the intended recipient’s phone number or email address.27 The system is built on the assumption that each identifier is unique to one person.28 However, phone numbers are not unique to any one person, and emails can be spoofed, exposing weaknesses in Zelle’s security.29 While all financial systems are susceptible to fraud, aspects of Zelle’s design, like not always notifying customers when money is transferred, have added to its vulnerability.30 Zelle’s immediacy has also made it a favorite of fraudsters, as it takes merely seconds to take someone’s money,31 and neither customers nor banks are able to recover it.32
Bank Fraud Data and Regulation
Banks are not required to report their losses publicly, making it difficult to track each instance of fraud that has occurred through Zelle.33 This has frustrated lawmakers trying to gauge the scope of the issue.34 Senator Elizabeth Warren led a hearing on Early Warning’s banks, yet only Bank of America, PNC Bank, U.S. Bank, and Truist provided their fraud data, all of which demonstrated wide variations in how claims were addressed: according to the released report, PNC Bank refunded only 14 percent of the 10,683 claims it received regarding unauthorized Zelle payments, while Truist refunded 82 percent of its 24,752 claims.35
Bank Regulators
The Consumer Financial Protection Act of 2010–also known as the Dodd-Frank Act36 –aims to increase oversight and clarify the consumer finance laws governing financial transactions to protect consumers in these transactions.37 This is an amendment to the National Bank Act designed to identify and explain the standards that apply to national banks,38 and its implementation , created the Consumer Financial Protection Bureau (CFPB).39 As a federal watchdog, the CFPB’s role is to centralize the regulation of various financial services and products.40
Regulation E
Banks deny that it is their responsibility to return money to defrauded customers because the federal law covering electronic transfers —Regulation E — requires them to cover only “unauthorized” transactions, not “authorized” ones in which they are tricked into making the transfers themselves.41 Victims say these latter transactions should be classified as unauthorized because they were duped into sending the money.42 Yet, even data that banks recently provided on unauthorized transactions to Congress discloses only a reimbursement rate of 47 percent for money that clients claimed was taken without their authorization between 2021 and the first half of 2022.43 Regulatory guidance has so far been murky.44
Stakeholder Perspectives
Banks
Banks insist they take appropriate precautions against P2P scams45 and are aware of the widespread fraud on Zelle.46 Early Warning reported that its banks’ proportion of fraud and scams has significantly decreased. In a report to Senator Warren, Wells Fargo Bank indicated that 99.94 percent of its customer transactions occurred without incident, implying that only 0.06 percent of its Zelle transactions led to a fraud or scam claim.47 The banks only consider transactions fraudulent if the customer did not authorize them, and if they did, they offer no protection, whereas credit cards protect users against such scammers.48 Until 2021, when CFPB issued detailed guidance to banks about the kinds of fraudulent losses they are required to repay, the banks’ view was that liability was on the customer.49 Yet banks have been reluctant to refund victims’ money — despite owning Zelle.50
Early Warning Systems
A payments consultant at Early Warning suggested banks need to educate customers more about the risks of Zelle, because of its vulnerability: once funds are sent, they cannot be recovered.51 Despite Zelle’s increasing usage–with $490 billion sent in 2021 versus $307 billion in 2020–52 Early Warning reported that its proportion of fraud and scams has been steadily decreasing.
