Warren Calls Out Wells Fargo and Zelle for “Evasive” Responses about Fraud

She calls out scenarios where people willingly sent money to someone over Zelle themselves. This wasn’t a compromised account; it was people being conned by other individuals (think Nigerian Prince). Why should Zelle be on the hook for someone being stupid? They did exactly their job.

Should the US Mint refund me money if I gave a fraudster cash?

Update: Love the comments below folks. I get it now.

1. subject had a bank account with the ability to link to Zelle

2. subject turned on Zelle to receive money from a family member

3. several high dollar Zelle transactions were made - subject claims that they were at home with covid and no one had access to her phone

4. she calls bank to cancel transactions, bank refunds money

5. bank investigates and claims face id and her IP address was used and takes refunds back

6. subject takes bank and zelle to court

7. Zelle says: we are just a middleman - not our responsibility

8. bank claims that it can't investigate where the money went because it was instant transferred

9. banks settles for some of the money

Conclusion? If you have to use Zelle or Venmo, attach it to a bank account with limited funds in it.

Pros and cons. The consumer is at risk, well don’t be an idiot consumer. No different than giving someone cash and them running away.

I asked my bank if it could be reversed. They said no, but I could return it to the sender by initiating a new Zelle transfer. The transaction only showed the sender's name; I asked my bank if they could provide me with a Zelle address, and they said no, I needed to ask the sender for that information.

This was obviously impossible and the whole situation smelled fishy. I let it sit for a few days, and got an email from someone with the same name, asking for their $500 back. It was a lot of money to them, they made a mistake, and their bank wasn't helping them recover it at all. I couldn't decide if it was a scam or not. I ended up sending $500 to the address I received the email from. They thanked me profusely, and I never heard about it again.

A few days after this email, I got a frantic call from my Mom saying that someone stole $5000 out of her bank account, and the bank won't reverse the transaction. It turned out that someone called her claiming to be some antivirus software provider, convinced her to share her screen, and transferred out a chunk of money with Zelle. The email I got, and her bank, both warned that it was irreversible. And thus far, it seems unable to be reversed.

To me, this violates a fundamental assumption of banking. If someone takes your money without your consent, you typically have recourse through customer service (often works) and the legal system (almost always works, but costly). This fundamental assumption was thrown away overnight without informing anyone about it. One day, you log into your bank and maybe you can pay a bill to a known physical address. The next day, people in other countries can drain your entire bank account. It's kind of a shock; no 2FA rollout, no way to opt out, just a ticking time bomb that came out of nowhere. My bank has it; nobody ever told me about it.

My takeaway is that people aren't really ready for irreversible bank transactions. They have literally no way to understand what that even means. Sure, there's crypto, but most cryptocurrency users are pretty technical, and knew they were entering untested waters, and did so with extensive education. It has simply never been a thing in the "traditional" financial world.

The problem here, then, is that people don't associate things like "screen sharing" with taking money. They have had weird charges on their credit card before, and in those cases, called their bank and the charges were instantly forgiven. So they protect their computer with that level of security; "if I allow this screenshare, I might get a virus or worst case, something bad might happen and I'll have to make a call to my bank within 6 months after reviewing my statement". Zelle moved the goalposts; if someone uses your unlocked workstation or guesses your 4 character password, all your money is gone with no legal repercussions.

I think this is maybe fine if you opt in to be an early adopter, or your bank rolls out crypto-like payments with the requirement that you enable 2FA and have a 239847 character password every time you transfer money, but it doesn't seem like they did any of that. They just turned a safe system into an unsafe system while nobody was watching. Congress should look into that; the implementation was botched and innocent people were hurt.

(I shouldn't have to say this, but people being scammed aren't idiots. My Mom has a PhD and has written multiple scientific papers. She is a little too trusting of people claiming to help with computers and honestly doesn't understand the computery world. But I blame us, the people that make those systems and that software, not her. Ordinary people just want to send email and pay some bills in between their lives real demands. We have fucked it up severely, and the banks did a particularly bad job here. Windows Hello asking "Enter your PIN" before sending money would have stopped the screenshare attack. There's more security required to look at my Grafana dashboard that shows the humidity level of my 3D printing filament than there is around stealing $5000. That's egregiously irresponsible, and victim blaming isn't going to do anything other than ensure that the field of software dies.)