The US Consumer Financial Protection Bureau sues Zelle and four of its partner banks

On Friday, the Consumer Financial Protection Bureau (CFPB) sued four financial companies involved with Zelle. The CFPB’s lawsuit (via CNBC) accuses Zelle’s operator (Early Warning Services) and three of the service’s partner banks — JPMorgan Chase, Bank Of America and Wells Fargo — of failing to protect consumers from widespread fraud on the peer-to-peer payment system.

The CFPB says customers of those three banks have lost over $870 million during Zelle’s seven years as a payment service. The suit claims hundreds of thousands of customers who filed fraud complaints were denied meaningful assistance, with some being told to “contact the fraudsters directly to recover their money.” (Pro tip: Don’t do that.)

“The nation’s largest banks felt threatened by competing payment apps, so they rushed to put out Zelle,” CFPB Director Rohit Chopra wrote in a statement. “By their failing to put in place proper safeguards, Zelle became a gold mine for fraudsters, while often leaving victims to fend for themselves.”

The CFPB says one of the system’s loopholes is that its “tokens” (linked US phone numbers or email addresses) can be used and reassigned across different banks. The agency claims fraudsters can exploit this by connecting a victim’s number or email to the perpetrator’s deposit account, causing payments meant for the consumer to go to the scammer’s account instead.

The suit accuses Zelle and the banks of allowing repeat offenders to bounce between financial institutions with impunity. “Banks did not share information about known fraudulent transactions with other banks on the network,” the CFPB wrote. “As a result, bad actors could carry out repeated fraud schemes across multiple institutions before being detected, if they were detected at all.”

The CFPB also claims the defendant banks didn’t heed red flags to prevent further fraud, report incidents consistently or on time, properly investigate customer complaints or take appropriate action.

On Friday, Zelle framed the government’s lawsuit as a political hit that would help criminals and force them to charge fees. “The CFPB’s attacks on Zelle are legally and factually flawed, and the timing of this lawsuit appears to be driven by political factors unrelated to Zelle,” Jane Khodos, Zelle spokesperson, wrote in a statement. “Zelle leads the fight against scams and fraud and has industry-leading reimbursement policies that go above and beyond the law. The CFPB’s misguided attacks will embolden criminals, cost consumers more in fees, stifle small businesses and make it harder for thousands of community banks and credit unions to compete.”

In September, JPMorgan Chase wrote in a quarterly filing (via CNBC) that it would consider counter-litigation if the CFPB took action against the bank for its role with Zelle.

Last month, The Washington Post reported that President-elect Donald Trump and Congressional Republicans plan to limit the CFPB’s funding and powers, aligning with the agendas of large financial institutions. Elon Musk and Vivek Ramaswamy, his “government efficiency” advisors, have said they want to eliminate the agency, which was established in 2011 in response to the 2007-08 financial crisis and resulting recession.

Killing the agency would require a congressional vote that wouldn’t likely pass, given Republicans’ thin majorities. But they could do what Trump did in his first term: appoint a new director to slow or stop regulatory actions, effectively kneecapping the agency as long as they’re in charge.