Zelle and Venmo scam texts, and why the money rarely comes back

Updated August 6, 2026

Almost everyone carries the same assumption about payment apps: if something goes wrong, you call somebody and they reverse it, the way a credit card company would. That assumption is the expensive part. Zelle and Venmo payments settle in seconds and there's no chargeback waiting behind them, which is why a fake Zelle text is worse news than a fake bank text. So catch them at the door. If a message says your Zelle or Venmo account is locked, or that a payment is on hold until you verify, it's phishing, and two facts prove it in about five seconds. Zelle shut down sending and receiving on its standalone app on April 1, 2025, so Zelle now exists only inside your bank or credit union's app; any message telling you to log in to "your Zelle account" is fake by definition. Venmo sends its texts from one five-digit short code, 86753, and nothing else.

The tells that take five seconds

• Zelle has no app. Early Warning Services, which runs the network, killed money movement on the standalone app in April 2025 because barely 2% of transactions were happening there. A text asking you to download or sign into a Zelle app is a scam every time.
• Venmo texts come from 86753. Any other number, including one that looks like an ordinary mobile number, isn't Venmo. Official Venmo email comes from the venmo.com domain, and Venmo says it will never ask for your six-digit code by phone, text, email, or chat.
• Nobody at either company needs your passcode. If someone wants a code that just arrived on your own phone, they're trying to finish logging in as you.

To report one: screenshot the Venmo text with the full sender number visible and send it as an attachment to phishing@venmo.com. That inbox is automated, so don't put personal details in the message and don't expect a reply. For Zelle, report through your own bank first. Zelle's support line is 1-844-428-8542, 8am to 10pm Eastern, seven days a week outside major holidays.

The account is locked text

Tapping the link lands you on a login page that looks close enough. It harvests your username and password, then asks for the one-time passcode, which is the part that actually matters. Behind the scenes someone is typing your credentials into the real site and waiting for you to hand over the code that lets them in.

If you typed anything into that page, treat it as an account takeover rather than a near miss. Change the password from a different device, sign out all sessions, check whether the linked email or phone number was quietly changed, and call your bank. If the message reached you as a QR code rather than a link, you can decode the image in your browser and read the destination without scanning it.

The accidental payment con

Money lands in your account from a stranger. A message follows within minutes: wrong person, so sorry, could you send it back? The apology is convincing and the amount is usually a few hundred dollars, small enough to feel harmless.

That incoming money came from a stolen card or a hijacked account. Days later, when the real owner reports it, the original payment gets clawed back out of your balance. Your polite refund does not come back with it. You end up out the full amount and holding nothing anyone will reimburse, because you sent that second payment on purpose.

Don't send it back yourself. Not once, not partially, not "just to be nice." Leave the money alone, tell the sender to open a request through the app's own support, and report it to your bank or to Venmo. If the mistake is genuine, the platform can move it. If it's a con, the pressure escalates fast, and that escalation (rent money, a sick relative, threats to report you for theft) is the tell.

Why cards protect you and payment apps don't

Credit cards run on a dispute system built for buyer's remorse and merchant failure. You get chargeback rights, a real investigation, and a merchant on the other end who can be debited. Payment apps have none of that architecture behind them.

What they have instead is Regulation E, the federal rule covering electronic fund transfers. Reg E protects you against unauthorized transfers, meaning somebody got into your account and moved money without your knowledge. Those are reimbursable, subject to liability caps. But if you pressed send yourself, even after forty minutes of expert lying, the transfer is legally authorized, and Reg E doesn't require anyone to give that money back.

That one distinction is the entire fight over payment app fraud. It's also why the fake bank call described on our page about bank fraud alert texts always steers you toward Zelle rather than a card. The scammer isn't choosing Zelle for speed. They're choosing it for the legal category it drops you into.

What actually happens when you dispute

For an unauthorized claim, the timeframes are concrete. Notify your institution within 60 days of the statement showing the transfer. It generally gets 10 business days to investigate, and if it takes the full 45 days permitted, it's supposed to give you provisional credit while it works, though it can hold back up to $50 where it has a reasonable basis.

For scam-induced payments, you're relying on policy rather than law. Since June 30, 2023, Early Warning Services has required its participating banks and credit unions (roughly 2,100 of them) to reimburse customers for qualifying impostor scams, using a clawback against the receiving account. The catch is real: Zelle has never published the criteria for what qualifies, so you genuinely can't tell in advance whether your case counts. Outcomes vary by bank, and the burden of explaining what happened lands on you.

Venmo's protection works differently again. Purchase Protection covers payments tagged as goods and services (item never arrived, item significantly not as described, damage in shipping), with the seller paying the fee. Friends and family payments carry no protection whatsoever. Anyone pushing you to pay friends and family "to avoid the fee" is telling you in plain language that they want a payment you can't dispute.

Where the law stands in 2026

The federal case is gone. The CFPB sued Early Warning Services along with JPMorgan Chase, Bank of America, and Wells Fargo in late 2024, alleging more than $870 million in customer losses over seven years, then dismissed the case with prejudice on March 5, 2025, which means it can't be refiled.

New York's suit is the live one. Attorney General Letitia James alleges the network's design enabled over $1 billion in fraud between 2017 and 2023, and on July 20, 2026, Justice Phaedra Perry-Bond denied nearly all of Early Warning's motion to dismiss, sending the case into discovery. Early Warning has said it intends to appeal.

My honest read on that ruling: it matters for how these products get built a few years from now. It does nothing for a payment you sent last Tuesday. Don't wait on litigation.

If it already happened

Call your bank's fraud line using the number on your card, today. If someone accessed your account, use the phrase "unauthorized transaction" and ask for a written Regulation E claim, because that specific framing is what starts the timelines above. Sent it yourself after being deceived? Say so clearly anyway, and ask directly whether your bank participates in Zelle's impostor scam reimbursement.

Then build the paper trail. Report at reportfraud.ftc.gov and at ic3.gov. If your bank denies the claim, a complaint at consumerfinance.gov/complaint still forces a formal response, though the CFPB overhauled that portal on June 24, 2026 with stricter identity verification and a clearer expectation that you've already exhausted your bank's own dispute process first. Your state attorney general's consumer protection office is worth a filing too, and New York's activity here suggests state offices are paying closer attention than federal ones right now.

None of that reliably gets your money back. Recovery on authorized push payments is poor, and anyone claiming otherwise is selling something. What the hour of filing actually buys you is narrower: a denial that sometimes gets reversed on escalation, a written record with your name on it, and a data point in the counts that eventually move policy. Worth doing. Not worth waiting on. If the whole episode started with an unexpected parcel rather than a text, the same crews work that angle, which we cover in the page on the unordered package that shows up at your door.