Zelle Fraud Litigation: What the Pleading-Stage Ruling Means for P2P Controls

TL;DR

• The New York Attorney General’s case against Early Warning Services survived nearly all of a motion to dismiss on July 20, 2026. That means claims proceed toward discovery; it is not a merits ruling, and Early Warning has said it will appeal.
• The complaint states allegations about Zelle’s fraud controls. Don’t rewrite those allegations as judicial findings.
• Regulation E turns on who initiated the transfer. A consumer-induced payment and a transfer initiated by a fraudster with credentials obtained by fraud are not treated the same.
• The CFPB’s separate federal case was dismissed with prejudice in March 2025. The New York action is a different proceeding under state law.

October 22, 2026 Status Update

The procedural record has three separate parts, and the case is still at an early stage.

The case is People of the State of New York v. Early Warning Services, LLC, Index No. 654753/2025. The Attorney General’s claims rest on New York Executive Law § 63(12), General Business Law §§ 349 and 350, and common-law theories. According to reports of the decision, the court dismissed or limited some theories but let the overwhelming majority proceed. Early Warning has said it plans to appeal. We have not seen a judgment, settlement, or appellate ruling as of October 22, 2026.

A board memo should not combine these matters into a single “Zelle ruling.” Identify the plaintiff, forum, claims, filing, and procedural posture each time.

What the New York Complaint Alleges

The Attorney General’s announcement and complaint allege that:

• Zelle launched in 2017, and enrollment lacked key verification steps, letting scammers register with email addresses that resembled trusted businesses or government agencies;
• users lost more than $1 billion to scams between 2017 and 2023;
• banks could report fraud to Early Warning long after it happened, and at launch Early Warning did not require banks to report certain scams, such as those where victims were tricked into sending money;
• Early Warning developed basic safeguards as early as 2019 but did not adopt them;
• Early Warning did not promptly remove fraudsters, did not require reimbursement for certain scams, and did not meaningfully enforce its own anti-fraud rules against partner banks.

The announcement’s example: a New Yorker paid $1,476.89 to a “Coned Billing” account after a caller impersonated a Con Edison employee, and the consumer’s bank said it couldn’t get the money back. The Attorney General seeks restitution and damages for New Yorkers and an order requiring anti-fraud safeguards.

Those allegations are useful for a control self-assessment because they show what a state enforcement office considers material. They are not findings by the court. Use attribution in every summary:

• Safe: “The complaint alleges that Early Warning failed to deploy adequate safeguards.”
• Safe: “The court held that the complaint adequately alleged misconduct by Early Warning itself.”
• Not safe: “The court found that Early Warning chose growth over safety.”

A motion-to-dismiss ruling asks whether properly pleaded allegations may continue. Discovery, later motions, settlement, trial, and appeal can change the record. Practitioners should still notice one thing the decision reportedly did address: Early Warning’s argument that it only operates a network and isn’t responsible for what happens on it didn’t end the case at the pleading stage. If you run a network, a platform, or a program on behalf of partner banks, “we just move the messages” is not a complete risk answer.

Regulation E Requires a Transfer-by-Transfer Analysis

Regulation E implements the Electronic Fund Transfer Act. Under 12 CFR 1005.2(m), an unauthorized electronic fund transfer is one “initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit.” It excludes transfers initiated by someone the consumer furnished the access device to, transfers made with fraudulent intent by the consumer or someone acting with them, and transfers by the institution or its employee.

That makes the word authorized easy to misuse in scam reporting.

Consumer initiates the payment

In a classic authorized push payment scam, the consumer intentionally sends money but is deceived about the recipient or purpose. That fact pattern may fall outside the unauthorized-EFT definition. Contract terms, network rules, state consumer-protection law, and voluntary reimbursement policies may still apply. The New York case is, in large part, about that gap.