Researchers
After years of awareness campaigns, banks expect a certain level of understanding on the consumer’s side, and thus banks have tried to “lock liability into the terms of use offered to their clients.”53 The real challenge remains for consumers to closely read and follow the Zelle product’s terms of use to protect themselves.54 Banks’ reluctance to refund consumer losses could have negative consequences for digital-payment systems, including impacting customers’ perceived risk of mobile banking use, loss of consumer trust, and increased demand for better security which can be a costly investment (e.g., biometrics as an additional authentication measure).55 A zero liability policy for consumers can be an alternative government response to mitigating consumer uncertainty and clarifying liability.56
Customers
Consumers have mixed feelings about payment apps like Zelle because, while it is free, fast, and convenient,57 complaints have been rising. Many customers have felt frustrated and enraged to find out that Zelle is owned and operated by banks. A user commented that they feel as though the banks have colluded with criminals, making it easier for them to steal from consumers.58 Because central banks operate Zelle, many customers believe there must be some built-in consumer protection.59 And despite knowing the CFPB’s current rules about fraudulent losses, some banks rebuffed them.60
Regulators
Representative Stephen F. Lynch commented on consumer protections for Zelle transfers saying that the banks have a responsibility in principle.61 In a letter to Early Warning, Senator Warren, with Senator Bob Menendez of New Jersey, told banks that Zelle fraud has resulted in a “confusing and unfair” situation for victims.62
Rohit Chopra, the director of the CFPB, said in 2022 that Zelle fraud is piling up and is a significant issue on the bureau’s radar.63 In 2021, the CFPB issued detailed guidance to banks requiring that they reimburse customers for losses on transfers that were “initiated by a person other than the consumer without actual authority to initiate the transfer,” including those who obtain a victim’s device through fraud or robbery.64 The CFPB has signaled to banks that it may soon issue new guidance and rules about their liability for fraudulent digital payments like Zelle, a move that may not be well-received by the banks, given their reluctance to provide remuneration.65 To date, the bureau has not addressed culpability for fraudulent transfers that the customer authorized but is aware of the problem and weighing how to address it.66
A Way Forward
With recent media coverage on the unabating Zelle consumer complaints and initial bank class action suits, regulators and lawmakers have begun to intervene.67 There is an urgent need for policy action to protect against fraud on P2P platforms like Zelle and address overdue weaknesses in consumer financial protection laws, specifically Regulation E, by providing precise and consistent guidance on who is liable for consumer financial losses using Zelle and other digital-payment apps.68
Revising regulatory guidelines is one way of changing the outcome for Zelle’s theft victims. Consumers need reassurance that they can recover their money, and need to restore trust in their banks. Given that the CFPB uses consumer complaints to inform policy, leveraging this citizen-centered approach can help immensely clarify Regulation E, specifically surrounding authorized and unauthorized P2P money transfers to ensure banks’ consistent application. Another method for reform is for the regulators to order zero liability for the consumer which will immediately restore consumer trust and, as one researcher found, would make discussions around the clarification and consistency of consumer protection laws, like Regulation E, obsolete.69
Bob Sullivan, a journalist and longtime consumer advocate, compared today’s large numbers of Zelle scams and theft reports–and banks’ reluctance to absorb the losses–to the early days of online banking. Until the Federal Reserve issued an order in 2005 clarifying the role of banks in covering losses, phishing scandals resulting in customer claims were routinely denied.70
Consumers have been appealing to lawmakers and regulators to address mistreatment by the banks who operate Zelle, sending a strong signal to the banks’ regulators, the Federal Reserve, Office of the Comptroller of the Currency, and the CFPB that they need to act to clarify who will absorb their losses and protect consumer rights as stated under the 2010 Consumer Financial Protection Act. In the meantime, Zelle users will continue to be vulnerable to fraud and scams without any liability on banks.
Endnotes
1. Stacy Cowley, “Zelle, the Banks’ Answer to Venmo, Proves Vulnerable to Fraud,” The New York Times, April 22, 2018, sec. Business. https://www.nytimes.com/2018/04/22/business/zelle-banks-fraud.html
2. ibid
3. Ibid
4. ibid
5. ibid
6. ibid
7. ibid
8. Cowley, Stacy, and Lananh Nguyen. “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.” The New York Times, March 6, 2022, sec. Business. https://www.nytimes.com/2022/03/06/business/payments-fraud-zelle-banks.html
9. Cowley, Stacy. “Elizabeth Warren Singles Out Wells Fargo for ‘Alarming Pattern’ of Zelle Fraud.” The New York Times, October 13, 2022, sec. Business. https://www.nytimes.com/2022/10/13/business/elizabeth-warren-wells-fargo-zelle-fraud.html
10. Stacy Cowley and Lananh Nguyen, “When Customers Say Their Money Was Stolen on Zelle, Banks Often Refuse to Pay,” The New York Times, June 20, 2022, sec. Business. https://www.nytimes.com/2022/06/20/business/zelle-money-stolen-banks.html
11. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
12. Cowley, “Elizabeth Warren Singles Out Wells Fargo for ‘Alarming Pattern’ of Zelle Fraud.”
13. Cowley and Nguyen, “When Customers Say Their Money Was Stolen on Zelle, Banks Often Refuse to Pay.”
14. Cowley, “Zelle, the Banks’ Answer to Venmo, Proves Vulnerable to Fraud.”
15. ibid
16. Cowley, Stacy. “Cash Faces a New Challenger in Zelle, a Mobile Banking Service.” The New York Times, June 12, 2017, sec. Business. https://www.nytimes.com/2017/06/12/business/dealbook/mobile-banking-zelle-venmo-apple-pay.html
17. Lieber, “Why It’s So Hard to Transfer Cash to Your Friends.” The New York Times, Feb. 24, 2012. https://www.nytimes.com/2012/02/25/your-money/why-its-so-hard-to-transfer-cash-to-your-friends-your-money.html
18. Cowley, “Cash Faces a New Challenger in Zelle, a Mobile Banking Service.”
19. ibid
20. Cowley, “Elizabeth Warren Singles Out Wells Fargo for ‘Alarming Pattern’ of Zelle Fraud.”
21. Stacy and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
22. ibid
23. Cowley, “Cash Faces a New Challenger in Zelle, a Mobile Banking Service.”
24. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
25. Cowley, “Cash Faces a New Challenger in Zelle, a Mobile Banking Service.”
26. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
27. Cowley, “Zelle, the Banks’ Answer to Venmo, Proves Vulnerable to Fraud.”
28. ibid
29. ibid
30. ibid
31. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
32. ibid
33. ibid
34. Cowley, “Elizabeth Warren Singles Out Wells Fargo for ‘Alarming Pattern’ of Zelle Fraud.”
35. Cowley, Stacy. “Few Customers Get Refunds for ‘Rampant’ Zelle Fraud, Senator’s Report Says.” The New York Times, October 3, 2022, sec. Business. https://www.nytimes.com/2022/10/03/business/zelle-fraud-warren.html
36. Rappeport, Alan. “Under New Leadership, the C.F.P.B. Lives On.” The New York Times, December 19, 2018, sec. U.S. https://www.nytimes.com/2018/12/19/us/politics/new-leadership-cfpb-name.html
37. Investopedia, “Consumer Financial Protection Act,” Accessed November 26, 2022. https://www.investopedia.com/terms/c/consumer-financial-protection-act.asp
38. Investopedia, “Consumer Financial Protection Act.”
39. Hulse, Carl. “Christopher Dodd and Barney Frank Are Welcomed at Watchdog Agency They Helped Create.” First Draft, 1437429552. https://www.nytimes.com/politics/first-draft/2015/07/20/christopher-dodd-and-barney-frank-are-welcomed-at-watchdog-agency-they-helped-create/
40. Investopedia, “Consumer Financial Protection Act.”
41. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
42. ibid
43. Cowley, “Few Customers Get Refunds for ‘Rampant’ Zelle Fraud, Senator’s Report Says.”
44. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
45. Cowley, “Zelle, the Banks’ Answer to Venmo, Proves Vulnerable to Fraud.”
46. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
47. Cowley, “Elizabeth Warren Singles Out Wells Fargo for ‘Alarming Pattern’ of Zelle Fraud.”
48. Cowley, “Zelle, the Banks’ Answer to Venmo, Proves Vulnerable to Fraud.”
49. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
50. ibid
51. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
52. Cowley, “Few Customers Get Refunds for ‘Rampant’ Zelle Fraud, Senator’s Report Says.”
53. Meulen, Nicole S. van der. “You’ve Been Warned: Consumer Liability in Internet Banking Fraud.” Computer Law & Security Review 29, no. 6 (December 2013): 715. https://doi.org/10.1016/j.clsr.2013.09.007
54. Meulen, “You’ve Been Warned: Consumer Liability in Internet Banking Fraud,” 716.
55. ibid
56. Meulen, “You’ve Been Warned: Consumer Liability in Internet Banking Fraud,” 717.
57. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
58. ibid
59. Cowley, “Zelle, the Banks’ Answer to Venmo, Proves Vulnerable to Fraud.”
60. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
61. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
62. Cowley and Nguyen, “When Customers Say Their Money Was Stolen on Zelle, Banks Often Refuse to Pay.”
63. Cowley and Nguyen, “When Customers Say Their Money Was Stolen on Zelle, Banks Often Refuse to Pay.”
64. Cowley and Nguyen. “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
65. Cowley, Stacy. “Elizabeth Warren Singles Out Wells Fargo for ‘Alarming Pattern’ of Zelle Fraud.”
66. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
67. Cowley and Nguyen, “When Customers Say Their Money Was Stolen on Zelle, Banks Often Refuse to Pay.”
68. Cowley and Nguyen, “Fraud Is Flourishing on Zelle. The Banks Say It’s Not Their Problem.”
69. Meulen, “You’ve Been Warned: Consumer Liability in Internet Banking Fraud.”
70. Cowley and Nguyen, “When Customers Say Their Money Was Stolen on Zelle, Banks Often Refuse to Pay.”
