If you have linked any of your bank accounts to the money transfer app Zelle, you might want to reconsider that after perusing recent news. The CFPB (Consumer Financial Protection Bureau) has announced an investigation of various banks allowing the app to be used with their accounts, including JPMorgan Chase, Bank of America and Wells Fargo. The core issue being investigated by the government is that the app is generating a significant number of complaints from customers about substantial losses stemming from fraud and that these banks (to date…) have only reimbursed about 38 percent of the fraudulent transfers.
Virtually every bank supporting online banking allows wire transfers or ACH transfers to any other bank provided you have the full routing number and account number of the source/destination bank at the other end. So why does anyone need an “app” to transfer money?
Well, banks often charge a fee (fixed amount or percent, I’m not sure) for wire transfers. However, wire transfers undergo a great deal of human scrutiny at both the sending and receiving bank (hence the fee). ACH transfers use the same electronic backbone used to process every check so they are “free” but can incur processing delays of up to 24 hours and subsequent “deposit holds” of several days based on the destination bank’s internal rules for new arriving funds.
For many consumers trying to get money quickly and easily, these traditional online mechanisms seem cumbersome. Zelle was created to offer a few key advantages. First, the entire process is “app” based and can be accessed from a smartphone app. Second, the transfers are nearly instantaneous and “free.” However, the app cannot be used to transfer money into credit cards or pull money FROM a credit card as a cash advance transaction. It can only be used to / from deposit accounts. Essentially, it is a different channel for originating transactions the banks are treating as DEBIT transactions.
That should already be triggering alarm bells in the back of your head. Most know that if you have a credit card that can also be used as a debit card, when you actually PAY for something as a DEBIT transaction, when that transaction clears, YOUR MONEY IS GONE and you are not getting it back unless the other party agrees to return the money. There’s no BANK in the middle acting as a time delay who will also go after a fraudulent party and refund your money in the mean time.
Perhaps that is why Zelle is a less expensive way to transfer money. The bank is ony pushing the bits around on the network and assuming ZERO liability for preventing or correcting any fraud that might be occuring. All of that risk is shifted directly to the party allowing money to leave their account. The fact that registration on the app is keyed by a user’s telephone number (presumably a cell phone) and/or email address seems guaranteed to allow hackers or fraudsters to figure out a way to use the registration process or user interface in a way to trick other users. Maybe the app has an “invite” feature that lets the fraudster to send a text message to a target to the effect of “Hey mom, it’s Courtney, here’s an invite to Zelle so you can transfer me the money we talked about.” Many apps send messages from a seemingly random six digit number and rely on the user clicking on a link in the text to get the “context” of the message. With Zelle, if the fraudster gets to craft that resulting communication displayed when the user clicks on the page to reach a landing page, they can socially engineer less sophisticated users into thinking the request is coming from a known party. It is child’s play to find a person’s cell phone number and find information on family members online.
Perhaps users need to consider adding “two factor authentication” to any financial app. If you get an elecronic communication (text, email, robo-call) claiming to be anyone regarding a transfer of money, even if you have been discussing it with them previously, STOP AND CALL THEM DIRECTLY AND VERIY THE SOURCE ACCOUNT, DESTINATION ACCOUNT, AMOUNT, DATE AND REASON directly. The extra 30 seconds is a lot easier to find than the WEEKS or MONTHS of time required to fight to get your stolen money back.
WTH