Is Zelle covered by Reg E? The rule, payment by payment

Yes, Zelle is covered by Reg E: a Zelle payment from a consumer's account is an electronic fund transfer, so Regulation E's error-resolution and liability rules apply to it like any other EFT. Coverage does not mean every Zelle loss is repaid. Regulation E makes the bank repay an unauthorized transfer, one started by someone other than the consumer without her authority, including a transfer made with a code or login she was tricked into sharing. It does not make the bank repay a payment the consumer started herself, however she was deceived; that is left to the network's imposter rule and the bank's own policy. P2P Fraud Claims, Botminds' software for dispute teams that resolve P2P fraud and scam claims, applies the rule to each payment in a claim separately and cites the provision and the CFPB guidance it relied on.

This guide is for compliance officers and dispute specialists. It goes from the definitions to a case-by-case coverage table, then to the edge cases that generate exam findings: misdirected payments, network finality, instant payments and non-bank apps.

Does Reg E apply to Zelle?

Regulation E applies to Zelle payments because they are electronic fund transfers to or from consumer accounts. The CFPB's Electronic Fund Transfers FAQs address the most common Zelle design, a credit-push payment initiated in the sender's banking app, and treat it as an EFT. They go further and settle the question that matters most for fraud claims: "A credit-push P2P transfer is considered an EFT even if the payment was initiated by a third party that fraudulently obtained access to consumer’s account, such as by using login credentials stolen in a data breach or obtained through fraudulent inducement."

The consequence for a bank is that every Zelle notice of error runs on Regulation E's clock: investigate promptly, decide within 10 business days or provisionally credit and decide within 45 days, report within three business days, correct within one. The network's own operator is not the one with these duties. The customer's bank is, which is why the Senate staff recommended that Congress also bring network operators within the Act's definition of a financial institution.

What is an unauthorized electronic fund transfer?

Regulation E defines it in one sentence and then removes three cases. An unauthorized transfer is one from a consumer's account that someone other than the consumer started, without actual authority to start it, and that gave the consumer no benefit; the exact words, and what they mean for false claims, are taken apart in the friendly fraud guide. The exclusions are a transfer by someone the consumer furnished the access device to, until she tells the bank that person's authority has ended; a transfer made with fraudulent intent by the consumer or someone acting with her; and a transfer by the bank or its employee.

Each element is a question about evidence. Who started the payment is answered by the device and session records. "Without actual authority" is answered by how that device came to be trusted. "No benefit" is answered by where the money went. A bank that answers those three questions for each payment, from its own records, has done most of a Reg E investigation; one that answers a different question, such as "did she share anything?", has not.

What if the customer shared the code?

A code shared because of a lie does not turn the scammer's payments into the customer's. The CFPB's FAQs give the bank-impersonation call as their first example of a transfer that is still unauthorized: "a third-party calling the consumer and pretending to be a representative from the consumer’s financial institution and then tricking the consumer into providing their account login information, texted account confirmation code, debit card number, or other information that could be used to initiate an EFT out of the consumer’s account". The FAQs also close the obvious loophole: such a consumer has not "furnished" an access device, so the first exclusion does not apply.

This is the rule most often misapplied on P2P desks, because the customer's own account of the call ("I gave him the code") sounds like consent. The evidence that decides it is usually in a passcode log: when a code was sent, what it was for, where it was entered and which device it added.

The evidence for an unauthorized placement: a code sent to add a device, entered elsewhere

Is a misdirected Zelle payment an error under Reg E?

It can be. Regulation E's list of errors includes an incorrect electronic fund transfer to or from the consumer's account, and the CFPB's examiners have applied it to P2P directories that held outdated details: when a consumer entered the recipient's correct phone number or email but the money went to someone else, the transfer was a token error. "Examiners found that institutions violated Regulation E by failing to determine that token errors constituted “incorrect” EFTs under Regulation E."

A payment the consumer sent to a wrong number she typed herself is a different case, and the published findings do not treat it as a token error. The investigation has to establish which happened, from the network's records for that token on that date. Treating every "wrong person" claim as the customer's mistake is the shortcut the examiners cited.

Do network rules change Reg E?

Network rules can add protection but cannot take it away. The CFPB's FAQs answer this for P2P finality directly: "Although private network rules and other commercial agreements may provide for interbank finality and irrevocability, they do not reduce consumer protections against liability for unauthorized EFTs afforded by the Electronic Fund Transfer Act." The Act's anti-waiver clause does the same work for account agreements: a clause that ends a consumer's protection once she shares credentials is unenforceable.

