Tap to pay, Zelle and Venmo may not be as secure as you think, Consumer Reports warns

Sandy Sans had rented a ski cabin in Lake Tahoe for several years via Craig's List, paying for it using Zelle, a digital payment app linked to his bank account.

But in 2018, as it was getting close to his check-in-date, something didn't feel right about the owner he was dealing with. When Sans did some more research, he realized he had not been dealing with the owner of the cabin, but a scammer. He had sent $1,300 for the rental.

Sans, who lives in Los Altos, California, tried – and failed – to get his bank to reverse the payment he sent to the scammer. The bank also cited privacy reasons for being unable to give him information about the person who received the money.

In his complaint to Consumer Reports, Sans said it did not matter that the money had been obtained "through deception and lying.  I reported to the appropriate law enforcement but they also could not do any meaningful tracing of the money or really get any information at all."

Sans said he was taken aback "how the 'privacy laws' protect the criminal."

Capitalize on high interest rates: Best current CD rates

Zelle isn't the only peer to peer payment app (P2P) he has used, and despite being scammed, Sans told USA TODAY he still uses several for business purposes. But now, he uses the apps only with people he knows, he said.

Use of Venmo, Zelle, mobile apps on the rise

With digital payments on the rise, apps like Zelle, Venmo, Apple Pay and Cash App, say they have implemented numerous steps to protect consumers. But Consumer Reports says they're not doing enough.

"Despite the increasing risk and harm of fraud and scams on P2P services, companies have made no pro-consumer changes to their policies," Consumer Reports said in a report on the need for additional protections.

Consumers have been increasingly using digital payment apps to pay friends and family and to buy goods and services.

In 2023, 72% of consumers used an online or mobile payment account, according to the 2023 Survey and Diary of Consumer Payment Choice by the Federal Reserve Bank of Atlanta.

But the financial losses incurred by consumers on these apps – either through fraud or scams – have also increased.

In 2023, consumers reported losing $210 million to scams on the platforms, according to data from the Federal Trade Commission. That's up 62% from the losses in 2021.

How are digital payment apps regulated?

The digital payment apps are less regulated than debit and credit cards, especially for payments that are disputed as fraudulent.

A key sticking point is whether the digital payment is "unauthorized," or a result of a stolen account, versus a consumer being induced to send a payment to the wrong person or a scammer.

There are pretty clear protections for unauthorized transactions, which cover consumers' losses, but "where you have more fuzziness is in what is called fraud in the inducement," when a scammer persuades a consumer to send money for goods or services that turn out not to be legitimate, said Delicia Hand, senior director of digital marketplaces for Consumer Reports.

Depending on the fine print in their user agreements, consumers may not always be able to get reimbursed in those instances, Consumer Reports says.

Yet these scams are increasing in volume and complexity, and consumers should be more protected by the payment apps, which are also increasingly being used for the scams, Hand said.

Consumer Reports did an evaluation of user agreements and protections for the most popular digital payment apps in 2022. Recently, it took another look at the digital apps to see if there had been progress made to protect consumers from fraud.

Consumers need more fraud protections, Consumer Reports says

In a report published in late September, Consumer Reports said there have been some changes, but not enough. Consumer Reports is calling on the payment app providers and the Consumer Finance Protection Bureau (CFPB), which oversees and enforces existing regulations around the payment forms, to strengthen the protections for consumers.

Consumer Reports recommended the bureau "require more generous liability protection for unauthorized transactions, and to implement liability protection for fraudulently induced transactions."

Consumer Reports also called on the payment apps to make several other improvements, including:

• Implement a mandatory 24-hour holding period for transactions of $500 to $750 or more, with an option for consumers to override it by providing additional verification.
• Institute a universal 12- to 24-hour window during which all payments can be easily reversed by consumers, similar to the cancelation policies of other financial vehicles and institutions.
• Commit to improving the transparency and thoroughness of internal investigation procedures and more fully reimbursing consumers who are victims of sophisticated induced fraud scams.
• Improve user authentication methods by implementing multi-factor authentication for all transactions over $500.

Consumer Reports said it was also watching pending legislation, dubbed Protecting Consumers Against Payment Scams, which has been introduced in both the Senate and House, to increase protections on P2P platforms. The legislation, introduced in August by Sens. Richard Blumenthal, D-Conn., Elizabeth Warren, D-Mass., and Rep. Maxine Waters, D-Calif., would protect consumers when they are lured into sending a payment to a scammer; when they lose money through fraudulent bank wire transfers; and when their accounts are inexplicably frozen or closed. The legislation has not yet advanced.

“Right now, fraudsters are using every trick in the book to steal money from hardworking consumers through payment apps like Zelle, Venmo, or old-fashion bank wire transfers. That’s why it is absolutely critical that we move quickly to modernize our consumer protection laws to reflect the realities of today's payment systems,”Waters said in a joint statement released when the bills were introduced.

Victim of fraud?Protections are different for debit, credit cards.

Payment apps respond

Via statements and interviews with USA TODAY, representatives for the P2P apps said their platforms protect consumers.

Zelle sent Consumer Reports a letter after its report was published online, expressing disappointment that it was published before a meeting between the parties and saying there were inaccuracies.

In an interview with USA TODAY, Zelle Chief Fraud Risk Management Officer Ben Chance said all unauthorized transactions in which the consumer did not send the money are reimbursed 100%. For payments made by an account holder to a scammer, all Zelle financial institution participants will investigate on a case by case basis, but scams involving imposters posing as a government agency, financial institution or existing service provider will also be fully reimbursed.

In a statement provided to USA TODAY, Venmo said: "Venmo has always had a zero-tolerance policy for attempted fraudulent activity, and we continuously evolve our fraud prevention capabilities and invest heavily in products, features, and solutions that prevent fraud from occurring in the first place, including 24/7 fraud monitoring, encryption, and machine learning scam avoidance modeling to proactively take action by limiting scam accounts and declining risky transactions."

Unauthorized transactions will be fully reimbursed. A Venmo spokesperson also said users have protections through Venmo Purchase Protection, which covers eligible transactions even if they're authorized by a purchaser.

Cash App said in a statement that it "remains committed to building a safe and secure platform to protect our customers. We strive to mitigate risk on the platform through a combination of preventative controls, dynamic detection, and consumer education. As part of these efforts, we're constantly developing new features and upgrading our tooling, including upleveling reporting flows and enhancing payment warnings."

Apple did not respond to a request for comment on its Apple Pay services.

Protect yourself

Here are some tips from Hand for consumers using P2P apps:

Send money only to people you know. "Just like you wouldn't give a check to someone you don't know, don't click or swipe" to send money to someone you don't know, Hand said.

Verify the person you're dealing with. "We move so quickly. We might mistype something," Hand said. "Verify the recipient's information carefully before sending the money."

Betty Lin-Fisher is a consumer reporter for USA TODAY. Reach her at blinfisher@USATODAY.com or follow her on X, Facebook or Instagram @blinfisher. Sign up for our free The Daily Money newsletter, which will include consumer news on Fridays,here.