As I understand it, Zelle is fully subject to Reg E, and the transfer you are describing was not initiated by the victim. If 30 days have not elapsed, contact Zelle and the bank and tell them that, per Reg E, they must issue a refund. You can escalate to their legal team, to the regulators, and/or to small claims court.

This isn’t Europe where excuses like “the EMV chip says the transaction was valid, so it must be valid” supposedly fly. Reg E has no carveout for “well, we put really expensive locks in the door, but the bad guy came in the window.”