Warren Calls Out Wells Fargo and Zelle for “Evasive” Responses about Fraud

https://www.warren.senate.gov/oversight/letters/warren-calls-out-wells-fargo-and-zelle-for-evasive-inaccurate-and-misleading-responses-about-fraud-and-scams-on-zelle-calls-for-companies-to-publicly-release-all-data-on-zelle-fraud-and-scams

by rntn • 4 years ago

146 117 4 years ago

warren.senate.gov

kevin_thibedeau• 4 years ago

Instant ACH, what could possibly go wrong?

toomuchtodo• 4 years ago

Some fraud is a cost of instant payment infra. It must be built into the P&L of the system, with robust controls to prevent what can be prevented. Security and convenience must intersect, it’s just a matter of sussing out that point.

gleenn2• 4 years ago

The fact that ACH takes 3 days is actually because the original protocol was file and FTP based, where one bank would upload the transfer as a file to another's, and the other would return a file with exceptions or something within 3 days. If the first bank didn't see a file with exceptions in 3 days the first would actually wire the money. Money can move way faster and fraud can be detected, obviously some time for human intervention is good too but that wasn't baked into the solution on purpose as much as it was just a terrible protocol to begin with.

nrmitchi3• 4 years ago

because the original protocol was file and FTP based

As if that's not largely how it still works today? :sad-face:

gt565k• 4 years ago

It’s the price you pay for instant money in your account. I mean you want quick settlement or 3-4 days to access your money.

Pros and cons. The consumer is at risk, well don’t be an idiot consumer. No different than giving someone cash and them running away.

ceejayoz3• 4 years ago

People understand giving someone cash, though.

Zelle is implemented in a confusing way that's begging for fraud.

lotsofpulp3• 4 years ago

What is confusing about Zelle?

This is BoA’s page on Zelle, and it seems very clear to me:

https://www.bankofamerica.com/online-banking/mobile-and-onli...

Wells Fargo’s is similar.

https://www.wellsfargo.com/online-banking/zelle/

Wells Fargo FAQ:

What protections do I have when I use Zelle®?
You are protected in the unlikely event an unauthorized user accesses your consumer accounts and initiates payments using Wells Fargo Online or Wells Fargo Mobile.
However, because Zelle® is intended to replace instances where cash and checks are being exchanged, you do not have the same protections associated with a credit card or a debit card transaction, such as the ability to dispute purchase transactions. Once you send money with Zelle®, you cannot cancel the payment if your recipient has already enrolled. Neither Wells Fargo nor Zelle® offers a protection program for any authorized payments made with Zelle® – for example, if you do not receive the item you paid for or the item is not as described or as you expected.
We recommend you only send money to known and trusted recipients when using Zelle®.

gleenn2• 4 years ago

My friend also somehow had his Zelle compromised and then there also wasn't any ability for recourse. So now he removed all his online money services including Venmo, etc out of fear. Definitely not a great setup even if it is super nice to have instant deposits.

andirk2• 4 years ago

A good ole finger wag oughta learn em to not be professional fraudsters. Yeah. Worked real well with all the non-binding suggestions put in to law post-2008 banker scams.

ceejayoz3• 4 years ago

We're just gonna pretend Warren didn't propose and found the CFPB, are we?

lotsofpulp3• 4 years ago

CFPB is amazing. I had an employer sponsored HSA account from PNC, and PNC reps were giving me the run around about transferring money to another HSA custodian.

Sent one message on CFPB website describing my problem, and the next day I got a call from a “VP” at PNC letting me know my issue was resolved.

A simple matter that could have been solved if PNC had intended their customer service agents to actually solve my problem, but I assume was left unaddressed because transferring funds out is not of any benefit to PNC.

andirk2• 4 years ago

She did and has done a handful of other great things from her Senate seat. She also does very strong finger wags with the rest of them. Not aware of my denial of said org. Can you please quote? Or did you just do a strong finger wag at me :)

I want to add a rule to Senate/House committee procedures that you can't say a damn thing that isn't followed up with action. Their job is to VOTE on shit, not give their opinion.

culi• 4 years ago

CFPB is one of the few departments in government that are actually incredibly functional. Probably one of the best things to come out of American governance in a long time

eftychis• 4 years ago

Yeah. If the only bank they had prosecuted wasn't tiny Abacus, with its excellent low delinquency rate, they could "learn em."

When governments' motto became "too big to fail," they lost every right. And they signaled even banks not doing it, that it is a good idea to do so.

LorenPechtel2• 4 years ago

Where are they claiming it's anything but users falling for deceptive messages? The banks won't do anything because the transaction isn't fraudulent.

usea• 4 years ago

Lying to people in order for them to send you money is fraud.

