It's so strange to read this is still happening in US. I live in Europe - 95% of such attacks are prevented by something called Strong Customer Authentication, which anybody serving or providing access to an account (cards including) must implement. Basically, that's 2FA implemented in myriad different ways. So, this Zelle thing wouldn't be possible at all: Zelle would have to ask for a SCA verification from the customer, just to connect/use his/her account in the first place. That would eliminate ground for such scamming messages ever appearing (if the customers knew and were accustomed to SCA).
Though to be fair, scamming is still present here, typically involving calling older people and trying to persuade them to reveal bank access codes during a phone call. There two differences with US banks here:
- banks are required never to ask for access credentials over insecure channel (phone/email) (though SMS is also not perfect in this regard);
- banks are required to educate customers that they never ask for such credentials, educate about fraud scenarios, etc. And they do (at least the reputable ones)
Seems that the PSD2 regulation (including SCA) are really making payments much safer in Europe when you compare to rest of the world.
Also, to admit: I'm a head of financial institution here, quite knowledgeable of the field, both on regulatory and on technical level.
Though to be fair, scamming is still present here, typically involving calling older people and trying to persuade them to reveal bank access codes during a phone call. There two differences with US banks here: - banks are required never to ask for access credentials over insecure channel (phone/email) (though SMS is also not perfect in this regard); - banks are required to educate customers that they never ask for such credentials, educate about fraud scenarios, etc. And they do (at least the reputable ones)
Seems that the PSD2 regulation (including SCA) are really making payments much safer in Europe when you compare to rest of the world.
Also, to admit: I'm a head of financial institution here, quite knowledgeable of the field, both on regulatory and on technical level.