Sending bank fails to disclose irreversability of a transaction implying that typical consumer protection takes place.

Receiving bank fails to detect simple fraud pattern: Within short period of time: New account opened, Zelle transfer received, Money withdrawn.

Let it rinse and repeat for long enough - and class action will take place.

Bank-fraud laws existed for multiple decades longer than there was the (arguably unconstitutional) CFPB, so I'm confident that any activities which actually violate the law will, eventually, be curtailed.