Chase at least is popping up a bold social engineering warning whenever you’re attempting to send a Zelle payment to a new contact, or the underlying account has changed for an existing contact.

There are table stakes (security and financial controls, prudent IAM and MFA, etc), and then there are folks who will fail even with the most robust guardrails attempting to protect them.