What the Zelle app leaves on an iPhone

Summary

• Zelle is a bank-to-bank payment service. Zelle says most people reach it inside their bank's app. The app named Zelle is a standalone app that Zelle began to phase out for sending money in late 2024.
• Government and press records describe scams in which a person is tricked into approving a payment. They describe misuse by third parties of a legitimate service. The two lawsuits in the record are allegations, and the federal one was dismissed.
• In the app's folder on two images the Lab found no payment, recipient or message store. It found a risk-check log, a console log, analytics identifiers and event times, and preferences. Six parser artifacts read them.
• So the phone can place the app in time and show what its analytics components recorded. The payment itself is a matter for the bank and the network operator.

What the app does and who uses it

Zelle describes itself as a way to move money from your account to another person's account, typically within minutes. A sender names the recipient by a U.S. mobile number, an email address or a Zelle Tag, and both people need an eligible U.S. checking or savings account. The money goes directly into the enrolled recipient's bank account. Zelle presents the service as meant for people you know and trust, such as friends, family and coworkers, and it also has a section for small businesses. Its pages say a payment cannot be reversed once sent, and that you can cancel only if the recipient has not yet enrolled.

Zelle is run by Early Warning Services, LLC (EWS), and reaches people mostly through banks. Its pages say Zelle is built into more than 2,400 banking and credit union apps. For 2024 Zelle reported 151 million enrolled consumer and small business accounts, 3.6 billion transactions and more than $1 trillion sent. Legitimate users rely on it to pay people and businesses they know, and the scale is the reason a small share of misuse is still a large number of people.

The app in the Lab's images is the one simply named Zelle. Zelle's own notice of October 31, 2024 says it created a standalone app for people whose bank or credit union had not joined the network, that only about 2% of transactions happened there, and that over the following months it would stop letting users enroll or send money through it. Users had until March 2025 to re-enroll through a bank, and the standalone app would remain for scam education and a list of participating institutions. We take the app in the images to be that standalone app, from its name and from Zelle's statement that the network is otherwise reached through banks. We could not retrieve the store listing to confirm it, and we do not use the dates of the images.

Why this app matters to an examiner

The public record is about one pattern: a person is persuaded to approve a payment that they would not otherwise send. Zelle's own fact sheet says scams often start with calls, text messages or online marketplace ads, long before any money moves, and that once you approve a payment the money leaves your account and is often unrecoverable. The FBI's Internet Crime Complaint Center described a version in April 2022: a text asks whether you made a large instant payment, a caller whose number looks like the bank's takes over, and the victim is told to send a "reversal" to themselves. That alert names no app. The Federal Trade Commission's August 2023 consumer alert does name Zelle, with Venmo and Cash App, and describes fake emergencies, fake prizes and bank impersonation. In every one of these, the misuse is by a third party of a service that has legitimate uses.

Figure 2 lays out the public record in date order. Nothing in it is an adjudicated finding against Zelle or its operator. A Senate subcommittee held a hearing on May 21, 2024, and on July 23, 2024 held a second hearing and released a majority staff report on Zelle and the three largest banks on the network. We could not retrieve the report itself, because the Senate's site returned an access error to automated requests, so these figures are as press coverage reports them. Coverage says those three banks handled 73% of Zelle transactions in 2023, and that the report found they repaid 38% of $166 million in fraud disputes that year. The banks and the EWS chief executive disputed the findings; he testified that more than 99.9% of transactions complete without a report of fraud or a scam.

Two later events are litigation, and we report them as allegations. On December 20, 2024 the Consumer Financial Protection Bureau sued EWS and Bank of America, JPMorgan Chase and Wells Fargo. According to American Banker, the 91-page complaint alleged that consumers lost more than $870 million over seven years. The Bureau dismissed the case on March 4, 2025, and the court dismissed it with prejudice on March 5, according to the Bureau's archived page; Zelle's spokeswoman had called the suit without merit. On August 13, 2025 the New York Attorney General announced a suit against EWS, alleging that Zelle was designed without critical safety features and that scammers took more than $1 billion between 2017 and 2023. The Attorney General's press release states these as allegations and seeks restitution, damages and court orders. Zelle's fact sheet says more than 99.95% of transactions today complete without a report of a scam or fraud. These figures count reports, so they depend on people reporting.

