Payment App Scams: Zelle, Venmo, Cash App and Marketplace Fraud

Peer-to-peer payment apps solved a real problem. Splitting a restaurant bill, paying a babysitter, sending rent to a housemate — all of it used to be awkward and now takes four seconds. That speed is the entire product, and it is also the entire vulnerability.

Zelle, Venmo, Cash App, PayPal Friends & Family, and their equivalents worldwide are built to move money instantly and irreversibly between people who trust each other. They were never designed for buying a sofa from a stranger, and they offer almost nothing when it goes wrong. Scammers understand this far better than most users do.

The Rule That Explains Everything

There is one distinction that determines whether you get your money back.

An unauthorised transaction is one you did not make — someone hacked your account and sent money. Consumer protection law in most countries requires the bank to investigate and usually reimburse.

An authorised push payment is one you made yourself, willingly, because you were deceived. You tapped send. Legally, in most jurisdictions, that is your payment — and historically the provider's position has been that they owe you nothing.

Essentially every scam in this article is engineered to make the second thing happen. The criminal's goal is never to hack you; it is to persuade you to press the button yourself.

Rules are shifting in some places — the UK introduced mandatory reimbursement for many authorised push payment scams in 2024, and there is regulatory pressure elsewhere — but you should assume, as a default, that money you send is gone.

The Scams You Will Actually Encounter

1. The fake bank fraud alert

The most damaging one. You get a text: "Did you authorise a payment of $890 to [unknown]? Reply NO." You reply NO. Seconds later your phone rings, and the caller ID says your bank. A calm, professional person confirms fraud on your account and says they will help you move your money to a "safe account" — or asks you to send yourself a payment to reverse the charge.

Every part of it is fake. The number is spoofed. The "safe account" belongs to the criminal. And because you initiated the transfer, it is authorised.

The truth: no bank will ever ask you to move money to keep it safe. That sentence does not exist in legitimate banking. If you hear it, you are being robbed.

2. The overpayment refund

A buyer sends you more than the agreed price and asks you to refund the difference. The original payment is fraudulent or from a stolen account and will later be reversed. Your refund is real and permanent. You lose both the item and the difference.

3. The "wrong account type" upgrade

A buyer sends payment and then claims the transfer failed because you need a "business account." You receive a convincing email, apparently from the payment provider, saying the buyer's money is held and you must send a fee to unlock it — which the buyer promises to reimburse. The email is fake, the held funds do not exist, and the fee is the scam.

4. Marketplace ghosting

The seller wants payment by Friends & Family, Zelle, or a bank transfer "to avoid fees," and offers a discount for it. You pay. They block you. There is no buyer protection on those payment types by design — which is precisely why they insisted on them.

5. The fake rental

A property listed well below market rate. The "landlord" is abroad and cannot show you around, but will post the keys once you send a deposit. The photographs are copied from a real listing. This scam takes larger sums than any of the others.

6. Accidental payment recycling

A stranger sends you money "by mistake" and politely asks you to send it back. The original funds came from a stolen account. When the theft is reported, that payment is clawed back — and your repayment, sent from your own money, is not.

7. Fake pet, ticket, and rare item listings

Emotionally compelling purchases with escalating fees: the puppy needs a special crate, insurance, a vet certificate. Each fee is smaller than what you have already committed, so people keep paying.

8. Payment app support impersonation

You post publicly about a problem with an app. A "support agent" replies from a lookalike handle and asks you to verify your identity, share a code, or send a test payment. Most of these apps provide no phone support at all — but a searched phone number often leads to a scammer's call centre.

Warning Signs

• Any request to move money to a "safe" or "protected" account. Always a scam, without exception.
• The seller insists on Friends & Family, Zelle, a bank transfer, gift cards, or crypto and refuses buyer-protected options.
• Pressure to complete before you can think. "Three other people want it." "The account will be frozen in ten minutes."
• Price far below market for a desirable item.
• They refuse a phone or video call, or refuse to meet in person for a local sale.
• They ask for a code that was texted to you. That is a verification code. Sharing it hands over your account. No legitimate person ever needs it.
• An overpayment followed by a refund request.
• A brand-new profile with no history, or a "verified" seller whose reviews are all posted in the same week.
• Stock photography. Reverse image search the listing photos before you send anything.
• The conversation moves off the platform — to WhatsApp, text, or email — early. This removes the platform's monitoring and any transaction record.

