Bank imposter frauds and scams, resulting in sizable wire transfers of stolen funds, are not new. And Wells Fargo is not the only bank whose customers experience this kind of trickery. But even looking just at Wells Fargo, you can see the size of the problem. In just the past two years, three class-action lawsuits from bilked customers have been filed against the bank in California, Pennsylvania, and Virginia. Dozens of other, similar reports of wire fraud scams have been publicized across the U.S.
In one case, a Virginia woman lost her life savings, more than $700,000, in a series of wire transfers made online and in person at a Wells Fargo branch. In another, a Los Angeles woman had $100,000 wired out of her Wells Fargo account after a bank employee was tricked by the scammers.
Phishing schemes, which typically involve criminals sending texts and emails pretending to be a bank or government agency, are proliferating. Since 2019, the number of phishing complaints to the FBI has more than doubled, to nearly 300,000 reports last year, according to the agency’s 2023 Internet Crime Report. And nearly half of all Americans have encountered some type of cyberattack or scam online, according to a nationally representative CR survey of 2,042 U.S. adults conducted in April 2024 (PDF). Of those, 19 percent reported losing money as a result.
Today, scammers—usually working in small teams, each with a specific job, and often operating overseas—are employing increasingly sophisticated cyber tools and using hacked personal data to exploit lingering gaps in banks’ security protocols. In many cases, the cybercriminals are buying so-called “phishing-as-a-service” cybercrime kits and subscriptions—a one-stop shop of tools, templates, and services made specifically for criminals so that they can more quickly and easily lure bank customers and steal their money. The kits, available on the messaging app Telegram and on the Dark Web, can be purchased as a subscription for as little as $150 a month and have bizarre names, such as Anthrax, the ONNX Store, and Darcula.
Banks are struggling to keep up, despite spending billions of dollars each year on anti-fraud measures. They are also denying wire fraud claims from their customers, citing the Electronic Fund Transfer Act. That federal law doesn’t require banks to reimburse customers when they are tricked and end up authorizing money to be sent to scammers. Rather, the law requires banks to make their customers financially whole only in limited circumstances—like when a cybercriminal gains unauthorized access to their accounts after finding or stealing someone’s phone.
“Financial institutions across the board are not reimbursing consumers, even when it appears the wire transfer request was not done by the consumer but someone who gained access to the consumer’s account and initiated the wire,” says Carla Sanchez-Adams, a senior attorney at the National Consumer Law Center who focuses on emerging issues with banking. “In other words, even where the weak law provides some remedy for a consumer for an unauthorized wire, the financial institutions fight tooth-and-nail to hold the consumer liable.”
“Once the money is transferred from your account, you have not days, not hours, but minutes to report it, to have hope of getting something back,” says Thomas W. Cronkright II, the co-founder and executive chairman of CertifID, a company that works with government agencies and companies on fraud cases.
A proposed amendment to the law, called the “Protecting Consumers from Payment Scams Act,” would require banks to share the financial liability for such frauds when the customer is “induced” into sending criminals money. In 2023, three of the country’s largest banks—JP Morgan Chase, Wells Fargo, and Bank of America—reimbursed their customers for scams at relatively low rates: 2 percent, 4 percent, and 24 percent, respectively, Senate investigators found.
“The banks are aware that, every single day, some of their customers are going to be hurt,” says Sen. Richard Blumenthal (D-Conn.) in an interview with Consumer Reports. “But they are failing to protect consumers from threats. They fail to prevent the frauds. And then they refuse to reimburse consumers when the speed and irreversibility of these transactions causes their consumers to be duped.”