Duped users are victims of fraud.

j-bos• 4 years ago

Agreed. That's why the fraudster's should be tried Using the bank records as evidence.

When someone opens an account in one's name, that's fraud on the bank, and the bank needs to pay for it until squeezing it from the scammer. When someone convinces one to send them money under false pretenses, that's on one and one needs to pay for it until squeezing it from the scammer.

miohtama2• 4 years ago

But are banks responsible for fraud? Should one make a criminal report and get your money back in a court?

NovemberWhiskey4• 4 years ago

No; the bank won't do anything because the transaction isn't unauthorized which is the operative word in the law.

LorenPechtel2• 4 years ago

Ok, yeah, same concept. I'm saying the transaction was initiated by the person, thus the transaction is not fraud. They were defrauded into making the transaction, but the fraud happened with the person, not the bank.

ajaimk• 4 years ago

I watched the hearing a while back and honestly don’t get the fuss Warren in making in this specific scenario.

She calls out scenarios where people willingly sent money to someone over Zelle themselves. This wasn’t a compromised account; it was people being conned by other individuals (think Nigerian Prince). Why should Zelle be on the hook for someone being stupid? They did exactly their job.

Should the US Mint refund me money if I gave a fraudster cash?

Update: Love the comments below folks. I get it now.

mimikatz• 4 years ago

The reason is incentives and lack of protections. If banks don't eat the cost of fraud they don't properly protect people from being preyed upon.

anon291• 4 years ago

Wire fraud is a huge problem already.

lotsofpulp3• 4 years ago

So people expect credit card/debit card level protection without paying the credit card/debit card fees or going through the process of merchant vetting by a payment processor?

mullingitover3• 4 years ago

Zelle is an alternative to ACH, and I’m glad it exists! However there are a lot of consumer protections in the ACH system, not so much with Zelle.

NovemberWhiskey4• 4 years ago

Like what? Zelle has exactly the same consumer protections as ACH, as far as I know. It's exactly the same consumer protection law in each case.

colechristensen2• 4 years ago

With other payment methods there are many methods to reverse transactions in response to fraud, which includes a person willingly sending money after being deceived. There’s no reason that an electronic payment method can’t provide that kind of protection, financial institutions have the responsibility to know who their customers are and to not facilitate fraud. They should be on the hook to be able to reverse a transaction.

A person should not be able to create an account, commit fraud, and run away with the proceeds. A bank is responsible for flagging suspicious transactions especially for new accounts… making them hold the bag when there is fraud means they will be motivated to accurately judge risk and refuse transactions when it is high.

miohtama2• 4 years ago

60% of fraud is “friendly fraud” where you send your money to your associate (or make online card payment), call bank, accuse fraud and double your money.

Alternative demand money back from a completely fine product and delivery.

With too much consumer protection friendly fraud goes up easily. People will scam the system other way around.

refurb5• 4 years ago

But banks never claimed their payment services were for buyers and seller, only cash transfers.

If you want consumer protection, either pay by credit card or use another service.

When I make a Zelle transfer I get a big warning (and a box I have to check) which says "You can't reverse this transfer once complete".

It's like complaining Amazon doesn't sell airline tickets. Of course not, they never intended to sell airline tickets.

none_to_remain• 4 years ago

making them hold the bag when there is fraud means they will be motivated to accurately judge risk and refuse transactions when it is high.

Except I would like to be able to use my own money, please

pasttense012• 4 years ago

Consider the payment system call cash: there is no way to reverse fraudulent transactions except via the court or criminal justice system. I think it is very reasonable to have an electronic cash payment system which you would use for the same purposes you currently use cash--mostly either in person transactions or with people you trust.

"A person should not be able to create an account, commit fraud, and run away with the proceeds."

Well this is what we have a criminal justice system for.

alxmdev2• 4 years ago

It doesn't have to be something egregious like the Nigerian Prince. It could be a Craigslist concert tickets deal where you pay in advance and never hear from the "seller" again. Why be callous to innocent victims? Unlike cash, Zelle is a digital system that could provide some protections for all parties involved, like the option to file a dispute.

dymk2• 4 years ago

Having charges be very difficult to reverse is a protection to the user. Treat it like cash which you don’t need to carry a wallet around for.

friedman23• 4 years ago

So every time I sell something on craigslist I need to worry about being drawn into some kafkaesque bureaucratic nightmare because someone might claim I didn't fulfill my end of the bargain? Got it, I'll just throw out my old stuff going forward.

