The Outlier Lab

Case Study - Zelle Scam Liability Disputes (2024-2025)

The CFPB sued Zelle's operator and three owner banks over scam and fraud losses in December 2024, then dropped the case; New York's AG refiled under state law in 2025.

What happened

  • The rail. Zelle moves money between bank accounts almost instantly. Once a payment reaches an enrolled recipient, the sender generally can't recall it. That makes it the preferred US rail for Impersonation Scams, fake-goods scams and ATO cash-out (Real-Time Payment Rail Fraud).
  • The CFPB theory (December 2024). The Bureau alleged unfair practices under the Consumer Financial Protection Act against all four defendants, and violations of the Electronic Fund Transfer Act and Regulation E against the banks. Reported allegations included limited identity verification at enrollment, repeat offenders being able to move from bank to bank on the network, and banks failing to investigate complaints properly or reimburse when required. The Bureau put losses at more than $870M at the three banks over seven years, with hundreds of thousands of complaints.
  • The dismissal (March 2025). The CFPB voluntarily dismissed with prejudice on March 4, 2025, and the court closed the case on March 5. This came as the Bureau's enforcement program was being cut back sharply. The case was not decided on the merits.
  • The state refiling (August 2025). New York's AG sued EWS in state court in Manhattan under state consumer-protection law. The complaint alleges EWS knew from the start that the network's design left it open to fraud, considered safeguards around 2019 but adopted them only in 2023 after congressional and CFPB scrutiny, and didn't enforce anti-fraud rules on participating banks. It cites ATO, fake goods, and impersonation of banks, government agencies and utilities. It seeks safeguards, restitution and disgorgement. The complaint says reported fraud losses fell sharply after the 2023 safeguards.
  • The industry's position. EWS and the banks call the suits political. They say more than 99.95% of Zelle payments involve no fraud or scam report, and that making the network liable for authorized payments would invite false claims and raise costs.

Timeline

DateEvent
2017Banks begin offering Zelle
~2019Internal safeguard recommendations allegedly considered but not adopted (per the NY AG)
September–October 2022Senate Banking hearing and Sen. Warren report criticizing scam refunds on Zelle
June 30, 2023Zelle network rules change: participating institutions must reimburse certain qualifying impostor scams (victims tricked into paying someone posing as a government agency, a bank or an existing service provider), and institutions must adopt a risky-transfer flagging tool. The NY AG treats the 2023 changes as long-delayed basic safeguards.
December 20, 2024CFPB sues EWS, JPMorgan Chase, Bank of America and Wells Fargo (D. Ariz., 2:24-cv-03652)
March 4–5, 2025CFPB voluntarily dismisses with prejudice. Court closes the case.
April 2025Standalone Zelle app shut down. Zelle is used only through bank apps.
July 2025Congressional Democrats write to owner banks about fraud monitoring
August 13, 2025NY AG sues EWS in New York state court
February 2026Federal court remands the NY case to state court (per press)
July 20, 2026Justice Phaedra Perry-Bond (N.Y. Sup. Ct., N.Y. County, Index No. 654753/2025) denies nearly all of EWS's motion to dismiss. She rejects the argument that a network operator can't be liable for third parties' fraud, because the complaint targets EWS's own design, monitoring and marketing choices. Some claims or theories are trimmed. Zelle says it will appeal.

Mechanisms involved

Control gaps

Gap (alleged)Why it mattered
Light identity verification at enrollmentScam recipients could enroll and receive funds easily (KYC and Customer Identification Program (CIP), Identity Verification Outcomes)
Weak network-level offboardingRecipients flagged at one bank could keep receiving at others (Negative Lists and Deny Lists, Consortium and Data Sharing)
Error resolutionComplaints allegedly denied or poorly investigated (Regulation E and Unauthorized Transfers)
Few payment-time interventionsLittle friction on first payments to new payees (Payee Confirmation and Payment Friction, Payee and Counterparty Risk)

Detection and response

The industry's main response was product-level. It adopted network safeguards in 2023, and at the bank level added new-payee limits, confirmation steps and scam warnings. It also retired the standalone app so every payment goes through a bank's own risk controls. The June 30, 2023 rule change requires participating institutions to reimburse qualifying impostor scams, where the victim pays someone posing as a government agency, a bank or an existing service provider, and to use a risky-transfer flagging tool. Zelle says the benefit goes beyond what law requires. EWS has declined to publish the exact qualifying criteria, saying that would give criminals a roadmap, and has not published reimbursement data. Victims continued to report denials in 2024.

Outcome

  • Federal: CFPB case dismissed with prejudice in March 2025. No liability finding and no money recovered.
  • State: NY case largely survived the motion to dismiss in July 2026. The ruling addressed only the pleadings. Zelle has said it will appeal.
  • Policy: the US still has no mandatory reimbursement for authorized scams, unlike the UK (Case Study - UK APP Scam Reimbursement Rules (2024)). Liability is being fought case by case and state by state.

Lessons for practitioners

  1. The authorized/unauthorized line is under pressure. Reg E covers unauthorized transfers, and courts and regulators are testing how far "induced by fraud" stretches. Classify carefully, because the label decides who pays (Regulation E and Unauthorized Transfers, Loss Taxonomy and Attribution).
  2. Receiving-side controls are part of your exposure. The central allegation is that scam recipients got onto the network too easily and stayed too long. Inbound mule detection and fast offboarding are a liability defense as well as a fraud control (Playbook - Money Mule Detection Members, Fast In Fast Out Patterns).
  3. Use friction on the risky payments. New payee, first large amount, and contact with the customer just before payment are where targeted friction pays off (Scam Victim Indicators, Customer Contact Signals, Playbook - Scam Intervention Members).
  4. Document your error-resolution decisions. Both suits rely on complaint handling. Defensible, consistent investigations with written reasoning matter in any enforcement environment (Case Documentation Standards, Fraud QA Program).
  5. Expect state enforcement when federal enforcement pulls back. When the CFPB stepped back, a state AG picked up the theory. Plan compliance for the strictest active regulator (US Regulatory Overview).
  6. Network data sharing is a selling point. A network that shares recipient risk across members can catch repeat offenders that no single bank sees (Consortium and Data Sharing, Payments and P2P).

Sources