Zelle is a popular peer-to-peer money transfer mobile application. Most of the time, it is used to pay friends and family without having to withdraw cash. Think about a group of friends having dinner together—one person pays the check, then the rest of the party can use Zelle to chip in their portion of the meal and tip.
It's a popular enough app that a lot of banks and credit unions now offer it as a feature of their online banking services. You might not even be aware that it's available—check your financial institution's website or zellepay.com/get-started to find out.
However, like every other piece of technology, there are scams that leverage Zelle and attempt to steal money from consumers.
The typical Zelle scam begins with a text message that appears to come from your bank or credit union (the scammers may have information linking your phone number to an account at a specific financial institution, or they may be just spitballing by using a mega-bank like Chase or Wells Fargo). This message asks if you authorized a Zelle payment for some alarming amount ($5,000, for example). Whether you respond yes or no, within a few minutes, your phone rings.
This caller will claim to be helping you with the fraudulent payment (which is not real). Their first question (allegedly to confirm you identity) will be your online banking username. Next, you will receive a (usually) six-digit passcode in a text message from your bank, which the caller will ask you for.
On the other end of the line, the scammer has used your online banking username and clicked the "forgot password" link. The bank sends you a one-time passcode to verify your identity, but since you relayed it to the caller, they can use it to log in to your account, change your password, then use Zelle to quickly transfer funds out of your account. As a special bonus, you can't login immediately to see what's happening on your account because the scammer has changed your password, and you don't have it.
Zelle has attempted to combat this type of fraud by requiring users to verify outgoing transactions, but these verification messages are sent by text message. The scammer, knowing the victim is going to receive this message, will keep them on the phone and instruct them to respond that the transaction is authorized.
How can you avoid this type of fraud?
When it comes to passwords and passcodes, there is one rule to rule them all: never give them to anybody, whether over the phone, text message, email, in-person, message-in-a-bottle, two-cans-on-a-string, or any other method of communication. There is ONE way to use those six-digit passcodes: by typing or pasting them into the website or app yourself. ANYTHING outside of that is going to turn out to be fraud. If your financial institution supports Zelle, be on the lookout for this scam. If you get a text message alluding to a Zelle transaction you don't recognize, do not respond in any way. Whether you respond "yes" or "no," anything other than deleting this message will trigger a call from a scammer bent on taking your money. If you want to check to make sure, log in to your account like you normally would, but never reveal your username, password, or any passcodes to anyone, ever.
