Arguably, the entire selling point of Zelle as a platform is that it is owned by big banks that ostensibly are invested in making sure that your money is safe. Turns out security was not the priority that you might imagine, according to New York Attorney General Letitia James. In a lawsuit against the money transfer, the top prosecutor for New York State claims that customers have lost more than $1 billion to fraud on Zelle, which was enabled by a lack of sufficient protections.

In the suit, James alleges that Zelle has been insecure since it first launched in 2017, and its parent company, Early Warning Services (which is owned by Bank of America, Capital One, JPMorgan Chase, Wells Fargo, and other major financial institutions), has mostly ignored the problem. “EWS knew from the beginning that key features of the Zelle network made it uniquely susceptible to fraud, and yet it failed to adopt basic safeguards to address these glaring flaws or enforce any meaningful anti-fraud rules on its partner banks,” the AG’s office said in a statement.

As evidence of this point, James points out that Zelle didn’t include a sufficient verification process to make users confirm their identity, making it easy for scammers to spoof others. Because transactions on Zelle can’t be reversed, there is shockingly little friction between transactions to keep people from falling for impostors. The issue was so bad that Congress pressured Zelle into refunding victims of impostor scams back in 2023 after learning that users of the app had lost $440 million to such fraud that year. Not great for a platform that actively advertised itself as “safe.”

Another beef James has with Zelle: It allegedly didn’t respond to consumer complaints about fraud. “Even when EWS did receive reports of fraud, it failed to promptly remove the fraudsters from the Zelle network or require banks to reimburse consumers for certain scams,” James alleged, stating that when the app launched, the parent company didn’t even require banks to report scams, which theoretically could have prevented network-wide abuse.

New York’s lawsuit picks up where the Consumer Financial Protection Bureau left off. The agency had announced it was suing JPMorgan Chase, Bank of America, and Wells Fargo in December 2024, alleging similar charges of fraud and failure to protect users. That case was dropped almost immediately by the Trump administration, which proceeded to fire the head of the bureau and attempted to shutter it entirely. Trump probably can’t shut down the state of New York, so this case should likely continue.