You got a Zelle verification code you didn't request

A Zelle code is worth reading differently from the others, because Zelle usually isn't a separate account. It lives inside your bank.

That means an unrequested Zelle code is often a signal about your bank account, not about Zelle. And Zelle transfers settle almost immediately and are treated as authorized once sent, which puts this in the small category of things worth interrupting your day for.

What to do

1. Never confirm the code, especially to someone who called you

The most common Zelle fraud in circulation runs like this. You get a text asking whether you authorized a Zelle payment. You reply "no." Seconds later someone calls, says they're your bank's fraud department, and explains they need to reverse the transaction. To do that, they need you to confirm a code, or to send yourself a Zelle payment to "cancel" the first one.

Every part of that is the attack. Your bank will not ask you to send a Zelle payment, and will not ask for a verification code. Money you send this way is money you authorized, which is exactly why the script is built to make you send it.

2. Call your bank on the number printed on your card

Not the number in the text. Not the number the caller gives you. The number on the back of your debit or credit card, or the one on your statement.

Tell them you received a Zelle verification code you didn't request and ask them to review recent activity and any pending transfers.

3. Change your online banking password and check for changes

Change the password from the bank's app or by typing the address yourself. Then check whether the contact email or phone number on the account was altered, and whether any new payees or Zelle recipients were added.

4. Look at pending transfers, not just completed ones

Pending is where a transfer can still be stopped. Check both, and check any linked accounts at the same bank.

5. Strengthen the second factor and remove old sessions

Move from SMS to an authenticator app if your bank supports one, and sign out of sessions or devices you don't recognize.

6. Ask your bank to note the attempt

A documented report matters if anything follows. Ask them to flag the account, and file a report with the FTC as well.

How this starts

The people running this need two things: a phone number that reaches you, and enough detail to sound like your bank.

The first is easy. Data brokers and people-search sites publish current phone numbers next to full names, home addresses, and past addresses, compiled from public records and commercial data and sold to anyone who pays. The second often comes from the same place, or from a breach that revealed which bank you use.

That's why these calls land. When someone opens by confirming your address and the last four digits of a card, you're already half-persuaded before they ask for anything, and the ask sounds like procedure rather than theft.

Delist finds those listings, files the removals, and keeps checking them, since brokers routinely repost profiles. Fewer places publishing your phone number means fewer easy ways to reach you with a script like this. Run a free scan to see where your number appears.

The wider pattern is covered in why you're suddenly getting 2FA codes you didn't request, and the call itself is covered in scam calls that already know your bank details.

Frequently asked questions

Is Zelle itself compromised?

Not usually. Zelle runs inside your bank's app, so an unrequested Zelle code generally points at your bank account rather than at Zelle as a service. Treat it as a banking issue.

Can I get a Zelle payment back?

Rarely, if you authorized it. Zelle transfers are near-instant and are treated as authorized when you send them, which is why scams focus on persuading you to send rather than on breaking in. Report it to your bank immediately anyway, and file with the FTC.

The text asked me to reply YES or NO. Should I reply?

Don't reply, and don't tap links. Contact your bank on the number on your card. Replying confirms the number is live and often triggers the follow-up call.

Someone said they were from my bank and knew my address. Was it them?

Knowing your address proves nothing. That information is sold openly by data brokers. Hang up and call the number on your card.

Should I stop using Zelle?

You don't have to. Enrolling with a phone number you don't publish widely, keeping alerts on, and treating any inbound call about a transfer as suspect covers most of the realistic risk.