Zelle fraudsters find new victim pool: Consumers who don’t even use Zelle

Milt Tipperman had never heard of Zelle before April 18, but he learned about the P2P payment app quickly when 8 fraudulent Zelle transactions drained $800 from him checking account.

“I was mad, and I still am,” says Tipperman, of Maryland. He says his bank, PNC, is investigating, but when I spoke to him on Monday, he was still short the money. “I have never used or even heard of Zelle before. I have never used my cell phone to do banking …They apparently provide a service to people who choose to use their service, but for everyone else who do not use their service, they are a threat.”

(UPDATE 4/29/19: Zelle has confirmed to me that consumers who are victims of this fraud are entitled to Reg E protection.. That means banks should not be denying disputes, and should be refunding consumers’ money. See full statement below. ) 

Zelle is exploding in popularity with consumers, and apparently, with fraudsters, too.  Designed by big banks to compete will digital-age P2P apps like Venmo, Zelle has continued to pick up steam. The firm that manages Zelle, Early Warning, says that 5,000 financial institutions are signed up to use the network.   Just one, Bank of America, reported recently that its Zelle transaction volume has doubled in a year, to 58.1 million transactions, up from 28.6 million in 2018’s first quarter. The value of the payments from $9 billion to $16 billion during that span.

Last year also saw an avalanche of complaints against the service, too, as users found out the hard way that their transactions come with no credit-card-style fraud protections. Fraudsters seized on this; a typical scam involved requesting Zelle payments for concert tickets that were never delivered. Zelle warns users to treat its payment system like cash, and doesn’t help consumers who unknowingly send money to criminals.

But recently, a new spate of fraud complaints using a method that’s more troubling has hit Zelle — complaints from consumers like Tipperman, who’ve never signed up for the service.

As with last year’s round of fraud complaints, consumers are frustrated because many feel like they are bounced back and forth between their bank and Zelle, with neither entity taking responsibility for the fraud — or making quick offers to refund consumers, which is standard with credit or debit card fraud.

Early Warning told me it is investigating Tipperman’s complaint, but did not offer comment by press time. PNC vice president of media Amy Vargo said the firm couldn’t comment on specific customers, but said Tipperman’s case had been escalated.

It appears criminals have found a way to open Zelle accounts attached to consumers’ existing bank accounts and then send money to themselves.

In Tipperman’s case, criminals completed 8 transactions sent to three different recipients.

“The first person I talked to said we must have given our ID and password to somebody. Of course, that didn’t happen,” Tipperman said.  He has since closed his bank account and expects he’ll be reimbursed for the fraud. Still, he’s frustrated.

“When I called Zelle, I was told they can do nothing since their records use phone numbers and my phone number is not in their records. So a thief is using their (own) cell number to open a Zelle account using my bank account. My bank, PNC, said they cannot block Zelle transactions from my account.”

It’s not hard to find similar-sounding complaints online, several from around the same time period as Tipperman.

“Our online banking was compromised and money was moved via Zelle. We were told this was our doing. We are victims and are being treated as crooks. Legal action might be necessary,” wrote Eric Beckerle on Twitter  on April 18. Beckerle confirmed to me later that his request for a refund had been denied.

“We have never used Zelle and yet someone was able to gain access to our account, activate Zelle and send money to an email address without our knowledge or consent. We were told by the banks investigators that the transaction was legitimate and they denied our claim,” he said.

In March, another Twitter use wrote: “I woke up this morning to find $1,000 in fraudulent transactions from Zelle to my TDBank_US account. Turns out I’m seeing dozens of stories this morning of rampant bank fraud associated with Zelle.”

The problem isn’t new.  Last May, NBC reported a string of similar-sounding account takeover fraud events.

“Consumers like Brad Miller say they’ve been robbed in a matter of seconds,” it wrote. “Miller said he’s banked with Wells Fargo for more than 29 years. He said everything was fine until recently, when he got an alert on his phone saying his Wells Fargo password had been changed.”

It’s unclear what security tools Zelle uses to authenticate bank account holders at signup, permitting them to link bank accounts to their smartphones for instant payments.  One possible scenario: Criminals are using typical credential-stuffing attacks to gain access to victims’ online bank accounts, then using that access to arrange Zelle transfers. Or they could be tricking victims into divulging login information some other way.

Last year, Zelle told NBC it was taking reports of non-Zelle user attacks seriously and has implemented several systems to prevent such fraud.

“We are listening to, and acting on feedback, working closely with our financial institution partners to resolve issues quickly, or addressing situations directly when the Zelle app is used to originate a transaction…. We and our partner financial institutions each apply multiple layers of protection across both the Zelle app and the mobile banking apps, respectively, alongside 24/7 fraud monitoring at the network level,” the firm said.

UPDATE: Statement from Early Warning, the network operator of Zelle

“In a case where a consumer’s bank account or debit card is compromised, or a Zelle payment is made from a consumer’s account and not authorized by that consumer, consumers have rights under the Electronic Funds Transfer Act (also known as “Reg E”). Those consumers should contact their bank to determine an appropriate resolution.”

 

 

About Bob Sullivan 1342 Articles
BOB SULLIVAN is a veteran journalist and the author of four books, including the 2008 New York Times Best-Seller, Gotcha Capitalism, and the 2010 New York Times Best Seller, Stop Getting Ripped Off! His latest, The Plateau Effect, was published in 2013, and as a paperback, called Getting Unstuck in 2014. He has won the Society of Professional Journalists prestigious Public Service award, a Peabody award, and The Consumer Federation of America Betty Furness award, and been given Consumer Action’s Consumer Excellence Award.

6 Comments

  1. I received an email from my bank last week that there was an attempt to register my debit card with Zelle. I now get even more notifications for any transaction. I assume they’re using information that was stolen during the Experian breach, security questions and all of the other information needed.

  2. PNC sent no notification to me about zelle. PNC freely sent money via zelle from my debit account to theives. PNC is investigating my request for reimbursement. Zelle told me there is nothing they can do!

    • Can you call PNC and ask who deals with identity theft, USAA fealty with mine as identity theft and fraud. I also tried to opt out of Zelle.

  3. PNC Bank – we can’t do anything to stop someone robbing you via Zelle, but by God don’t you dare use your credit card after notifying us that you’re traveling, because our Fraud dept. will harass you via robo/personal calls, then turn the card off, because we care…about ourselves!

  4. Rest of the story. Never heard from zelle, after I asked them to take my information and give me a case number. I reported the theft to my bank, PNC, on Sunday April 21. On April 23, PNC reimbursed my account the $900 stolen through zelle and closed their investigation. PNC told me they cannot block zelle transactions from my account; that would have given me peace of mind.

2 Trackbacks / Pingbacks

  1. Here's how hackers are using Zelle to raid bank accounts; and why victim was out $1,800 until I wrote to the bank — bobsullivan.net
  2. VIDEO: Zelle fraud includes clever text message intercepts, foiling two-factor authentication — bobsullivan.net

Leave a Reply

Your email address will not be published.


*


This site uses Akismet to reduce spam. Learn how your comment data is processed.