Con Watch: How Safe Are Peer-to-Peer Payment Services?

Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams. See Steve’s other Con Watch articles.

Peer-to-peer (P2P) payment service like Zelle, Venmo, and CashApp are used by many people to quickly and conveniently send money electronically from their bank account or credit card. Sending money through these services only requires you to enter the recipient’s mobile phone number or email address. It couldn’t be easier.

Unfortunately, it also couldn’t be easier for crooks, and unlike scams targeting your credit cards, you may not have as much protection under the law to get your money back if you do get taken.

While most P2P payment services are considered safe to use from the perspective of their built-in security, the direct peer-to-peer payment aspect makes it all too easy for people to be defrauded.

In addition to luring people to pay for worthless items through these services, scammers may also send phishing emails and text messages asking for usernames, passwords, and PINs to take over their victims’ bank accounts. If you were tricked into sending a payment, you didn’t have any protection, but that is starting to change.

In October 2022, Senator Elizabeth Warren released a report that found rampant and increasing fraud and scams on Zelle. And in December of 2023, Senators Warren, Sherrod Brown, and Jack Reed urged Venmo and Cash App to start reimbursing victims of scams.

After pressure from the senators, Early Warning Services, the owner of Zelle, agreed to reimburse some victims of scams for their losses. Banks and credit unions that use Zelle are now required to reimburse customers who are victims of qualifying imposter scams where the crook poses as the victim’s bank.

Unfortunately, this new policy was poorly communicated to customers. Last month, Senators Warren, Brown, and Reed sent a letter to Zelle in which they pointed out that  Zelle had not shared specific information about its new reimbursement policy, and customers were not aware that they might be able to get refunds. The senators wrote:

In November 2023, it was reported that Zelle began to reimburse customers who are subject to imposter scams, a scam in which someone impersonates a representative at a financial institution, a business, utility, or a governmental entity to trick a consumer into sending money. However, it remains unclear whether this reported policy is standard practice because the details have not been made public. Zelle’s webpage says: ‘Because you authorized the payment [in a scam], you may not be able to get your money back’ and that ‘[q]ualifying imposter scams may be eligible for reimbursement’; it does not specify which categories of imposter scams may qualify or what steps a victim must take to exercise their rights under the reimbursement policy.

Additionally, the senators voiced their concern about Zelle’s unnecessarily complicated reporting requirements for scam victims. Zelle’s nonsensical official position is that it has not clarified the new rules about reimbursing victims of “certain imposter scams” because it would tip off scammers.

The senators have sent similar entreaties to Venmo and CashApp.

Meanwhile, Zelle users continue to be victimized by imposter scams: Someone posing as a Wells Fargo bank official recently convinced Eileen Loughran of San Francisco to transfer $3,500 through Zelle, and Zelle continues to deny her claim for reimbursement.

Most recently, the senators have backed a proposed federal rule that would expand oversight and supervisory authority over big tech companies that offer digital peer-to-peer mobile payment systems and digital wallet services, saying that nonbank tech companies such as CashApp, Venmo, and Zelle should be held to the same basic standard of consumer protection as banks, credit unions, and other financial institutions.

How to Protect Yourself

• Before signing up for Zelle or any other P2P service, familiarize yourself with their fraud protection rules. In the fine print of many P2P services, you may find that you have little, if any, protection if you use the account to purchase something that ends up being a scam. While PayPal offers significant protection from fraudulent transactions, Zelle and Venmo, for example, do not offer such protection.
• If possible, connect your payment service to a credit card, which will offer you more protection, instead of a bank account (note that not all services allow this).
• Use a PIN or other dual factor authentication when available to help protect your account.
• Never provide your username, password, or PIN in response to any email, text message, or phone call. Requests for this information are never legitimate.
• If you have any concerns about a communication being legitimate, contact your bank or other company by calling them at a telephone number you know is accurate. Even if you get a call that appears to come from your bank, it could be a scam.
• P2P payment apps should only be used for payments to friends and family with whom you are totally familiar. It should not be used for payments for any commercial purpose.