Milt Tipperman had never heard of Zelle before April 18, but he learned about the P2P payment app quickly when 8 fraudulent Zelle transactions drained $800 from him checking account.
“I was mad, and I still am,” says Tipperman, of Maryland. He says his bank, PNC, is investigating, but when I spoke to him on Monday, he was still short the money. “I have never used or even heard of Zelle before. I have never used my cell phone to do banking …They apparently provide a service to people who choose to use their service, but for everyone else who do not use their service, they are a threat.”
(UPDATE 4/29/19: Zelle has confirmed to me that consumers who are victims of this fraud are entitled to Reg E protection.. That means banks should not be denying disputes, and should be refunding consumers’ money. See full statement below. )
Zelle is exploding in popularity with consumers, and apparently, with fraudsters, too. Designed by big banks to compete will digital-age P2P apps like Venmo, Zelle has continued to pick up steam. The firm that manages Zelle, Early Warning, says that 5,000 financial institutions are signed up to use the network. Just one, Bank of America, reported recently that its Zelle transaction volume has doubled in a year, to 58.1 million transactions, up from 28.6 million in 2018’s first quarter. The value of the payments from $9 billion to $16 billion during that span.
Last year also saw an avalanche of complaints against the service, too, as users found out the hard way that their transactions come with no credit-card-style fraud protections. Fraudsters seized on this; a typical scam involved requesting Zelle payments for concert tickets that were never delivered. Zelle warns users to treat its payment system like cash, and doesn’t help consumers who unknowingly send money to criminals.
But recently, a new spate of fraud complaints using a method that’s more troubling has hit Zelle — complaints from consumers like Tipperman, who’ve never signed up for the service.
As with last year’s round of fraud complaints, consumers are frustrated because many feel like they are bounced back and forth between their bank and Zelle, with neither entity taking responsibility for the fraud — or making quick offers to refund consumers, which is standard with credit or debit card fraud.
Early Warning told me it is investigating Tipperman’s complaint, but did not offer comment by press time. PNC vice president of media Amy Vargo said the firm couldn’t comment on specific customers, but said Tipperman’s case had been escalated.
It appears criminals have found a way to open Zelle accounts attached to consumers’ existing bank accounts and then send money to themselves.
In Tipperman’s case, criminals completed 8 transactions sent to three different recipients.
“The first person I talked to said we must have given our ID and password to somebody. Of course, that didn’t happen,” Tipperman said. He has since closed his bank account and expects he’ll be reimbursed for the fraud. Still, he’s frustrated.
“When I called Zelle, I was told they can do nothing since their records use phone numbers and my phone number is not in their records. So a thief is using their (own) cell number to open a Zelle account using my bank account. My bank, PNC, said they cannot block Zelle transactions from my account.”
It’s not hard to find similar-sounding complaints online, several from around the same time period as Tipperman.
“Our online banking was compromised and money was moved via Zelle. We were told this was our doing. We are victims and are being treated as crooks. Legal action might be necessary,” wrote Eric Beckerle on Twitter on April 18. Beckerle confirmed to me later that his request for a refund had been denied.
“We have never used Zelle and yet someone was able to gain access to our account, activate Zelle and send money to an email address without our knowledge or consent. We were told by the banks investigators that the transaction was legitimate and they denied our claim,” he said.
In March, another Twitter use wrote: “I woke up this morning to find $1,000 in fraudulent transactions from Zelle to my TDBank_US account. Turns out I’m seeing dozens of stories this morning of rampant bank fraud associated with Zelle.”
The problem isn’t new. Last May, NBC reported a string of similar-sounding account takeover fraud events.
“Consumers like Brad Miller say they’ve been robbed in a matter of seconds,” it wrote. “Miller said he’s banked with Wells Fargo for more than 29 years. He said everything was fine until recently, when he got an alert on his phone saying his Wells Fargo password had been changed.”