Fraudster initiates the payment

The CFPB’s Electronic Fund Transfer FAQs say unauthorized EFTs include transfers initiated by a person who obtained a consumer’s access device through fraud or robbery. They also address the induced-credentials case directly: when a third party fraudulently induces a consumer to share account access information and uses it to initiate a transfer, the transfer is unauthorized, and the consumer has not “furnished an access device” within the exclusion. The FAQs also confirm that P2P payments meeting the EFT definition are covered.

The clocks that apply once it’s unauthorized

Worked example: three disputes, three answers

1. “I sent $800 to someone posing as my utility.” The consumer typed the payment and confirmed it. Likely not an unauthorized EFT under 1005.2(m). The case still needs documented intake, a recipient-side review, and a decision under any voluntary reimbursement or network policy.
2. “A ‘bank fraud agent’ got my one-time passcode and then money left my account.” The fraudster initiated the transfer with credentials obtained by fraud. Under the CFPB FAQs, that is an unauthorized EFT. Error-resolution timelines and liability limits apply.
3. “I let my nephew use my login and he drained the account.” The consumer furnished the access device. Excluded unless the consumer had told the institution the nephew’s transfers were no longer authorized.

The label “scam” fits all three. The Regulation E answer differs in each.

Operational consequence

Dispute intake should record at least:

• who entered and confirmed the payment instruction;
• whether a fraudster remotely controlled the device or account;
• how credentials or an access device were obtained;
• whether the consumer received a benefit;
• the payment rail and account type;
• the applicable error-resolution timeline; and
• any separate network or voluntary reimbursement policy.

Don’t let an “APP scam” label decide the Regulation E result before those facts are established. Our guide to Regulation E P2P scam liability and investigation standards goes deeper on investigation files.

Five Control Questions for P2P Operators

1. Can recipient onboarding detect impersonation and mule activity?

The complaint’s lead allegation is about enrollment: lookalike business and government names. Test identity verification, account-name controls, device reuse, velocity, linked accounts, and escalation for government, bank, utility, and support impersonation. Document why thresholds are proportionate to the product’s risk.

2. Does monitoring work at network level?

A participant sees one sender’s payment; the network can see repeated receipt patterns across institutions. Define how recipient concentration, rapid cash-out, linked devices, complaint history, and law-enforcement referrals affect holds, limits, review, or removal. On instant rails there’s no settlement window to save you; see our instant payments fraud controls guide.

3. Are control deferrals governed?

The complaint alleges safeguards were developed by 2019 and not adopted. Whatever the court eventually decides, that’s the fact pattern to avoid in your own records. For every material safeguard that is rejected or delayed, retain the risk addressed, alternatives considered, compensating controls, accountable approver, target date, and revalidation trigger. A business decision can be defensible; an undocumented backlog is much harder to explain.

4. Are warnings specific and timed to the risk?

Evaluate whether warnings appear before an irrevocable payment and whether they match the scam pattern. Test comprehension and abandonment rather than counting banner impressions. Warnings supplement identity, monitoring, and response controls. They don’t replace them.

5. Can the program act on known-bad recipients?

Set evidence standards and response times for restricting, investigating, or terminating recipients tied to fraud reports, and for how fast partner institutions must report. Include false-positive review, appeals, information sharing (including FinCEN 314(b) sharing), and post-action monitoring.

So What?

The New York case is not a new Regulation E rule and not a judgment against Early Warning Services. It’s a live state enforcement action whose allegations survived a pleading-stage challenge, with an appeal signaled. State attorneys general don’t need the CFPB to pursue P2P fraud theories, and this one is moving to discovery.

The practical response is a documented fraud-control review: classify transfers accurately, test recipient and network controls, preserve decisions about delayed safeguards, and keep state-law exposure separate from federal error-resolution analysis.

The KRI Library can structure monitoring, but thresholds and response rules must be calibrated to the product, fraud history, legal obligations, and risk appetite.

Sources: New York AG complaint | New York AG announcement | American Banker decision report | Consumer Finance Monitor decision summary | CFPB federal case and dismissal status | Regulation E | CFPB Electronic Fund Transfer FAQs