Why regulators can't go as far as they'd like to stop Zelle scams

I'm not accustomed to getting spam text messages. Junk mail? Of course. Spam in the inbox? There's a filter for that. Even spammy calls about a warranty for a car I don't own is something I've gotten used to over the last few years.

But spam texts are kind of a new frontier, and many of the ones I receive — and delete, and block — are purportedly coming from my bank, informing me that I must contact them at once. Or, more to the point, they purportedly come from Zelle — the peer-to-peer payments platform owned by the largest banks — claiming that the transfer I didn't make fell through or that an unexpected windfall is waiting for me if I just click the link.

Momma didn't raise no fools, so I ignore — and, again, block and delete — these spam texts just the way I have ignored spam calls, junk mail and chain letters for years. But the reason people keep sending them is because in the aggregate, they work. And while spam messages are annoying to me, they can be ruinous to the people who take the bait. 

Alex Edelman/Bloomberg

Part of that is because when someone, say, steals your credit card and buys a bunch of front-row tickets to see Bruno Mars at Madison Square Garden (true story), the credit card makes you whole. When someone tricks you into sending your money via Zelle, in most cases that's just your own bad luck.

The Consumer Financial Protection Bureau under the direction of Rohit Chopra thinks something is fishy about this and is gearing up for a fight with banks — the owners of Zelle's parent company, the weirdly-named Early Warning Services, LLC — over who exactly is liable for P2P fraud. But while Chopra may want to stick banks with the bill as it reworks its Regulation E — the implementing regulation for the Electronic Fund Transfer Act — the letter of the law will make that exceedingly difficult without a legislative fix.

A showdown is coming over who is liable for P2P payments fraud

The EFTA, first drafted in 1978 and most recently amended in 2009 and again by Dodd-Frank in 2010, establishes the rules of the road for electronic payments ranging from ATM transactions and credit card swipes to debit card transactions and P2P payments. But the bulk of the consumer protections in the law address "unauthorized transactions" — a term that the law itself defines as a transaction "initiated by a person other than the consumer without actual authority to initiate such transfer." The law also goes on to expressly say that transactions made by someone who was given access to the consumer's accounts don't count as unauthorized transactions.

There's an important difference between someone cloning your card and buying Bruno Mars tickets and someone inviting you to give them money via Zelle for whatever scammy reason. And even if the end result for the scammer is the same, the outcome for the consumer is very different, due to a regulatory quirk.

Even if the CFPB will have a hard time making the legal case for putting banks on the hook for Zelle fraud, that doesn't mean regulators are powerless to do anything about it. The lowest-hanging fruit here likely doesn't lie with the CFPB at all, but rather with the Federal Communications Commission, which oversees the telecommunications industry. Given that these texts and calls are facilitated by telecom networks — and given, again, that they are annoying scams — the FCC should compel these networks to put a lid on these kinds of unsolicited communications the way it did with telemarketing and robocalls. The FCC compelled networks to implement a suite of anti-spoofing protocols (delightfully known as STIR/SHAKEN) last year, and I'm sure that helps. But if the question is how to reduce fraud on Zelle, the telecoms are clearly part of the answer.

That isn't to say that banks are blameless. Whereas EFTA requires banks to investigate unauthorized transactions, P2P networks like Zelle don't extend the same practice to alleged incidents of fraud on those platforms. They should, if for no other reason than doing so would improve the public perception of those platforms as safe. And if they don't — if caveat emptor is the philosophy of P2P — then the CFPB would be on firmer footing to require that they do.