The "Zelle transfer" examples seem to be a US equivalent of Push Fraud, which was big in the UK. In the UK's Push Fraud there's no third party (Zelle) involved, victims are persuaded they should send money from their account to an account controlled by the bad guys, using Faster Payments, which just moves money (up to £1M) from one UK bank account to another UK bank account, in theory within one business day in practice typically instantly.

Push Fraud was significantly hampered (~solved?) by requiring that the recipient name field, rather than just being for your own note of who you sent money to (so e.g. "Jenny birthday" or "Fucking Landlord") must closely match the recipient's account name, which as a result of Know Your Customer checks should be a legal name of some sort.

There's a back-and-forth mechanism, so it was at first (presumably got better with practice) harder to pay companies with hard to spell or weirdly punctuated names, but hey, better I can't send money to "Pat Smith" (nope, his name is Matthew and that's Smythe not Smith) than that my £800 000 for a house goes to a crook who sent me an email pretending to be from my lawyers.

Because Faster Payments was a legal requirement, operated by a regulated entity that's ultimately paid for by the banks, it was presumably easier to write a law saying how it needs to be secured, whereas Zelle is a third party unrelated to the banks.

Zelle is essentially the same as Faster Payments here; the legal structure of it being a third party seems more or less irrelevant. I don’t think regulating it will be a problem for the CFPB or other US regulators.

The company that owns Zelle is owned by a cartel of the biggest banks and Navy Federal CU.

Yeah its fascinating that quick payments probably is more of a problem than a benefit.

Do you think? What I see is that it's a useful way to move money and, as expected, crooks wanted to use it to steal money.

It's more remarkable when we invent things that move money and don't get used for crime.

For example the UK's Direct Debit turns out to be almost useless for crime, because it can be unwound, so, if you use it to steal money you run into two closely related problems:

1. When the victim realises they just undo the transaction, and get their money back

2. Because the bank doesn't want to be on the hook for that, their capital requirements to allow Direct Debit are eye watering. Out of reach of ordinary crooks.

What's the defense against abuse of #1 - that's the usual problem we see with perfectly reversible transactions.

Because it's intended only to pay large outfits who are owed money, this just isn't a problem. It's as though you woke up one day and discovered the customer didn't pay last month's bill - even though in reality they did pay but then unwound it.

The vast majority of your customers are legitimate, so there's usually going to be a reason why they unwound the payment. You can of course pursue them for payment as you would have if they were overdue on 30-day terms or whatever, but you definitely want to try to figure out why the unwind happened before you kick that off or you may waste a lot of money on a fruitless process.

Lets take a real example where I had my bank unwind bill payments. Water utility keeps billing me for more water than I'm using. I read my meter, I see I used 2.5 cubic metres of water, they bill me for 8 cubic meters, and the meter number they've listed is wrong. So I call, they send an engineer, the engineer looks at the meters, tries some things, declares that yeah, whoever installed these meters fucked up. No worries, we'll fix it, your next bill will be correct. But the next bill is wrong too. Call utility, engineer comes out, same diagnosis, same lack of consequences. Rinse, repeat. OK, I see the pattern, unwind payments.

Now obviously the water utility's lawyers threatened to take me to court for non-payment - I didn't pay them any money for the water they've incorrectly billed me for. But they won't actually go to court because lawyers don't want to get disciplinary hearings for their employer's incompetence. They still have personal responsibility (the employer can pay for their liability insurance but it is personal liability, "But my company ..." doesn't work on judges) for these proceedings. So a human lawyer will take five minutes to look at the paperwork, see the company fucked up and not file.

But you can't just have customers who don't pay you indefinitely, these are for-profit companies, so a few months later I get a phone call. They can't fix their records apparently, it's just such a tangled mess, so, new plan, delete my customer account, make a new customer account with a zero balance, attach the correct meter to the account, get a fresh reading and start from there. Is that OK by me? Yes it is.

I think in the end this meant instead of paying for water I didn't use, I saved about six months on water I did use, which seems fair.

