6 ms·

Consumers defrauded on Zelle are left high and dry by the banks that created it [pdf]

• fortran77 3y ago
  For one thing, they should make NEVER send any emails or SMS related to Zelle, and the app should say every time it starts "Zelle NEVER sends you an email or text message. Do everything from inside the app." Theat would be a good start.
  • fsckboy 3y ago
    > NEVER send any emails or SMS related to Zelle, and the app should say every time it starts "Zelle NEVER sends you an email or text message. Do everything from inside the app." is Zelle ever its own app? I only use Zelle from my banks' apps, and banks use TFA with text messages all the time, including from the website, calls to support, and the bank app running on the phone. I'm not saying that TFA texts to your phone are 100% two-factor-valuable from an app on your same phone, but what you're talking about would be a major set of changes to the standard security model everybody follows.
    • squeaky-clean 3y ago
      Looks like one was released around 2019, I didn't even know. I can't find any specific dates mentioned or any press releases. Things around 2017 mention a Zelle app coming in the future, by 2019 articles are mentioning the Zelle app.
      • ceejayoz 3y ago
        The app just tells me my bank has Zelle and I should use it instead.
        • Arrath 3y ago
          Same here. Not that I am a fan of just throwing money into the aether and hoping it gets to the right destination in any case.
    • CaliforniaKarl 3y ago
      Zelle does have their own app, and I have used it before. The app is for folks using a domestic United States bank that isn't connected to Zelle. During registration, the Zelle app prompts you for your bank name, your mobile phone number, and email address. Those are all checked: If your bank isn't listed as a Zelle-supporting bank, and your phone number & email aren't already linked in the Zelle system, then you can use the app. You also need to have a Visa- or MasterCard-based debit card. You did not need to provide your PIN. Zelle uses the same rails as VenMo's Instance Bank Transfer[0] payout option, so Zelle is subject to the same limitations. IIRC, all logins required either mobile number or email, password, and SMS-based two-factor. I think your login lasted for maybe a day. I used the app in the days before app-based two-factor was a thing, so I don't know if they still use SMS-based two-factor today. Sending and receiving money worked as advertised. In particular, money received would show up in my bank account fairly quickly (within a few hours, IIRC). I was not charged any fees—for deposits or withdrawals—for using the Zelle app. [0]: https://help.venmo.com/hc/en-us/articles/115015844068-Instant-Bank-Transfer-FAQ https://help.venmo.com/hc/en-us/articles/115015844068-Instan...
      • fragmede 3y ago
        Minor nit - those aren't Venmo's rails, but Visa/Mastercard's. Other vendors offer similar instant payout features.
• costco 3y ago
  Due to Zelle's low transaction limits the amount lost in Zelle scams is hardly worth noting. Every bank already has a warning page before you use Zelle telling people what to look for in scams but based on this report it appears people are ignoring it. The losses from investment scams are much more worrying. I think all consumer bank accounts should require a mandatory two hour anti scam educational video before any outbound transfer > $10000 can be made.
  • godzillabrennus 3y ago
    That’s an elitist world view / statement. More than half of Americans have less than $500 in savings: https://www.gobankingrates.com/saving-money/savings-advice/nearly-half-of-americans-have-less-than-500-in-savings-how-you-can-beat-trend/ https://www.gobankingrates.com/saving-money/savings-advice/n...
    • costco 3y ago
      There is no way to do what the senators want without undermining the entire point of Zelle. If there are chargebacks then there needs to be a dispute resolution system and higher fees to compensate. These are authorized payments, banks are already obligated to reimburse all unauthorized payments.
      • wmf 3y ago
        Yep, people are about to learn that those credit card fees actually buy you something.
        • spandextwins 3y ago
          Credit card fees, like insurance rates, are staggeringly high to cover all the crime and fraud. Just hope someday those companies don’t have to have their own law enforcement teams to go after the criminals who cause all that fraud and crime.
          • 3y ago
• jiofj 3y ago
  [flagged]
• burnte 3y ago
  In 2009 I met some Israeli developers in Atlanta who were trying to get meetings with some of the banks in the area (there are a number of corporate bank offices here for big banks) to hawk their direct payment system, which was exactly what Zelle is. I contracted with them and got them some meetings, I was basically a rent-a-laowai for them to get meetings here. I never heard what happened to them after that, and when Zelle came out, I was sad to see the exact same idea but from a totally different company. But the core concept is digital cash, so you HAVE to treat it as such.
  • deleted 3y ago
    [deleted]
  • prepend 3y ago
    It’s not a unique product and I worked for some bank startups in the early 2000s trying trying the thing. And really this was the original idea for PayPal, dwolla, and lots of other digital cash payment systems.
    • burnte 3y ago
      Well, unlike PayPal with had been around for years, this was basically SWIFT for the US, which is kind of what Zelle is. From what I heard the big problem they faced was banks couldn't see how to monetize it.
    • simfree 3y ago
      Nearly all of which have pivoted from the free at point of use model since moving money for consumers at no cost is not often profitable.
