First Person: How Fraud Found My Family
By Maddy Perkins, Managing Editor at The Financial Brand
Simple Subscribe
Subscribe Now!
Executive Summary
- A recent fraud attempt on our managing editor’s mother highlights a growing customer service and reputational problem for banks.
- As federal consumer protections dwindle, how should banks respond when the onus is increasingly on them to protect their customers?
- As bank marketing experts, what would you suggest? Have you or your loved ones experienced anything similar? If you have any ideas, talk to us: [email protected].
Six words I didn’t want to hear: “Something weird happened with the bank.”
Amid a rush to find a new apartment after my landlord decided to sell at the last minute, my mother and I had been dividing and conquering the multi-step cashflow nightmare of signing a new lease in the New York City area. Deposit, two months rent, broker fee. Several banker’s checks. It was all moving too quickly and something had to go wrong.
“Some guy from Chase called and told me I had two fraudulent transactions — $1,500 and $3,000 — processing via Zelle and that I had to act quickly to cancel,” she said. The man on the phone went on to give her a “cancellation code,” a code for “a manager at Chase” and instructed her to plug them into Zelle’s recipient field. Knowing something felt off, she checked to see if there were any pending transactions. There weren’t any she could find. She plugged in the “codes” and noticed they added a new recipient. He explained that by inputting the codes, she would stop the bad transactions before they went through. “Shouldn’t you guys be handling this?” she asked. “No, there’s not enough time.” She hung up — it was too suspicious. It appears the “codes” were likely Zelle usernames made to look like codes.
In my decade of covering the financial services industry, I’ve come across, written and edited countless stories on fraud. I, too, could smell B.S. Mom told me the call came from a number identified as “Chase” on caller ID. Curiously, he knew her name and that she was an accountholder.
I urged her to call Chase. They confirmed they saw no fraudulent transactions processing. It was weird that someone called, they said, but it wasn’t them. Nothing they could do.
I emailed a Chase spokesperson to ask if this was the standard operating procedure and if they would like to provide a comment. “This customer took the right steps by contacting us directly to verify the call’s legitimacy. Bank impersonation scams are common, and we urge customers to ignore outreach asking for money or access to accounts — banks won’t make these requests, but scammers will. Always report instances of fraud or a scam to your bank, as your vigilance helps us enhance our systems to continue protecting our customers,” the spokesperson wrote.
We ran a reverse call search and found the number belonged to a man in Georgia who had no ties to Chase — and 22 fraud complaints tied to his number.
This led to a number of frustrating unanswered questions:
- How did he know my mom’s name and that she was an accountholder?
- Did the many transactions she was firing off due to the move tip anyone off?
- How could we prevent this from happening again — either by the same culprit or similar copycats?
- Was her data safe?
- Chase’s response was so unsatisfying. Surely they could have offered us more than a shrug?
- Did this have anything to do with her age? Was this an elder fraud scam?
Fending For Yourself
Zelle made headlines last year as the CFPB introduced a lawsuit suing the payment platform and three of its parent banks — Bank of America, Wells Fargo, and yes, JPMorgan Chase — over failing to protect consumers from “widespread fraud.”
“The nation’s largest banks felt threatened by competing payment apps, so they rushed to put out Zelle,” Rohit Chopra, the CFPB’s director at the time said in a statement. “By their failing to put in place proper safeguards, Zelle became a gold mine for fraudsters, while often leaving victims to fend for themselves.”
The CFPB statement announcing the suit cited Zelle’s limited identity verification methods, claiming that “criminals often exploited Zelle’s design and features to link a victim’s token to the fraudster’s deposit account.” Sounds familiar. It also said the payment platform and banks were too slow to restrict fraudsters, allowing them ample opportunity to hop between banks. Furthermore, “despite receiving hundreds of thousands of fraud complaints, the defendant banks have failed to use this information to prevent further fraud.”
The lawsuit was dropped in March as part of the Trump Administration’s sweeping move to pull back on enforcement actions by the bureau’s prior leadership. Also in March, Chase did introduce Zelle speed restrictions and payee verifications tied specifically to transactions over social media. But the changing landscape signals a much bigger problem.
The gradual dismantling of the CFPB “beggars belief that consumer protection will be gone forever,” Mark Narron, senior director of Fitch Ratings, told The Financial Brand last month. “At some point, banks will be answering to reputational risk, junk fees, Zelle fraud, what have you. It’s going to come back.”
Dig deeper:
- Is the Policy Pendulum in D.C. Swinging in Banks’ Favor?
- How Banks Can Find Their Voice in a Turbulent Regulatory Landscape
- How the CBA is Navigating Washington’s Shifting Political Landscape
Here it did. And the lack of help we received from Chase goes to show that perhaps banks are unprepared to answer the full scope of such concerns. We, indeed, felt left to fend for ourselves. While I’d contend it would perhaps be unreasonable to hold Chase fully responsible for an external fraud attempt conducted in their name, I would argue they are responsible for looking into some of our questions and providing some guidance or explanation. Notably:
Is my mother’s data safe? The fraudster knew her name and that she was an accountholder. The latter could be a lucky guess: Chase has a strong regional foothold in New Jersey and she has a 201 area code. But both?
Should she notify them of any additional attempts moving forward? Chase, like most banks, is explicit that customers should call the number on the back of their card if they are suspicious of a call claiming to be from the bank — a sentiment echoed in the statement cited earlier. However, given that all we received was confirmation of what we already knew, this doesn’t seem very helpful.
Question for Readers: What Would an Appropriate Response Be?
While this writer certainly has her mother’s interests at the center of this question, the reputational risk posed to banks by offering lukewarm responses to fraud concerns is real — especially when the onus is increasingly on banks to protect their customers.
When I brought this anecdote to the rest of The Financial Brand editorial team, we tried to ideate what a more appropriate solution could be. What advice should banks offer for customers to protect themselves beyond dialing an 800 number and receiving an unsatisfactory response?
One colleague noted that banks don’t always make it easy, either: “Years ago, we had a call from the bank that was really the bank. The caller was asking for information. I said I wasn’t going to cooperate with her without a case number and that I would call the number on the back of the card and ask for it. In the end, she relented, I called, got her again, and we straightened things out.”
My first idea — admittedly, ‘duh’ — was to encourage offering better consumer education on how to identify these attempts. In this instance, my mother is a veteran financial professional with a daughter who is a business journalist. Still, she engaged with the fraudster for some time before recognizing something was off. If it could happen to us, it could happen to anyone, right? But, to quote another one of my colleagues, a call for education is “weak beer:” It could place concerned consumers back into the doom loop of “suspect something, call.”
And so, dear readers: As bank marketing experts, what would you suggest? Have you or your loved ones experienced anything similar? If you have any ideas, write to me at [email protected].
