CFPB sues JPMorgan Chase, Bank of America and Wells Fargo over Zelle payment fraud

The Consumer Financial Protection Bureau on Friday sued the operator of the Zelle payments network and the three U.S. banks that dominate transactions on it, alleging that the firms failed to properly investigate fraud complaints or give victims reimbursement.

The CFPB said customers of the three banks — JPMorgan Chase, Bank of America and Wells Fargo — have lost more than $870 million since the launch of Zelle in 2017.

Zelle, a peer-to-peer payments network run by bank-owned fintech firm Early Warning Services, allows for instant payments to other consumers and businesses and has quickly surged to become the biggest such service in the country. At the same time, Democrat lawmakers have stepped up criticism of banks in recent years over the financial crimes happening on Zelle.

“The nation’s largest banks felt threatened by competing payment apps, so they rushed to put out Zelle,” CFPB Director Rohit Chopra said in a statement. “By their failing to put in place proper safeguards, Zelle became a gold mine for fraudsters, while often leaving victims to fend for themselves.”

The suit is the latest move by the CFPB in the waning days of the Biden administration. Many of the actions it has taken, including steps to limit credit card late fees and overdraft charges, have been met with stiff opposition from banks and their trade groups. Corporations have had success pushing back against regulators by choosing legal venues known as friendly to suits challenging federal oversight.

In fact, JPMorgan said in August that it was considering litigation against the CFPB if the regulator sought to punish the bank for its role in the Zelle network.

The CFPB wants to force banks to stop their allegedly unlawful practices around Zelle and to pay an unspecified amount in penalties, it said.

But the three banks collectively reimbursed just 38% of those claims, according to a July Senate report that looked at disputed unauthorized transactions.

Banks say that they investigate each fraud claim, but that they often find that what customers say was fraud was technically a scam where customers authorized payments. In those cases, banks aren’t usually required to make customers whole.

The CFPB claimed that Zelle’s “limited identity verification methods” have allowed criminals to infiltrate the network, enabling them to divert payments and move between member banks that didn’t share information among institutions.

The agency also said that banks failed to properly investigate complaints about Zelle activity and didn’t consistently report fraud activity.

“The banks failed to fix glaring flaws in their systems even as hundreds of thousands of customers filed complaints about fraud,” Chopra told reporters during a call on Friday. “The banks knew their customers were having their money stolen, but since they weren’t bearing the cost of these losses themselves, they dragged their feet on fixing the problems.”

Early Warning Services has said that while transaction volumes rose in 2023, reports of scams and fraud fell by almost 50%, and that only a tiny fraction of payment volumes are disputed as fraud.

Zelle is the preferred way for cyber criminals to extract funds because it is faster than other remittance options, according to Tom Peacock, Director of Global Fraud Intelligence for cybersecurity firm Biocatch.