Why doesn't the government just do their job and catch and prosecute criminals?

twblalock2• 4 years ago

If charges were easy to reverse, we would see the opposite type of scam: people buying things and then making false claims of fraud to get the charges reversed.

This happens all the time with credit card chargebacks already. It would happen with Zelle too, if it was easy enough.

ensignavenger• 4 years ago

The victim absolutely has the right to file a dispute. In a court of law, which exist for exactly that reason!

from2• 4 years ago

Zelle has low limits for this very reason. There are reversible payment methods available if you are transacting in a low trust situation. Warren and all these activist types are going to make selling on Craigslist effectively be cash only again, and all payment systems will just be Paypal with varying degrees of bad support.

themihai• 4 years ago

So all the digital payment methods must be a clone of paypal with "protections" for your own money? If paypal would be so great people would use only that trash.

LatteLazy• 4 years ago

Agreed. We need to draw a line between complex or technological fraud and "people giving away their money of their own free will then complaining".

judge2020• 4 years ago

I wonder how much reversal power will be possible with FedNow, releasing mid 2023. https://www.federalreserve.gov/newsevents/pressreleases/othe...

anonthrownaway• 4 years ago

Real world scenario I witnessed recently:

1. subject had a bank account with the ability to link to Zelle

2. subject turned on Zelle to receive money from a family member

3. several high dollar Zelle transactions were made - subject claims that they were at home with covid and no one had access to her phone

4. she calls bank to cancel transactions, bank refunds money

5. bank investigates and claims face id and her IP address was used and takes refunds back

6. subject takes bank and zelle to court

7. Zelle says: we are just a middleman - not our responsibility

8. bank claims that it can't investigate where the money went because it was instant transferred

9. banks settles for some of the money

Conclusion? If you have to use Zelle or Venmo, attach it to a bank account with limited funds in it.

gruez4• 4 years ago

8. bank claims that it can't investigate where the money went because it was instant transferred

They really couldn't, or their policies didn't allow handing out information without a subpoena? Given KYC laws, I'm sure that every financial institution involved probably has the records somewhere. As for the policy itself, I'm not so sure whether zelle refusing to hand over recipient information is a bad thing. If I'm selling something on facebook marketplace, I wouldn't want my counterparty to get my dox just because they cried foul. I'd want a judge to examine the request before zelle hands over my info.

rasz2• 4 years ago

Your story sounds possible with one exception, 8 "subject threatens to take bank and zelle to court". There is no universe where bank tells the judge it wont investigate.

jrockway2• 4 years ago

I didn't know that Zelle was a thing until one of my credit card issuers recently sent me an email along the lines of "don't use it, it's only for fraud". I immediately assumed that it was because they were sad that they weren't included in the alliance or something like that. They maybe have their competing service that they want to "win" instead, and the marketing department is now making it my problem. Turns out: nope. Not their angle. Their customers are losing money right and left and are unhappy about it, so at least they're trying to warn everyone.

A few days after this email, I got a frantic call from my Mom saying that someone stole $5000 out of her bank account, and the bank won't reverse the transaction. It turned out that someone called her claiming to be some antivirus software provider, convinced her to share her screen, and transferred out a chunk of money with Zelle. The email I got, and her bank, both warned that it was irreversible. And thus far, it seems unable to be reversed.

To me, this violates a fundamental assumption of banking. If someone takes your money without your consent, you typically have recourse through customer service (often works) and the legal system (almost always works, but costly). This fundamental assumption was thrown away overnight without informing anyone about it. One day, you log into your bank and maybe you can pay a bill to a known physical address. The next day, people in other countries can drain your entire bank account. It's kind of a shock; no 2FA rollout, no way to opt out, just a ticking time bomb that came out of nowhere. My bank has it; nobody ever told me about it.

My takeaway is that people aren't really ready for irreversible bank transactions. They have literally no way to understand what that even means. Sure, there's crypto, but most cryptocurrency users are pretty technical, and knew they were entering untested waters, and did so with extensive education. It has simply never been a thing in the "traditional" financial world.

The problem here, then, is that people don't associate things like "screen sharing" with taking money. They have had weird charges on their credit card before, and in those cases, called their bank and the charges were instantly forgiven. So they protect their computer with that level of security; "if I allow this screenshare, I might get a virus or worst case, something bad might happen and I'll have to make a call to my bank within 6 months after reviewing my statement". Zelle moved the goalposts; if someone uses your unlocked workstation or guesses your 4 character password, all your money is gone with no legal repercussions.

I think this is maybe fine if you opt in to be an early adopter, or your bank rolls out crypto-like payments with the requirement that you enable 2FA and have a 239847 character password every time you transfer money, but it doesn't seem like they did any of that. They just turned a safe system into an unsafe system while nobody was watching. Congress should look into that; the implementation was botched and innocent people were hurt.

