The online-payment platform Zelle is extremely popular with consumers, which helps explain why it’s also become a hit with scammers.

Another reason: Zelle payments can’t be reversed once they’re sent. They’re a nearly instantaneous transfer of cash from your account to someone else’s, and if that someone else is a scammer, you can’t simply stop the payment (like a check) or dispute it (like a credit card).

Now, the federal regulator overseeing financial products is probing whether banks that offer Zelle to their account holders are doing enough to protect them against scams. Two major banks — JPMorgan Chase and Wells Fargo — disclosed in their security filings in the last week that they’d been contacted by the Consumer Financial Protection Bureau.

According to the Wall Street Journal, which reported the filings Wednesday, the CFPB is exploring whether banks are moving quickly enough to shut down scammers’ accounts and whether they’re doing enough to identify and prevent scammers from signing up for accounts in the first place.

The CFPB declined to comment on the story, and none of the banks contacted by The Times would talk about the details of the CFPB’s probe. JPMorgan Chase’s official response, though, was combative, suggesting the bank would fight the regulators if the CFPB demanded significant new protections for consumers.

“The CFPB is fully aware we already go above and beyond what the law requires, reimbursing for all unauthorized transactions and even for certain types of scams, so they should expect to be challenged to ensure their actions stay within the bounds of the law,” a spokesperson for the bank said in a statement. “Our customers love Zelle, among the safest ways to pay people you know and trust, in real time and at no extra cost, and if necessary we will not hesitate to seek assistance from courts to uphold the integrity of how these services are provided.”

Here’s a rundown of the issues and how Zelle users might be affected by the CFPB’s inquiry.

Are scams a problem on Zelle?

A J.D. Power survey this year found that 3% of the people who’d used Zelle said they had lost money to scammers, which was less than the average for peer-to-peer money transfer services such as Venmo, CashApp and PayPal. The chief executive of Early Warning Services, which runs Zelle, told a Senate subcommittee in July that only 0.1% of the transactions on Zelle in 2023 involved a scam or fraud.

But Zelle operates at such a large scale — 120 million users, 2.9 billion transactions and $806 billion transferred in 2023, according to Early Warning Services — that even a tiny percentage of scam and fraud problems translates into a large number of users and dollars.

Scam activity generally is rising fast. According to the Federal Trade Commission, more than 41,000 consumers reported scams involving online-payment apps in the first half of 2024, with losses amounting to $171 million. That’s well over the pace of scams reported in 2023.

Early Warning Services insists that Zelle is bucking the rising tide of cons. From 2022 to 2023, Zelle cut the rate of scams by nearly 50% even as the volume of transactions grew 28%, resulting in less money scammed in 2023 than in 2022, said Ben Chance, the chief fraud risk management officer for Zelle.

The company didn’t disclose the amounts involved, but if 0.1% of the $806 billion transferred in 2023 involved scam or fraud, that would translate to $806 million.

Do Zelle users get reimbursed for scams?

Only in certain cases, and this is where the banks that offer Zelle have drawn the most heat.

If you use Zelle to pay a scammer, banks say, that’s a payment you authorized, so they’re not obliged under law to refund your money. Federal law requires reimbursement only for unauthorized transactions, such as when someone hacks into your account or surreptitiously uses an app on your phone to make payments.

In June 2023, Zelle started requiring banks to reimburse customers who were duped into paying scammers who posed as representatives of the bank, the government or a service provider with whom the customer had an existing business relationship (for example, a phone company). The policy is similar to one Bank of America adopted in 2021.

That change led to banks reimbursing more customers who were scammed on Zelle — according to a Senate report, reimbursements totaled $18.3 million in the last half of 2023 — but 80% to 85% of the consumers who reported being scammed still got none of their money back, the report said.

What do banks and Zelle do to try to stop scams?

The heart of the CFPB’s inquiry appears to be focused on this question.

Chance said that, under Zelle’s rules for participating banks, whenever a consumer reports a scam or fraudulent transaction, the bank has to report that to Zelle, which will in turn inform the receiving bank of the complaint. That’s true even for transfers within the same bank. The receiving bank is then required to conduct a fraud investigation on the recipient and report back to Zelle.

Some banks, such as Bank of America, say they will put a freeze on transfers by a suspected scammer as soon as a report comes in, then investigate and, if the report is substantiated, seize and return the money. But that works only if the scam is reported right away, before the scammer has the chance to withdraw the funds — which many will do immediately, said Iskander Sanchez-Rola, director of innovation at the cybersecurity company Gen.

Plus, the bank has to agree that a scam occurred. Adylia Roman of Los Angeles said she fought in vain with Bank of America for months to recover $2,700 lost from her savings account through Zelle; the bank insisted that the transfer was authorized by her son, who says he did no such thing and had no idea who the recipient was.

If there is a second complaint about an individual committing scams or fraud, Chance said, Zelle will probably suspend that person’s access to the network until an investigation is completed. But Zelle can’t freeze the money in dispute — it’s up to participating banks to decide how to respond to the reports that Zelle forwards.

Early Warning Services also requires banks to take more steps to ensure that customers know the people they’re sending money to and that they understand the risk. Before allowing a transfer to a new recipient, Zelle requires banks to send in-app alerts showing the verified name of the person holding the account where the money is being sent, and then warning that money should be sent only to people the user knows and trusts because the transfer is irrevocable. The user has to accept those terms before the transfer can be completed.

At the same time, Chance said, Zelle sends screening information about the recipient to the sender’s bank, which the bank uses to decide whether the transaction is too risky to approve.

How might consumers get more protection?

One change that could make a difference would be to limit when funds transferred via Zelle are available for withdrawal, as banks do with check deposits. That would give senders time to call off transactions they realize are suspicious.

Anything less than near-instant transfers, however, would probably drive users to other instant-payment services, Sanchez-Rola said.

Banks could also impose more restrictions on how Zelle users add new recipients. Although banks tell consumers that Zelle is designed for sending money to people they know and trust, there’s nothing stopping them from sending money to complete strangers, as long as contact information is available. That openness makes it easier for criminals to pull off their scams.

PayPal and Venmo address this issue through a buyer protection system for goods or services that’s mandatory on PayPal and optional on Venmo. Under this approach, the recipient of a payment has to pay a fee that helps reimburse consumers who are scammed.

Perhaps the biggest issue is making Zelle users more attuned to risks. Sanchez-Rola said that many people assume Zelle is risk-free because they access it through a regulated bank, and because people they know and trust use it for everyday things. So when someone they don’t know asks to be paid via Zelle, they’re not as skeptical as they should be.

“You shouldn’t use these kinds of [payment services] unless you fully trust the person,” he said. “That’s what they were designed for. They are not for getting your concert tickets quickly from some unknown guy.”

Sanchez-Rola suggested that Zelle could send more information about the recipient of a proposed transfer to the sender, displaying any potential red flags before the money is sent. He also recommended that Zelle users employ cybersecurity products that help detect scams and phishing attempts. (Gen owns Norton and Avast, which make cybersecurity products.)

“Having solutions that can help people is important,” he said. “You cannot just fully trust your bank.”

Some consumer advocates are calling for a more sweeping approach, amending the Electronic Fund Transfer Act to require banks to reimburse consumers who are duped into authorizing payments to scammers. Rep. Maxine Waters (D-Los Angeles) and Sens. Elizabeth Warren (D-Mass.) and Richard Blumenthal (D-Conn.) introduced bills in the House and Senate this month to do just that.