Categories: The Verge

New York claims Zelle’s shoddy security enabled a billion dollars in scams

New York Attorney General Letitia James is suing the banks behind Zelle over claims that their payment platform enabled “massive amounts of fraud” that caused customers to lose more than $1 billion between 2017 and 2023. In the lawsuit, James alleges Zelle was rushed to market, resulting in a design that made the platform “an obvious conduit for fraudulent activity.”

Early Warning Services (EWS), a company owned by major institutions including Bank of America, Capital One, JPMorgan Chase, Wells Fargo, and others, launched Zelle in 2017 as a way to let customers send money from their bank account to other users on the platform. However, James claims EWS “knew from the beginning that key features of the Zelle network made it uniquely susceptible to fraud” and still “failed to adopt basic safeguards.”

One of the alleged issues highlighted by James’ lawsuit includes a registration process that ”lacked important verification steps” that enabled scammers to sign up using misleading email addresses, which they could use to pose as a government employee or business to trick Zelle customers into sending them money that they couldn’t get back. Following government pressure, Zelle began paying back victims of imposter scams in 2023.

Additionally, James claims EWS did not ensure that banks reported customer complaints about fraud in a “timely” manner and falsely advertised the service as a “safe” money transfer tool. “Even when EWS did receive reports of fraud, it failed to promptly remove the fraudsters from the Zelle network or require banks to reimburse consumers for certain scams,” James alleges.

The lawsuit touches on many of the same points as the one initially filed by the Consumer Financial Protection Bureau. In March, the CFPB dropped its lawsuit against Zelle amid the Trump administration’s attempt to dismantle the agency and the firing of former head Rohit Chopra, who had taken an aggressive approach to tech regulation. That still hasn’t stopped scrutiny from federal lawmakers — and now, New York’s attorney general.

Zelle spokesperson Eric Blankenbaker pushed back on these claims in a statement to The Verge, saying Zelle “leads the fight to stop fraud and scams” in the US. “This lawsuit is a political stunt to generate press, not progress,” Blankenbaker says. “The Attorney General wants to hand criminals a blueprint for guaranteed payouts with no consequences, opening the floodgates to more scams, not less. That’s bad policy and puts consumers at greater risk.”

Attorney General James claims EWS violated New York law and is asking for restitution and damages for all New Yorkers harmed by scams on Zelle. “I look forward to getting justice for the New Yorkers who suffered because of Zelle’s security failures,” James said in the press release.

rssfeeds-admin

Share
Published by
rssfeeds-admin

Recent Posts

ConnectWise Automate Flaw Allows Attackers To Bypass Security Checks

ConnectWise has disclosed a critical security vulnerability in its Automate platform that could allow attackers…

3 minutes ago

Critical Memcached SASL Flaw Lets Attackers Infer Usernames

A high-severity vulnerability has been disclosed in Memcached, the widely deployed open-source distributed memory caching…

3 minutes ago

Threat Actors Abuse Fileless Execution to Spread Quasar Linux RAT

Compromising a developer workstation is one of the most devastating moves a threat actor can…

4 minutes ago

China-Linked Hackers Target Southeast Asian Edge Routers

A sophisticated China-nexus intrusion group has launched a large-scale campaign targeting edge network devices across…

4 minutes ago

Apache CXF LDAP Injection Flaw Exposes Arbitrary Certificates

The Apache Software Foundation has patched a critical security flaw in its widely used Apache…

4 minutes ago

PuTTY 0.84 Fixes SSH KEX Crashes and Telnet Spoofing Flaw

PuTTY has released version 0.84 on May 24, 2026, patching three confirmed security vulnerabilities, two…

5 minutes ago

This website uses cookies.