(I shouldn't have to say this, but people being scammed aren't idiots. My Mom has a PhD and has written multiple scientific papers. She is a little too trusting of people claiming to help with computers and honestly doesn't understand the computery world. But I blame us, the people that make those systems and that software, not her. Ordinary people just want to send email and pay some bills in between their lives real demands. We have fucked it up severely, and the banks did a particularly bad job here. Windows Hello asking "Enter your PIN" before sending money would have stopped the screenshare attack. There's more security required to look at my Grafana dashboard that shows the humidity level of my 3D printing filament than there is around stealing $5000. That's egregiously irresponsible, and victim blaming isn't going to do anything other than ensure that the field of software dies.)

mixmastamyk• 4 years ago

It is not a misdesign, but an intentional one. A payment system can protect the buyer/sender or the seller/receiver (or expensively both aka escrow), as any of them are capable of committing fraud.

Zelle favors the receiver, which is convenient in some scenarios like sending to a family member on a whim.

If you want sender protection, use a credit card. With the restriction that KYC/merchant rules apply to the receiver, restricting supply.

Animats• 4 years ago

To me, this violates a fundamental assumption of banking. If someone takes your money without your consent, you typically have recourse through customer service (often works) and the legal system (almost always works, but costly). This fundamental assumption was thrown away overnight without informing anyone about it.

Yes. Which is why I won't use Zelle or PayPal with an account connection.

A friend runs a bank branch. She had four clients in one day who'd been scammed. Some despite SMS 2FA. Someone had convinced a cellular provider to issue them a new SIM card for an existing number.

rasz2• 4 years ago

convinced her to share her screen
without your consent
people aren't really ready for irreversible bank transactions. They have literally no way to understand what that even means

Normal bank wire transfers are irreversible. At certain age family should take care of their oldest and take away their ability to harm themselves. Car keys is another example, especially in countries with no oversite over senior drivers (hello CA where you can renew online while 70 and legally blind & bed bound).

amluto• 4 years ago

As I understand it, Zelle is fully subject to Reg E, and the transfer you are describing was not initiated by the victim. If 30 days have not elapsed, contact Zelle and the bank and tell them that, per Reg E, they must issue a refund. You can escalate to their legal team, to the regulators, and/or to small claims court.

This isn’t Europe where excuses like “the EMV chip says the transaction was valid, so it must be valid” supposedly fly. Reg E has no carveout for “well, we put really expensive locks in the door, but the bad guy came in the window.”

midislack• 4 years ago

Get outta here the same bank caught laundering for cartels? No way.

CyberDildonics2• 4 years ago

Wrong bank

gruez4• 4 years ago

https://en.wikipedia.org/wiki/Wells_Fargo#Failure_to_monitor...

chatterhead• 4 years ago

Wells Fargo has systemic corruption and needs to lose it's Charter.

greyface-2• 4 years ago

I have a firstnamelastname@gmail.com address. I get a lot of misdirected emails for others with the same name; usually I ignore them. It's linked to a Zelle account and one day I received an unexpected $500 deposit.

I asked my bank if it could be reversed. They said no, but I could return it to the sender by initiating a new Zelle transfer. The transaction only showed the sender's name; I asked my bank if they could provide me with a Zelle address, and they said no, I needed to ask the sender for that information.

This was obviously impossible and the whole situation smelled fishy. I let it sit for a few days, and got an email from someone with the same name, asking for their $500 back. It was a lot of money to them, they made a mistake, and their bank wasn't helping them recover it at all. I couldn't decide if it was a scam or not. I ended up sending $500 to the address I received the email from. They thanked me profusely, and I never heard about it again.

wildrhythms• 4 years ago

How did the sender find your email address to contact you?

greyface-2• 4 years ago

Zelle recipients are specified by email address or phone number. They sent the email to the same address that they sent the Zelle transfer to.

pasttense012• 4 years ago

This is unacceptable and should be corrected to allow a transaction to be reversed, otherwise a recipient is at risk for a scam.

pencilguin2• 4 years ago

I don't understand how Wells Fargo executives avoided being personally indicted for thousands of counts of fraud, for their previous activity, ordering underlings to create fake credit card accounts for poor customers and then suck them dry.

justin66• 4 years ago

Similarly, I can’t imagine why anyone still banks with them.

lvl102• 4 years ago

Wells Fargo and Bank of America are horrible banks. They deserve to go bankrupt and disappear. And anyone working at these places are despicable.

Warren Calls Out Wells Fargo and Zelle for “Evasive” Responses about Fraud

Related Stories