BANKS OFTEN REFUSE TO PAY FOR APP SCAMS
Zelle, Venmo and Cash App are convenient, but also targets for thieves
Argelys Oriach was on his way home from a shopping trip one evening in March when he was robbed at gunpoint. The thief demanded his iPhone and passcode. Oriach turned them over and fled.
The next morning, Oriach, who lives in New York City, said he discovered that the thief had drained $8,294 from his bank accounts at Capital One, using multiple money transfer apps including Zelle. He contacted Capital One, fully expecting the bank to refund him the stolen cash, as required by federal law. The bank refunded only $250, saying it found no evidence that the rest of the money was stolen. Oriach was stunned.
“I filed a police report, identified the suspect at a precinct and even testified at a grand jury,” he said. “But none of that seems to have helped my case.”
After The New York Times asked Capital One about Oriach’s case, bank representatives said they had determined there was fraud and would repay him. “We reached out to
the customer to apologize for any additional stress this matter has caused,” Capital One said in an emailed statement.
In recent years, payment apps like Zelle, Venmo and Cash App have become the preferred way for millions of customers to transfer money from one person to another. Last year, people sent $490 billion on
Zelle, the country’s most popular payments app, and $230 billion through Venmo, its closest rival.
But the same reasons that have drawn customers to these apps — they are free, fast and convenient — have made them easy targets for scammers and thieves. While banks argue that they shouldn’t have to re
fund customers who inadvertently granted a scammer permission to use their accounts, they have also often been reluctant to refund
customers like Oriach whose money was stolen. That could be a potential violation of the law.
Under a 1978 federal rule called Regulation E, banks are required to make clients whole if their money is stolen from a consumer account
through an electronic payment initiated by another person, as in Oriach’s case.
Since Reg E was written well before payment apps existed, the Consumer Financial Protection Bureau last year issued guidelines saying that the law covered all person-to-person online payments. The bureau clarified that all unauthorized online money transfers — meaning any payment initiated by someone other than the customer and done without the customer’s permission — were the bank’s liability.
“When a consumer provides notice to a financial institution that money was stolen from the consumer’s account, the burden is on the institution to show that the transfer of funds out of the consumer’s account was authorized by the consumer,” said Raul Cisneros, a spokesperson for the bureau.
But despite the updated guidance, banks in many cases are refusing to refund customers who claim — often with supporting documentation — that money was stolen from their accounts. The banks rarely provide clear explanations for their decisions, leaving victimized customers with little recourse.
The consumer bureau’s updated guidelines “caused a lot of angst and confusion for banks,” said Peter Tapling, a payments consultant. “Regulation E was never intended for instant money movement products.”
In early February, Chuck Ruoff said, a thief transferred his mobile phone
number to another device through an attack technique called “SIM swapping.” The thief then used Ruoff ’s number to get into his accounts at Bank of America and extract $3,450 through Zelle. Ruoff reported the theft as soon as he discovered it, but his claim was denied. The bank said the transaction did not appear to be unauthorized.
Ruoff sent the bank additional documentation, including a police report and a letter from Verizon describing what happened, and
asked for the case to be reconsidered. He was told to wait 45 days for a response. When that deadline passed, he was told to keep waiting. Ruoff spent hours on the phone, calling every few days for an update on his claim.
“I said repeatedly, ‘I’ve never used Zelle. I never authorized this,’ ” said Ruoff, who has been a Bank of America customer for 34 years. “I said to the lady I spoke with once, do you think I would go to the police department and file a false report? That’s a crime.”
After the Times contacted Bank of America, it refunded Ruoff’s money. The bank was already reconsidering its decision and paid the claim after taking into account additional information provided by Ruoff, said Bill Halldin, a bank spokesperson.
Zelle, the most popular payments app, is owned and operated by Early Warning Services, a company based in Scottsdale, Ariz. Early Warning is owned by seven banks — Bank of America, Capital One, JPMorgan Chase, PNC, Truist, U.S. Bank and Wells Fargo. But each of the 1,600 banks and credit unions that offer Zelle to their customers uses its own security settings and policies.
Neither the banks nor Early Warning publicly release any data on fraud, so it’s hard to tell how prevalent scams and theft are on Zelle. Incidents like the ones described by Oriach and Ruoff are “rare” and make up a small portion of the activity on the platform, said Meghan Fintland, a spokesperson for Early Warning.
In a survey of nearly 1,400 people whose accounts were accessed without their consent last year, one-quarter said Zelle or other personto-person payment services were used to make unauthorized money transfers, according to a report by Shirley Inscoe, an adviser at Aite-Novarica Group, a financial services consultant. That was second only to fraudulent credit card transactions.