CFPB Sues JPMorgan Chase, Bank of America, and Wells Fargo for Allowing Fraud to Fester on Zelle
Americans have lost hundreds of millions of dollars to fraud tied to payment network’s shoddy safeguards
Washington, D.C. – Today, the Consumer Financial Protection Bureau (CFPB) sued the operator of Zelle and three of the nation’s largest banks for failing to protect consumers from widespread fraud on America’s most widely available peer-to-peer payment network. Early Warning Services, which operates Zelle, along with three of its owner banks—Bank of America, JPMorgan Chase, and Wells Fargo—rushed the network to market to compete against growing payment apps such as Venmo and CashApp, without implementing effective consumer safeguards. Customers of the three banks named in today’s lawsuit have lost more than $870 million over the network’s seven-year existence due to these failures. The CFPB’s lawsuit describes how hundreds of thousands of consumers filed fraud complaints and were largely denied assistance, with some being told to contact the fraudsters directly to recover their money. Bank of America, JPMorgan Chase, and Wells Fargo also allegedly failed to properly investigate complaints or provide consumers with legally required reimbursement for fraud and errors. The CFPB is seeking to stop the alleged unlawful practices, secure redress and penalties, and obtain other relief.
“The nation’s largest banks felt threatened by competing payment apps, so they rushed to put out Zelle,” said CFPB Director Rohit Chopra. “By their failing to put in place proper safeguards, Zelle became a gold mine for fraudsters, while often leaving victims to fend for themselves.”
Bank of America, N.A. is a national bank and subsidiary of the Bank of America Corporation, headquartered in Charlotte, North Carolina. As of June 30, 2024, Bank of America had over $2.5 trillion in consolidated total assets.
JPMorgan Chase Bank, N.A. is a national bank and subsidiary of JPMorgan Chase & Company headquartered in Columbus, Ohio, and the nation’s largest bank, with over $3.5 trillion in consolidated total assets as of June 30, 2024.
Wells Fargo Bank, N.A. is a national bank and subsidiary of Wells Fargo & Company headquartered in Sioux Falls, South Dakota. As of June 30, 2024, Wells Fargo had $1.9 trillion in consolidated total assets.
Early Warning Services, LLC is a financial technology and consumer reporting company based in Scottsdale, Arizona. Early Warning Services designed and operates the Zelle network. It is co-owned by seven of the largest banks in the United States: Bank of America, Capital One, JPMorgan Chase, PNC Bank, Truist, U.S. Bank, and Wells Fargo.
Zelle allows near-instant electronic money transfers through linked email addresses or U.S.-based mobile phone numbers, known as “tokens.” Users can create multiple tokens across different banks and quickly reassign them between institutions, a feature that has left consumers vulnerable to fraud schemes.
The CFPB alleges widespread consumer losses since Zelle’s 2017 launch due to the platform’s and the defendant banks’ failure to implement appropriate fraud prevention and detection safeguards. The CFPB alleges that Bank of America, JPMorgan Chase, Wells Fargo, and Early Warning Services violated federal law through critical failures including:
Leaving the door open to scammers: Zelle’s limited identity verification methods have allowed bad actors to quickly create accounts and target Zelle users. For example, criminals often exploited Zelle’s design and features to link a victim’s token to the fraudster’s deposit account, which caused payments intended for the consumer’s account to instead flow to the fraudster account.
Allowing repeat offenders to hop between banks: Early Warning Services and the defendant banks were too slow to restrict and track criminals as they exploited multiple accounts across the network. Banks did not share information about known fraudulent transactions with other banks on the network. As a result, bad actors could carry out repeated fraud schemes across multiple institutions before being detected, if they were detected at all.
Ignoring red flags that could prevent fraud: Despite receiving hundreds of thousands of fraud complaints, the defendant banks have failed to use this information to prevent further fraud. They also allegedly violated the Zelle Network’s own rules by not reporting fraud incidents consistently or on time.
Abandoning consumers after fraud occurred: Despite obligations under the Electronic Fund Transfer Act and Regulation E, the defendant banks failed to properly investigate Zelle customer complaints and take appropriate action for certain types of fraud and errors.