How scammers target Zelle users – and how you can stay safe

The consumer payments space has undergone a radical shift in recent years. A new breed of apps, including Venmo, Cash App and Zelle, now offer a fast, effective and free way for users to pay friends, family and selected small businesses. Launched in 2017 by a US banking consortium, Zelle is one of the most successful of these peer-to-peer (P2P) services, becoming by far the largest provider of its kind in the US by total payments sent: $490 billion in 2021.

Some 10,000 financial institutions now participate in its network, meaning Zelle can be accessed from countless banking apps, as well as downloaded as a standalone service. But while it is widely regarded as a safe way to transfer funds, it has been criticized for offering little consumer protection against scams.

Indeed, just a few days ago, Zelle came under fire in a US Senate report, which stated that Zelle users lost about $440 million through fraudulent transactions in 2021. According to the report, banks are doing little to prevent fraud and scams on Zelle combat and is generally reluctant to reimburse people who have fallen victim to scammers.

Couple these figures with the fact that incidents of fraud on Zelle are trending upwards and it’s clear that you need to be on the lookout for tricks that take advantage of others’ trust for their own gain and leave victims high and dry.

Zelle scams to watch out for

There is a long list of tactics scammers use to trick victims into sending them money. Here are the main ones to look out for:

1. Imitation scam

A scammer impersonates a family member or close friend and urgently requests some funds to help them with an emergency. Or they may pretend to be a representative of a government agency, bank, utility or similar, demanding funds to cover a late payment or penalty. Either way, once the money is sent, they disappear.

2. Overpayment

Facebook Marketplace is a magnet for Zelle scams. In one classic scam, which is also used to withdraw money via Cash App and other services, a buyer sends a fake check to a seller for an amount that exceeds the sale price of an item. They will then ask the seller to refund the transfer via Zelle. If the latter do, they will lose that money before realizing that the check itself is not legitimate.

3. Business upgrade

In another Facebook Marketplace scam, a buyer shows interest in a product and claims they will pay through Zelle. They then send the victim a fake email claiming that a payment is pending, but that the buyer is using a business account for which they had to pay extra. It requests the seller to refund that fee to the buyer so that the initial payment goes through. However, the whole thing is a lie, and the seller ends up with whatever they paid the buyer in ‘fees’.

4. E-commerce scams

Online buyers beware: scammers are all over e-commerce and various social media sites, offering to sell in-demand items that are priced extremely low, but only for a limited time. This pressure often causes the buyer to abandon their usual caution online. They pay through Zelle and the item never shows up.

To help highlight the risks of buying red-hot products on social media, ESET Chief Security Evangelist Tony Anscombe recently struck up a conversation with a verified (though apparently hacked) Twitter account that claimed to be PlayStation 5 consoles and requested payment via Zelle.

Conversation with a scammer (click to enlarge)

5. Romance scam

Romance scammers are past masters of social engineering: the art of the trickster. They will build a strong relationship with their victim online and initially befriend them on dating sites. Once their point is absorbed, they will start requesting money: for medical bills, plane tickets and more. If it’s sent through Zelle, the chance that the victim will ever see that money again is almost zero.

6. False invoice

The victim receives a legitimate message or email from a company they do business with asking them to click a link to check an invoice. Doing so will take them to a phishing page spoofed to look like that business’s website, where they’ll be asked to enter personal details. Once in the scammer’s hands, these details will enable a takeover of the victim’s Zelle account.

7. Lottery scam

It works similarly to the fake invoice scam, except that the victim receives a communication telling them that they have won some kind of prize and only need to click on a link to receive the winnings. Doing so will take them to a fake website that encourages them to re-enter their personal details.

There are numerous variations of these two scams, all leading to account takeover.

8. Malware

Phishing emails and texts can also lead to secret malware downloads, if the user is tricked into clicking on a malicious link. This effectively cuts out the stage where they enter their personal details. Instead, the malware can either steal logins or automatically hijack the Zelle account and transfer money.

9. Fake fraud section

A user receives a test from their ‘bank’ asking if they are trying to transfer funds. If they answer, a scammer will call them pretending to work for the bank. They will then walk the victim through a list of instructions that they believe will help reverse the fraudulent transaction. In fact, it starts a money transfer to the criminals.

10. Victim/Refund Scam

When an individual falls victim to a Zelle or other online scam, their details are often saved on file for follow-up fraud. Here, a scammer may call and pretend to work for an agency that can recover their lost funds. All the victim has to do is pay a fee in advance. Unfortunately, they will never get this money back either.

RELATED READ: Mobile payment apps: How to stay safe when paying with your phone

Can Zelle fraud victims get their money back?

Zelle does not require users to share any financial information to send funds, and individuals are usually verified via their bank, which adds an important layer of security. However, like Cash App and similar services, it does not offer the same protection as credit and debit cards.

Zelle itself distinguishes between “fraud” – when an unauthorized third party gains access to a user’s account and transfers money without the user’s knowledge – and “scams” where the user is tricked into sending the money themselves. In the case of the latter, there is little chance that they will recover the fraudulent funds.

In fact, according to the aforementioned report, banks do not refund 90% of the cases in which people were tricked into making payments on the platform.

How to stay safe on Zelle

The tips for staying scam-free on Zelle are no different than those for avoiding scams on Cash App and other P2P payment services. This includes being wary of any unsolicited communications, improving account authentication and only sending money to people you trust. Consider the following:

Be skeptical: Never send money to someone you don’t trust, and remember that if an offer seems too good to be true, it usually is. Double check with the supposed sender: If you receive such a communication, contact the alleged sender immediately to check whether it is legitimate or not. Never use contact details in the original message. Be wary of phishing emails, texts and phone calls: They look legitimate, but will often try to rush your decision making into something you’ll regret. Never provide your bank or other credentials to anyone. Improve authentication: If it’s not already enabled, add two-factor authentication to your banking or Zelle app, which will mean that even if fraudsters get hold of passwords and usernames, they won’t be able to hijack the account. Improve mobile security: By downloading anti-malware software to your device from a trusted vendor. This will go a long way in staying safe from phishing attacks and secret malware downloads.

The bottom line is, “if you don’t know a person or aren’t sure you’ll get what you paid for, using your credit card may be a better payment option” – according to Zelle himself. If there is even an iota of doubt in your mind, make sure that online payments are made through methods that offer greater cardholder protection.