Category data shows the size of the problem without naming Zelle. The FTC's 2024 Data Book counted 2,600,678 fraud reports, and 475,905 (18%) of them named a payment method. Payment apps or services accounted for 90,571 reports and $391 million of reported losses. Bank transfers or payments accounted for $2,089 million and cryptocurrency for $1,417 million, the two largest (Figure 3). The Data Book does not break out Zelle, so none of these numbers is a count of Zelle fraud.

For an examiner the phone matters because the approval happens on it. On a victim's phone the question is usually when the app ran, what else was happening, and whether the person acted alone. On the phone of someone who received money, the app is only one thread among accounts and messages. Either way the app's folder is not where the payment is recorded, which is why the rest of this article is about what is, and is not, in it.

Why the Lab chose it

The Lab compared the apps found in its research images with what the open-source iOS parser reads. It found 731 distinct non-stock apps. Fifty-one were parsed in full by the parser, 4 partly and 676 not at all, as of the Lab's check on November 6, 2026. The Lab ranked the unparsed apps by public-record relevance and recommended ten for contribution. Zelle ranked second. PayPal ranked first on category context alone, because the Lab found no PayPal-specific misuse source. Zelle's rank rests on an app-specific public record, the Senate subcommittee's work, together with the category data above.

That ranking is about relevance, not about how much data the app holds. The app's folder in the inventory had 10 SQLite-like files, far fewer than several other apps on the list, and the app was present in only 2 of the 9 images. Both facts limit what follows.

Method

The Lab worked on existing iPhone full file system research images, read only, and no case data leaves the Lab. For each image with the app, the app's data container was found through its metadata file, which records the bundle identifier, rather than through a folder name, because iOS names containers with random identifiers. This is the container step described in the Lab's open-source post Reading app containers from the container manager state. We then listed the files, noted formats and schema names (table, column, file and key names), and recorded aggregate counts. No values were copied out.

A parser reads six artifacts from the container. It matches the container by bundle identifier, and a missing table, key or file gives fewer rows, not an error. To test it, we built synthetic fixtures: three cases, six artifacts each, 18 archives. The parser's 14 unit tests and its 18 case baselines pass, and its own checks for claim language, paths and output pass. Where the parser reads a file and returns nothing, the Lab's earlier study found that an empty result and a missing feature look the same, so the notes below say which files were read, not read or not decoded (LAB-TR-0006).

What is on the device and what is not

Only the data container exists for the app; there is no app group container. It held 169 files on one image and 410 on the other. There was no transaction, recipient or message store. What it did hold is in Table 1, and Figure 5 counts the rows the parser read.

Several files were not read: encoded SDK stores (ASCII lines of a number and a base64 string, 71 to 145 files), a configuration file of high-entropy bytes (2chkConfig), a storage folder with one row, the store receipt, Crashlytics bookkeeping and launch snapshots. Their entropy suggests encryption, but the Lab did not establish that. The Mixpanel event queue and the WebKit statistics are already read by other parser plugins.

Figure 4 asks the question an examiner usually starts with: where would I find this? Pick a kind of evidence and read the panel. A verdict of "server-side" is an inference from Zelle's public pages, not something the Lab observed. "Unknown" means the Lab found nothing and has no public page that says where it would be.

One practical point comes from Apple's file system guide. It says the Documents and Preferences folders are included in device backups and the Caches folder is not, and that the system may clear Caches. The Lab did not test backups, but an examiner working from a backup rather than a full file system should expect that the console log in Library/Caches may be missing from it.

What an examiner can and cannot conclude

The Lab's analysis is an indicator, not proof. These are statements the evidence supports, and statements it does not.

What this does not prove

Sources

Every number and claim, and where it comes from. Web pages were read on November 6, 2026. The Senate subcommittee's report and press release returned an access error (HTTP 403) to automated retrieval, so the report is cited through press coverage. LAB-TR-0006, Empty Is Not Absent, is on Zenodo (doi:10.5281/zenodo.23717928). Numbers that could not be sourced, or on which sources differed, were left out.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related

The parser and its synthetic fixtures for this app are in preparation for the open-source project and the Lab artifact repository. No open-source page for them exists yet.