The network's imposter rule sits on the other side of that line. It requires member banks to reimburse certain authorized payments, those induced by impersonation of a government agency, a bank or an existing service provider, which Regulation E does not cover. It is a contract among banks, with versions, not a federal rule, and which scams qualify under it is a separate question from Regulation E coverage.

Does Reg E cover instant payments?

Yes, where the transfer is a consumer EFT. The Federal Reserve's Consumer Compliance Outlook, reviewing the two US instant payment services in late 2025, concluded that a consumer payment over FedNow or RTP that meets the definition of an EFT is covered by the EFTA and Regulation E like any other. Both services are credit-push and irrevocable between banks, as Zelle payments are in practice, and irrevocability between banks does not limit the consumer's rights against her own bank.

Are non-bank P2P apps covered by Reg E?

Yes, when the provider meets Regulation E's definition of a financial institution, and the consumer's bank keeps its own duties either way. The CFPB's FAQs say that "if a P2P payment provider directly or indirectly holds an account belonging to a consumer, they are considered a financial institution under Regulation E." A provider that issues an access device and agrees with the consumer to provide EFT services is covered too. And where a fraudster uses a non-bank app the consumer never signed up for to pull money from her bank account, the bank holding the account has full error-resolution obligations.

Does Reg E cover scams?

Regulation E covers the payments in a scam that someone else started; it does not cover the payments the consumer started herself. Courts have read the definition the same way: the Senate staff report lists federal decisions dismissing claims where consumers authorized Zelle payments to scammers. The staff recommended that Congress amend the Electronic Fund Transfer Act to require reimbursement of "fraudulently induced" authorized transactions, and that the CFPB say more about what a reasonable investigation requires. Regulation E's definition, in the text in force in October 2026, is unchanged.

For a bank, the practical rule is that a scam claim is never a single decision. It is a set of payments, some of which may be covered and some not, and each needs its own placement and its own citation. How a customer experiences that split is described in can you dispute a Zelle payment if scammed.

Covered and not covered, in one claim: each payment placed with its rule

Are the CFPB's EFT FAQs still current in 2026?

They remain posted on the CFPB's site, with answers dated June 4 and December 13, 2021, and the page was last modified in January 2025. In May 2025 the CFPB withdrew many guidance documents in a single Federal Register notice, applicable May 12, 2025; the only Regulation E item on that list was a 2012 bulletin on the remittance rule, and the Electronic Fund Transfers FAQs were not on it. The FAQs are staff guidance, not regulation, but the regulation text they interpret, 1005.2(m) and its commentary, has not changed.

A bank should still cite the regulation first and the FAQs second, and record which version of each it relied on. In the solution, each placement names its rule, for example 12 CFR 1005.2(m) with the FAQ's Unauthorized EFTs Question 5, so a claim decided today can be read against the text in force today even if guidance moves later.

P2P Fraud Claims places each payment on its side of the line with the rule that puts it there, and stops below a confidence threshold so the hard cases reach a specialist. To see the sample claims on this page screen by screen, start from P2P Fraud Claims.

Questions people ask

Are P2P payments electronic fund transfers?

Yes, when they move money to or from a consumer account electronically. The CFPB's FAQs say Regulation E applies to any P2P or mobile payment that meets the definition of an EFT, including debit card, ACH and other electronic transfers, and that a credit-push P2P payment is an EFT.

Is a Zelle payment to a scammer protected by Reg E?

Only if the scammer started it, for example from a device added with a code the consumer was tricked into sharing. A payment the consumer sent herself to a scammer is authorized and outside Regulation E, though the network's imposter rule may cover it if the scammer posed as a bank, government agency or existing service provider.

Do business accounts get Reg E protection on Zelle?

No. Regulation E protects accounts established primarily for personal, family or household purposes. Business account disputes are governed by the account agreement and network rules.

Can a bank refuse a Reg E claim because the customer was negligent?

No. Regulation E's commentary says consumer negligence cannot be used to impose greater liability than the regulation allows; the consumer's liability depends on how promptly she reported, not on how careful she was.

Does Reg E cover Zelle payments made through the standalone app?

The consumer's bank holds the account the money leaves, so it has error-resolution duties whichever app started the payment. A non-bank provider is also covered if it holds the consumer's account or issues an access device under an agreement to provide EFT services.