The Consumer Financial Protection Bureau announced today that it has sued Early Warning Services, Bank of America, JPMorgan and Wells Fargo for allegedly failing to implement anti-fraud safeguards on peer-to-peer payments network Zelle.  

Customers of the financial institutions named in today’s lawsuit have accumulated more than $870 million in losses due to the alleged failure to protect them from fraud, according to the CFPB.

However, Zelle parent company Early Warning Services alleges that CFPB’s recent lawsuit is a testament to the bureau’s “pattern and practice of regulatory overreach,” Jane Khodos, vice president of communications for Early Warning, told Bank Automation News today. “Through this lawsuit, the CFPB would be simultaneously creating and enforcing entirely new legal requirements that go well beyond what Congress authorized the CFPB to do.” 

Regulatory overreach? 

The CFPB has been attempting to expand its oversight in 2024 to include nonbank entities, Ryan Blumberg, banking and financial services attorney at international law firm Clark Hill, told BAN. 

“For example, the CFPB finalized a rule subjecting larger nonbank providers of digital wallets and payment apps to federal supervision, targeting large entities,” Blumberg said. “Additionally, the bureau is attempting to establish a public registry requiring nonbank entities to disclose enforcement actions under consumer protection laws, enhancing transparency and compliance.” 

The CFPB has also pursued legal action against nonbank companies for allegedly violating what are traditionally bank regulations, signaling a broader regulatory reach into nonbank financial services, Blumberg said, adding that today’s lawsuit is another example of the trend. 

In response to the CFPB lawsuit, banks will deploy delaying tactics while “anticipating a potentially more favorable regulatory environment under the incoming administration before negotiating settlements,” he said. 

Zelle’s defense 

The CFPB’s attacks on Zelle are “legally and factually flawed, and the timing of this lawsuit appears to be driven by political factors unrelated to Zelle,” Khodos told BAN.  

Zelle has given the regulator information about its improving fraud prevention processes, Khodos said. The bureau fails to acknowledge that Zelle’s consumer reimbursement policies go beyond regulatory requirements, she said.

Zelle reimburses customers for all instances of fraud as required by the Electronic Funds Transfer Act and Reg E law, Khodos said. 

The payments provider said it requires all participating financial institutions to use authentication and enrollment controls, which may include:  

• Usernames;  

• Passwords;  

• Biometric data;  

• Encrypted identity verification data; 

• Real-time monitoring of enrollment tokens; and  

• Data-driven technology for real-time identification of potential bad actors. 

According to Zelle data, 99.95% of payments were sent without a report of scam or fraud in 2023.  

The payments network also reports that scams and fraud decreased by nearly 50%, Khodos said. This was despite a 27% increase in transaction volume in 2023, according to Zelle. 

The lawsuit 

The CFPB alleges in the lawsuit that big banks, in their rush to provide the payments rail to their customers, failed to safeguard consumers on Zelle, resulting in “hundreds of millions of dollars in consumer losses,” according to today’s CFPB release. 

“The nation’s largest banks felt threatened by competing payment apps, so they rushed to put out Zelle,” CFPB Director Rohit Chopra said in the release. “By their failing to put in place proper safeguards, Zelle became a gold mine for fraudsters, while leaving victims to fend for themselves.” 

In the lawsuit, according to the release, the CFPB alleges the banks are: 

• Ignoring red flags, including consumer fraud complaints; 

• Allowing offenders to strike again; 

• Failing to properly investigate complaints; and 

• Not improving identity-verification methods.

The CFPB did not provide a comment to BAN before publication time today.

Editor’s note: This is a developing story

Register here for early-bird pricing for Bank Automation Summit 2025, taking place March 3-4 in Nashville, Tenn. View the full event agenda here.