• NovemberWhiskey 3y ago
  "Consumers defrauded with cash are left high and dry by the Federal Reserve Bank that created it".
  • akira2501 3y ago
    Did the Federal Reserve promise me that cash was always "safe, fast and convenient?" Are they getting a cut of every dollar I spend?
    • m_0x 3y ago
      They get a cut after every dollar created.
    • mark_up 3y ago
      [dead]
    • stu2b50 3y ago
      What part of Zelle isn't safe, fast, and convenient, that is actually scoped under Zelle's responsibilities? Zelle is for moving money from bank account A to bank account B - that's where its responsibilities end. > Are they getting a cut of every dollar I spend? They aren't.
  • hot_gril 3y ago
    I'm fine if a payment method is escrow-free and non-reversible, and I'm told that upfront. Oddly enough, that's like a rare luxury. Even Zelle is only half that: authorized payments are never reversed (i.e. they don't act as an escrow), but unauthorized ones (hacked account, etc) can be. This is posted somewhere, but I also tested it myself. Previous landlord had stolen my security deposit. I went to my Chase branch and called several different numbers trying to reverse the final month's rent, which had been Zelle'd. After initially getting the half-truth that payments cannot be reversed, I found the right person who asked sternly if the payment was unauthorized, saying I could reverse it if it was. I had to say no. So no dice, I had to go sue the landlord instead.
• cuteboy19 3y ago
  What do the scams actually look like?
  • paulocal 3y ago
    This happened to a friend of mine. She had listed a mattress with bed for sale on FB marketplace. Someone reached out and bought it and said would arrange pick up. They sent a screenshot of them Zelleing her. After a few minutes they reached out and told her they changed their mind because they cant pick it up and if they can Zelle them back. She did thinking it just hadn't hit her account yet. $1800 down the drain.
    • notyourwork 3y ago
      So she sent $1800 to someone without first seeing a pending transaction of any kind for a $1800 credit? Some things have to be learned the hard way if that's all it takes.
      • cuteboy19 3y ago
        The solution for this is instant SMS narratives. If you do any kind of transaction, whether receiving or sending, you will get an SMS detailing the (completed) transaction. Over time people will be conditioned to wait for the SMS before finishing any transaction That is how UPI does it anyways
      • bbatsell 3y ago
        No, the scammer stole someone’s credentials and the bank clawed back the payment. The bank can always reverse it at any point in the future. The consumer never, ever can.
    • kjs3 3y ago
      This is Zelle's fault? A screenshot? Either you have low friction financial transactions or you bubble wrap the whole thing so people don't do incredibly stupid shit.
• isanengineer 3y ago
  It's not just fraud you need to worry about. Here's a horror story for you. A few years back I was moving to a city for graduate school and needed to rent an apartment. A friend of mine toured the place and when we decided to rent the landlord asked if we could send him the security deposit using Zelle. I sent the deposit using his contact information, but he never received it. I spent three weeks being passed back and forth by one bank being told I needed to speak with they other bank. They confirmed the money had been debited from my account, and confirmed it was not deposited in his, but nobody could tell me where the money went. I called Zelle multiple times, but all they would tell me is I needed to talk to the banks. Eventually after three weeks the money was quietly returned to my account with no explanation. After a bit more digging it appears my transaction triggered some fraud alert, but neither myself, the depositor, or either bank was notified of this. To add insult to injury, during this process the people in charge of Zelle at my bank (which rhymes with Space) told me I was out of luck, because using the Zelle for any type of commercial transaction, including sending rent or security deposits, is against the terms of service. Looking back over the terms of service I found they were 100% correct. I also found that Zelle is basically just a front-end for the existing ACH Direct Deposit system. It was created by a consortium of banks to compete with services like Venmo, but it at it's core a very different service. Venmo actually provides value by acting as a middle man: Venmo pays the recipient and collects the money from me. Zelle is just a way to send money directly to someone's checking account, but by using their email address or phone number instead of the account and routing number. This is why there is absolutely no recourse if anything goes wrong. tl;dr do not ever use Zelle.
  • crazygringo 3y ago
    You should write that up as an Op-Ed or contact some journalists to use it as part of a story. You've got a lot of details in there that are definitely not common knowledge and would be of wide interest.
    • isanengineer 3y ago
      Thanks, but I don't think I know enough about this to speak about it on the pubic record. My experience is based on remembering what random customer service reps said a few years ago and a bunch of reddit and forum posts. For example, I don't know if Zelle is literally just direct deposit--if it was how did they freeze my transaction for 3 weeks? But I do get the sense that of all the payment platforms, Zelle is uniquely risky because of the way it's set up. I do with a journalist would look at it from that angle rather just from the "wow there's a lot of fraud here". It seems to be that the banks are incentivized just to get have this product out here to undercut the competition from digital payment platforms, but have absolutely no incentive to make it a functional or safe platform.