It seems that many people don't really understand the process that is happening. Push or bank transfers are kinda like putting money in envelope and sending it to other person. You better be sure that address, name and amount are right...

And still many people have also gotten scammed to send money in envelope...

Yeah, its not like the bank gave access to your account to the wrong person and now they're not paying you back. You did something with stuff you legitimately own and control and now you regret it. That's a big difference to me.

Chase at least is popping up a bold social engineering warning whenever you’re attempting to send a Zelle payment to a new contact, or the underlying account has changed for an existing contact.

There are table stakes (security and financial controls, prudent IAM and MFA, etc), and then there are folks who will fail even with the most robust guardrails attempting to protect them.

Banks should obviously do their best to prevent and revert fraudulent behavior, but there are points past which they can't do anything without just refunding out of the goodness of their (perhaps cold and small) hearts.

If I convince you to withdraw thousands of dollars in cash and then skip town with it, do we expect the bank to make you whole?

I would expect the banks to talk to each other in good faith and reverse the transaction.

Please re-read the hypothetical - there is no second bank; it involves giving cash to a fraudster.

I think the issue is that without regulations forcing banks to serve customers better, they will simply abandon all responsibility completely because it's cheaper for them. And since we see that with Zelle, banks will collude to all hose customers in the same way, the free market is not a solution.

It would be trivial for banks to give customers better fraud protection tools and enable better recovery, but they clearly don't care. * For one, since you can't have a bank account anonymously the receiving bank knows exactly who stole the money. They should at least be able to refer them for criminal investigation. * Two, since they own the machinery of transferring the money, yes they can easily reverse fraudulent transactions -- the bank doesn't have to take a loss since the fraudster has to have an account with them. They know who to take it back from. * The fraudster withdrew the money and ran? ACH transfers have always taken up to 15 days to "clear" -- banks wouldn't let you withdraw money you just deposited exactly for this reason, to verify that the sending bank actually has the funds and there are no issues. Why can't Zelle let the sender specify a "hold" period so there is time to dispute the transfer and the funds can be recovered?

Basically is seems to me that a modern digital payment systems must have a kind of escrow service built in. IMHO this is what we need the law to require banks to do. In combination there needs to be a payment dispute resolution system which would probably take the form of a kind of arbitration system not unlike the role small claims court plays. This is something the banks should lobby the government to provide since doing it themselves would clearly get complicated and expensive.

Deep down you have the dichotomy between "instant payment" and "refundable payment".

If I'm selling you a car, I don't want a Zelle transfer for the money that I know you could claim was fraud and claw back from me - then I'm out the money AND the car; I'll demand cash in that case.

Right, which is why you can't do this without impartial arbitration.

Essentially each transaction that is "refundable" is an implied contract between parties and it should be verifiable. Such as in the case of a car sale it is pretty easy for a third party to check if the car was received.

Or somehow have a notary to witness and verify the transaction.

This is the basic problem is that you can't have instant transfers with fraud prevention. It's impossible to claim that banks don't understand this and IMHO it should be considered criminal negligence that they pushed this product on consumers knowing that it just exposes them to easy fraud.

> I'm out the money AND the car

Incorrect. You only deserved one, not both. You don't get the money AND the car. It's either your car and someone else's money, or someone else's car and your money.

Exactly – we can't expect banks to pay when their customers get themselves scammed.

I think the solution is escrow. I am biased, because I work for an escrow company, but I've never seen a more effective approach. Hold the money until the buyer has what they paid for, and only then release the money to the seller. (To be fair, escrow does tend to be more expensive than simple money transfer, so it's not all upside.)

Yeah, and we do escrow for large value things (houses). Other than that, since it's not well known, people don't bother with it for smaller things. Would you trust me if I told you I was the "escrow account" manager, heh?

Yes.

Banks are given a monopoly over an unavoidable, and very lucrative, aspect of modern life. No reason to give them that for free.

A lot of people (and small businesses) share their Zelle accounts and different name shows up when sending money. Whenever I am sending a big amount via Zelle, I send $1 first. Then check with recipient to verify.