Essay

Why fraud models should only propose. By Amir Shachar.

Read the essay
Skip to content
Riskernel

Teardowns · 003

Zelle 2017 to 2025: an instant-payment rail and the scams that rode it

By Riskernel · · Sources accessed 2 November 2026

A payment that arrives in seconds is also a payment a scammer can collect in seconds, so the sign-up, the screen the sender sees and the reimbursement rule carry the risk.

How to read the tags. Confirmed means a public source we cite states it. It does not mean we verified it ourselves. Not yet confirmed is a hypothesis we would test in a review. For a lawsuit, “Confirmed” means the source reports the allegation. An allegation is not a court finding, and the operator disputes it [1][2]. The operator’s rebuttal is included below.

Court and regulator detail is cited as reported. Detail on this page from the New York complaint, the federal complaint, the Senate reports and the Attorney General’s press release of 13 August 2025 is taken from press and law-firm summaries of those documents.

Events 2017 (launch); October 2022 (Senate staff report); December 2024 to March 2025 (federal suit filed and dismissed); August 2025 (New York suit)

What happened

In 2017 the company that runs Zelle (Early Warning Services, EWS) launched the Zelle app, describing it as a “faster, safer way” to send and receive payments [1]. Zelle’s website says the app had 151 million users as of 2024 [1].

On August 13, 2025, New York Attorney General Letitia James sued the operator, EWS, in state court [1][2]. The suit alleges scammers stole more than one billion dollars from 2017 to 2023 [1]. It alleges EWS built a “quick registration process” without adequate verification, and showed customers limited information during a transaction, so fraudsters could use false email addresses to trick consumers [1][2]. It alleges EWS failed to enforce its anti-fraud rules on partner banks, although it knew they were violating them [1], and that it “did not require reimbursement for induced fraud” [3].

EWS called the suit a “political stunt” and a “copycat” of a federal suit by the Consumer Financial Protection Bureau, filed in December 2024 and dismissed in March 2025 [1][3]. Separately, in October 2022 a report from a US Senator’s office, using data from banks that own Zelle, found those banks reimbursed 47% of the amount customers reported as fraud between 2021 and the first half of 2022 [4]. Banking and payments trade groups answered that 99.9% of the 5 billion transactions on the network were sent without any reported fraud or scam [4].

Attack tree

How the flow was abused.

Root goal: make a victim’s money land in an account the attacker controls, before anyone can stop it. Leaves marked Hypothesis are ours to test, not facts from the record.

GOAL Make a victim’s money land in an account the attacker controls, before anyone can stop it
  1. AGet a receiving destination that cannot be traced to the scammer
    1. A1Enrol with a quick registration and thin verification
    2. A2Use a false or look-alike email address as the alias
  2. BMake the sender approve the payment
    1. B1Persuade the sender (induced payment)
    2. B2Rely on the limited information shown at confirmation
  3. CTake over the sender’s session instead
    1. C1Get around identity checks to control a real user’s account
  4. DExploit gaps after the payment
    1. D1Reimbursement not required for induced payments
    2. D2Network rules not enforced on every participating bank
    3. D3Test: can funds move onward before a recall?Hypothesis
Public record Built from public reporting and law-firm summaries of an Attorney General suit, which the operator disputes. Allegations are attributed to the New York Attorney General. High, Medium and Low are our qualitative judgement of likely loss per leaf, based on what the sources allege about scale, not dollar estimates.

Findings

Confirmed 6

F-02 Confirmed

Alleged: the sender saw little before confirming.

The suit alleges that limited information shown to customers during transactions let fraudsters use false or fraudulent email addresses to trick consumers.

F-05 Confirmed

Reimbursement differed by case type.

In the Senate staff data, unauthorized transactions fall under a Zelle policy that requires participating institutions to reimburse, while authorized transactions a scammer influenced carry no promise of reimbursement. Banks that own Zelle reimbursed 47% of the amount customers reported as fraud, 2021 to the first half of 2022.

F-06 Confirmed

The operator and bank groups dispute the scale.

EWS said the proportion of fraud and scams “has steadily decreased” since the 2017 launch, and four bank trade groups said 99.9% of 5 billion transactions had no reported fraud or scam.

Not yet confirmed 1

F-07 Not yet confirmedHypothesis

Test: does a recipient-name check, a first-payment limit or a short hold cut induced losses?

No source we read tests these. We would test, on a rail like this, whether showing the verified name of the account holder, warning when a typed alias does not match that name, and limiting or briefly holding a first payment to a newly enrolled recipient would change outcomes, and what they cost in friction.

Evidence
No public source we read states this. Sources read: [1] CBS News MoneyWatch, 13 August 2025 (updated) · [4] Banking Dive, 4 October 2022

The three controls that matter most

For a fintech about to launch instant transfers, push payments or a wallet-to-wallet feature:

  1. Verify the receiving side before money can move to it. Tie every receiving alias (email, phone) to a verified identity at enrolment. At payment time, show the sender the confirmed account-holder name and warn or hold when it does not match what they typed.
  2. Put limits on new relationships. A newly enrolled recipient, or a first payment to a new payee, gets a lower limit, a short hold or a one-tap “are you sure?” with scam-specific wording. Watch the receiving side too: many unrelated senders paying a new recipient who forwards the money onward is a pattern worth scoring.
  3. Decide the reimbursement and recall rules before launch, and enforce them on every participant. Write down who pays when a customer is induced to send money, how fast a payment can be frozen or recalled, and how network rules are checked on each partner. One allegation in the suit is that rules existed on paper and were not enforced.

Sources

Date accessed for every source: 2 November 2026. Numbers on this page are only those a cited source states. Headlines are quoted with any dollar figure written in words, in square brackets.

  1. CBS News MoneyWatch. “New York AG sues Zelle parent company, alleging shortcomings allowed scammers to steal [one billion dollars].” Published 13 August 2025 (updated). Accessed 2 November 2026.
  2. Hunton Andrews Kurth, Privacy and Cybersecurity Law Blog. “New York Attorney General Sues Zelle for Inadequate Account Security and Verification Measures.” Published 22 August 2025. Accessed 2 November 2026.
  3. Consumer Finance Monitor (Ballard Spahr). “NY Attorney General sues Early Warning Services for Zelle Network’s lax security measures.” Published 29 September 2025. Accessed 2 November 2026.
  4. Banking Dive. “Banks reimburse less than half of Zelle-related fraud claims, [Senate report] says.” Published 4 October 2022. Accessed 2 November 2026.

Detail on this page from the New York complaint, the federal complaint, the Senate reports and the Attorney General’s press release of 13 August 2025 is taken from press and law-firm summaries of those documents.