• steelframe 3y ago
  For anyone extolling the virtues of credit cards as the ultimate payer-friendly solution, my "exhibit A" is a vendor who charged my card and then put a freeze on actually shipping the product. Then they tried calling me while my phone didn't have a signal. Then they sent me an email saying their "verification" department couldn't reach me and to let them know when they can call. I replied telling them when they could call. They didn't call. So I called them and sat on hold until someone finally picked up and told me that my order was flagged for some reason. After I confirmed my address (?), they seemed to confirm my order and then hung up. I still haven't gotten any confirmation that my item shipped yet. In general I try to avoid ordering from Amazon, but if I had done that instead, I would have my item in my hands right now. Instead I had to waste my time playing phone tag, and I'm still wondering whether or when they'll actually ship my item. All because the vendor is apparently super-averse to credit card fraud and would rather push me to Amazon for future purchases than take whatever chance they'd be taking by sending me what they've already charged me for. I'll have to be calling them again after the weekend to see if they've actually sent it. If they haven't, I'll tell them to cancel my order. And then I'll have to wait for them to refund the charges. If they don't, then I'll have to make another call to my bank to reverse the charges. All the while, I still don't have my item. So if you don't pay for fraud in lost cash, you're definitely paying the overhead of vendors trying to avoid being "stuck holding the bag" by throwing arbitrary verification processes in your face, introducing delays and possibly leading to you needing to make multiple phone calls to resolve problems while being left without the thing you need.
  • majormajor 3y ago
    "Pay before the item ships" is nearly ubiquitous online even if you used Paypal or a debit card or whatever. Maybe if you'd used a method like that they'd not even be pretending to think about sending your item, vs just pocketing your cash. I'm not sure "vendor is so paranoid about fraud because credit cards are too consumer friendly, thus credit cards aren't payer-friendly" follows from this story more than "vendor is just acting in bad faith."
  • WalterBright 3y ago
    Now and then someone "hacks" my pathetic Javascript shopping cart to buy software for $1 instead of the usual price. I just send them an email with a balance due for the rest of the purchase price. Never hear from them again. I accepted credit cards for many years until I was subjected to repeated "carding" attacks. The credit card processor blamed me for them, and was unable to tell me how to avoid such attacks. My solution was to not accept credit cards anymore.
• randyrand 3y ago
  Zelle is like cash. And like cash, it has the same problem. Once you give it, you can't demand it back without courts.
  • hot_gril 3y ago
    The common Zelle scams I've heard of rely on how Zelle doesn't work like cash. It is possible to reverse Zelle payments, but only in very specific circumstances like compromised bank creds. So the scammer will manipulate you into giving a clean, irreversible payment in exchange for a dirty one that later gets reversed. It's also a lot easier to send like $5K to some faceless entity with Zelle than with cash.
    • randyrand 3y ago
      TIL! Tricky.
      • soneil 3y ago
        I assume everyone's familiar with the overpayment scam - it's probably the second most common cheque scam after simply passing bad cheques in the first place. You're accidentally paid too much, and are asked to return the remainder, or pass it on to someone else. Then the original cheque bounces and you're out product plus the remainder you passed along. This version relies on banks being required to make "funds available" in a timeframe that's often shorter than how long it takes a cheque to actually clear - so you can dig yourself into a hole before the cheque finally bounces. The zelle version is essentially the same thing. Someone "accidentally" sends you a sum, and being a nice, reasonable person, you return it. The problem is this isn't a rollback; you don't (can't) revert their transaction - you create a second transaction. So when the source of the original transaction turns out to be fraudulent - and as the parent post says, fraudulent can be reverted, the house always wins - that first transaction is reverted. The second, where you "returned" their overpayment, is an entirely distinct transaction and needs to be fought separately. And it's a much harder fight to win, because it doesn't involve the house winning. (And yes, this could be almost entirely mitigated by having a user-facing return/revert/refund function that undoes the original transaction instead of creating a second.)
• cuteboy19 3y ago
  I agree that at some point people need to take some responsibility for being scammed. However, it seems that Zelle is engineered in the perfect way to help scammers. It is as though a committee of engineers and consultants sat together and said "How do we create the perfect vehicle for as many different types of scams as possible?" - Maybe! instant settlement - No standardized audit trail - No way to know who's really on the other side - Send money into the void - 2FA but not really
  • xboxnolifes 3y ago
    - No standardized audit trail - No way to know who's really on the other side I think these 2 are the biggest ones. You put in someone's phone number / email, and you get maybe an associated name as reassurance. How do I know it's actually associated with an account the person I'm trying to pay has access to?
    • jdmichal 3y ago
      Ideally you know that because banks have KYC (Know Your Customer). And Zelle accounts must be populated by a bank. Individuals cannot just create a Zelle account. They must open an account with a bank -- and thereby undergo KYC -- who then creates their Zelle account.
• cvccvroomvroom 3y ago
  It's like cash. It's not the problem, scammers are. Sounds to me some big banks and fintech got their lobbyists to stick it to Zelle.
  • birdyrooster 3y ago
    Zelle is the big banks
• ForOldHack 3y ago
  Oh really! Surprise Surprise! A new cash app, defrauds customers. I have not lost a cent because I do not trust any of them, except for Money Orders.