“Defendants have leaned into these consumer expectations and have widely marketed Zelle, such as through their websites, television, podcasts, radio, and on social media. Defendants encouraged consumers to use Zelle by promising that it is ‘safe’ or ‘secure,’ and EWS even encouraged consumers to use Zelle to ‘pay it safe.'”

💡 The defendants actively exploited consumer trust while knowing their fraud protections were inadequate.

“At its inception, Defendants focused on quickly bringing Zelle online to capture market share by leveraging their existing customer base and offering peer-to-peer money transfer services directly to those consumers. This rush to market was prioritized at the expense of consumers because Defendants have failed to institute effective anti-fraud measures for the network or otherwise comply with consumer financial protection laws.”

💡 The lawsuit explicitly states that defendants chose rapid growth over consumer protection.

“Since 2017, hundreds of thousands of consumers complained about being defrauded by Zelle users through various schemes. Yet consumers who went to their banks for help were largely denied relief, and some were even told to try getting their money back by contacting the person who had defrauded them.”

💡 Banks told fraud victims to contact their own criminals rather than providing meaningful assistance.

“Defendants could have taken numerous steps, both individually and collectively, to prevent much of the harm to consumers. In addition to failing their customers, Defendants’ actions and failures to act violated Federal consumer financial law.”

💡 The defendants knew how to prevent the fraud but chose not to implement the necessary measures.

“Defendants’ failures resulted in millions of complaints about Zelle fraud at these three banks alone, including complaints of over $290 million in fraud losses by 210,000 Bank of America customers, over $360 million in fraud losses by 420,000 Chase customers, and over $220 million in fraud losses by 280,000 Wells Fargo customers.”

💡 Nearly one million consumers across three banks lost over $870 million total to fraud the banks failed to prevent.

“EWS created a consumer sign-up process that was intentionally fast and frictionless, which allowed users to register for a Zelle token if they had a bank account and U.S.-based mobile phone number or email address and could access the email or mobile device to receive and enter a one-time passcode.”

💡 The deliberately minimal authentication made it equally easy for fraudsters to access the network.

“In September 2018, EWS required participating financial institutions to display the recipient’s first name at the point of transfer. But since then, EWS has not required participating financial institutions to display any additional identifying information that would help senders identify recipients, such as the recipient’s last name, the age of the token, or amount of time the user was on Zelle.”

💡 For years, consumers saw only first names when sending money, making impersonation fraud trivially easy.

“Since Zelle launched, each of the Defendant Banks has failed to prevent its own accountholders from using Zelle to defraud others, while also failing to protect other of its own accountholders from fraud when using Zelle. These failures were as basic as Defendant Banks not restricting the Zelle activity of their accountholders who engaged in Zelle fraud—or not sharing that information with EWS or other participating financial institutions on the Zelle network—which allowed those fraudsters to continue defrauding consumers across the Zelle network.”

💡 Banks allowed known fraudsters to keep operating even after receiving multiple complaints about them.

“Over the next six-plus years, EWS and Defendant Banks, including through their involvement on EWS committees and in their entity-specific materials, have repeatedly identified numerous fraud prevention failures, including with respect to authenticating, verifying, and displaying recipient names, fraud reporting, monitoring transfers, and identifying and blocking bad actors across the network. After identifying such measures, Defendants, however, took years to implement certain measures or have yet to implement other measures, almost eight years after Zelle’s launch.”

💡 The defendants identified the problems and solutions but deliberately delayed implementation for years.

“When investigating such Notices, each Defendant Bank has reviewed only records in its respective possession and not the other relevant information held by EWS—or the other participating financial institutions—all of whom have agreed to participate in the network.”

💡 Banks violated federal law by failing to conduct reasonable investigations using available information.

“Consumers had little reason to suspect that the Zelle network was rife with fraud. Consumers were not told about the lack of authentication and verification of Zelle users’ token identities, including Zelle token names, email addresses, and other identifying information. Consumers were not told about the lack of fraud prevention measures, including as to the lack of restriction of bad actors, lack of processes to pause or block suspicious transfers, and lack of information sharing about fraud. Instead, Defendants advertised the Zelle network to consumers using descriptions such as ‘safe,’ ‘secure,’ and ‘backed by the banks.'”

💡 Banks deliberately concealed Zelle’s vulnerabilities while marketing it as safe and secure.

“By July 2017, Zelle had launched and was rapidly growing. Accompanying Zelle’s rapid growth were significant fraud problems on the network.”

💡 The defendants knew about significant fraud problems immediately after launch but continued prioritizing growth.

“This level of authentication leaves consumers susceptible to fraud by bad actors. For example, in a scenario known as a token ‘takeover,’ a bad actor obtains a one-time passcode and token information from an unsuspecting consumer and reassigns that token to a deposit account in the bad actor’s control.”

💡 The basic authentication system allowed fraudsters to hijack consumer accounts and redirect payments.

“The network rules state that EWS will impose fees on participating financial institutions when it determines that they have failed to comply with certain network rules. [Redacted content indicating EWS failed to enforce its own rules].”

💡 Early Warning Services failed to enforce its own fraud prevention rules against participating banks.

“An early consumer complaint to Wells Fargo highlighted consumers’ belief that Zelle was secure: ‘The scammer assured me that the transaction was secure because I was using the Wells Fargo app. It is reasonable to assume that bank transactions are secure against fraud, and the design of the Wells Fargo app does not make it clear that Zelle is a distinct, non-secure service.'”

💡 Consumers trusted Zelle because it was embedded in their bank apps, exactly as the defendants intended.