It’s unclear what security tools Zelle uses to authenticate bank account holders at signup, permitting them to link bank accounts to their smartphones for instant payments. One possible scenario: Criminals are using typical credential-stuffing attacks to gain access to victims’ online bank accounts, then using that access to arrange Zelle transfers. Or they could be tricking victims into divulging login information some other way.
Last year, Zelle told NBC it was taking reports of non-Zelle user attacks seriously and has implemented several systems to prevent such fraud.
“We are listening to, and acting on feedback, working closely with our financial institution partners to resolve issues quickly, or addressing situations directly when the Zelle app is used to originate a transaction…. We and our partner financial institutions each apply multiple layers of protection across both the Zelle app and the mobile banking apps, respectively, alongside 24/7 fraud monitoring at the network level,” the firm said.
UPDATE: Statement from Early Warning, the network operator of Zelle:
“In a case where a consumer’s bank account or debit card is compromised, or a Zelle payment is made from a consumer’s account and not authorized by that consumer, consumers have rights under the Electronic Funds Transfer Act (also known as “Reg E”). Those consumers should contact their bank to determine an appropriate resolution.”
I received an email from my bank last week that there was an attempt to register my debit card with Zelle. I now get even more notifications for any transaction. I assume they’re using information that was stolen during the Experian breach, security questions and all of the other information needed.
It may have been the Equifax breach it’s hard to keep up with all the companies that have compromised our information.
PNC sent no notification to me about zelle. PNC freely sent money via zelle from my debit account to theives. PNC is investigating my request for reimbursement. Zelle told me there is nothing they can do!
Can you call PNC and ask who deals with identity theft, USAA fealty with mine as identity theft and fraud. I also tried to opt out of Zelle.
PNC Bank – we can’t do anything to stop someone robbing you via Zelle, but by God don’t you dare use your credit card after notifying us that you’re traveling, because our Fraud dept. will harass you via robo/personal calls, then turn the card off, because we care…about ourselves!
Rest of the story. Never heard from zelle, after I asked them to take my information and give me a case number. I reported the theft to my bank, PNC, on Sunday April 21. On April 23, PNC reimbursed my account the $900 stolen through zelle and closed their investigation. PNC told me they cannot block zelle transactions from my account; that would have given me peace of mind.
similar situation.It is unacceptable for Zelle’s whitewashing attitude.After all,it is their poorly fraud protection.I understand some part that they are the middle between banks and transaction dispute or fraud should be the bank’s move.But when I talked about my story to bank,they also said nothing they could do.Excuse me?I am the victim by their system loophole.
On selling on Craig’s list, I got a call from a friendly lady who wanted to buy my furniture. She said she couldn’t pick it up right away but would send a deposit by Zelle. I said ok since I have gotten deposits to my checking act by Zelle before. She sent me the money on my cell phone. The message said money sent from her name by Zelle and that I had to register my bank account to receive it.
When I clicked on that link – that looked very secure and official- it had me choose my bank and I had to enter my bank account password and user name. I felt funny giving this out since I had deposits of Zelle before and not had to register. Still, I thought it may be valid to have to register on my cell phone so I went to my computer to investigate before I put in my bank user name and password. The url she gave me for my registration of Zelle on my cell phone was not to be found. I considered that if I put my bank info into the phone and she was a scammer she could empty my bank account. So I told her that I only wanted cash for the furniture. She disappeared.
I had the same thing happen where I didn’t know what Zelle was and $1000 was taken from my PNC account through Zelle. When I filed a fraud report they called me a criminal and said that I made the transaction, which never happened.
How can I get my money back???
Zelle was absolutely no help to me! They take no responsibility that criminals are using their system. My bank was very helpful. Except they said they had no way to block zelle transactions from my accounts. My bank closed the account money was stolen from. Good luck!
Zelle is a joke!Keep communicating and they keep telling me they have no loophole.I asked if there is verification from me then the record could be traceable so they can blame me.otherwise stop telling me I make somebody use my phone or it is my move to enroll other account.So pissed by the failed protection!