How to Protect Yourself

1. Use P2P apps only for people you know personally

This is the whole strategy in one line. Zelle, Venmo Friends & Family, and Cash App are for your sister, your plumber, and the person who covered your lunch. They are not for strangers, ever, regardless of how legitimate the transaction looks.

2. Pay strangers with a credit card

Credit cards carry chargeback rights and, in the UK, additional statutory protection on purchases within a certain range. If a stranger will not accept a card or a protected platform payment, that refusal is the answer to whether you should proceed.

3. Hang up and call back — always

If anyone calls claiming to be your bank, hang up. Wait a minute or use a different phone, then dial the number printed on the back of your card. Caller ID is trivial to spoof, and scammers can keep an old call open on some lines.

4. Never share a verification code

Not with a caller, not with a buyer, not with "support." A code sent to your phone exists to prove you are you. Anyone asking for it is trying to become you.

5. Meet in person for local sales

Inspect the item, complete the payment on the spot, and use a police-station safe exchange zone if your area has one. Many do, specifically for online marketplace trades.

6. Lock down the apps themselves

• Enable two-factor authentication, ideally with an authenticator app rather than SMS
• Turn on a PIN or biometric lock for the app and for each payment
• Set your Venmo transaction feed to private — the default public feed reveals your social graph and spending habits
• Do not keep a large balance in the app; move funds to your bank
• Enable notifications for every transaction so you see anything unexpected immediately

7. Triple-check the recipient

Confirm the username, phone number, or email character by character. Scammers register handles one character different from businesses and individuals. For a first payment to anyone, send a small test amount and confirm receipt before sending the rest.

8. Never refund an overpayment directly

If someone overpays, do not send the difference back. Ask them to cancel the original payment and resend the correct amount, or contact the platform. A genuine buyer will accept this; a scammer will apply pressure.

9. Verify rentals and high-value purchases independently

View the property in person or send someone you trust. Check the landlord against the land registry or title records. Never pay a deposit on a home you have not seen.

10. Slow down deliberately

Every one of these scams needs you to act faster than you think. Build in a personal rule: any payment over a set amount to someone new waits until tomorrow. Almost no legitimate transaction is damaged by a day. Almost every scam is.

If It Already Happened

1. Call your bank immediately — the fraud line on the back of your card, not a number from a text. Ask them to attempt a recall and to freeze the account if credentials were exposed. Minutes matter.
2. Report inside the app. Zelle, Venmo, Cash App, and PayPal all have fraud reporting flows. Do this in writing so there is a record and a timestamp.
3. File a formal claim, and use the right words. If your account was accessed without permission, state clearly that the transaction was unauthorised — that triggers stronger legal protections. If you were tricked into sending it, say so accurately, but ask specifically about the provider's scam reimbursement policy.
4. Escalate if refused. In the US, complain to the Consumer Financial Protection Bureau and your state Attorney General. In the UK, escalate to the Financial Ombudsman Service after the bank's final response — they overturn a meaningful share of refusals. Do not accept the first no.
5. Report to law enforcement. IC3 in the US, Action Fraud in the UK, or your national cybercrime unit. Get a crime reference number; banks often ask for it.
6. Report the listing and profile to the marketplace so it comes down before someone else pays.
7. Preserve everything — screenshots of the conversation, the profile, the listing, the payment confirmation, and the phone numbers used. Do this before the scammer deletes the account.
8. Secure your accounts if you shared any code or credential: change passwords, revoke sessions, re-enrol two-factor, and check for added recovery emails or phone numbers.
9. Ignore recovery offers. Anyone who contacts you promising to get your money back for a fee is running the follow-up scam on a list of known victims.

The Bottom Line

Peer-to-peer payment apps are the digital equivalent of handing over cash: fast, convenient, and final. Nothing about the interface communicates that, which is why so many people learn it the expensive way.

Two rules cover almost everything. Use P2P apps only with people you know in real life, and pay strangers with a credit card. Add a third for safety: no bank on earth will ever ask you to move your money to a safe account.

Everything else — the puppy, the concert tickets, the flat with no viewing, the urgent fraud alert — falls apart the moment you slow down and refuse to send money you cannot get back.