Unclear legal agreements:

Peer-to-peer payment app providers deserve credit for designing simple and easy-to-use applications that belie their underlying technological and financial sophistication. But that simplicity smooths over more than just technical wizardry. It also hides a thicket of overlapping and uncoordinated legal agreements, financial regulations, and consumer protections. It’s almost impossible for consumers—even the rare ones who read user agreements—to understand their rights and obligations in the event of error or financial fraud.

Misdirected payments:

The CR study found it can be alarmingly easy to make the mistake of a misdirected payment, and that consumers may not know they can't necessarily reverse such payments. Nor do they know that in most cases, providers won't help if the recipient refuses to return the misdirected funds.

Fraud:

Another issue is outright fraud. Thieves are increasingly exploiting consumer enthusiasm for—and trust in—P2P services. If you or a family member is tricked into sending money to a scammer via P2P, the law doesn’t require P2P services to return or help recover the funds.

Privacy:

Payment apps typically have access to very detailed and illuminating information about our purchase habits, data that could be profitably used or sold. However, consumers have very little information about what app vendors are doing with this data, or which ones have the best practices.

[Excerpts gathered from CR Article: Peer-to-Peer Payments Are Generally Safe, But Consumers Must Be Aware of Risks]

Consumer Reports ratings article and in-depth review:

Why Apple Pay Is the Highest-Rated Mobile P2P Payment Service. This article highlighted key problems and fixes to better protect themselves, urging immediate action on the part of policymakers and P2P service providers. The article also shared how app services responded to the investigation: 

Zelle adopts practice to confirm recipients before transferring money:

Zelle, a service used by about 150 U.S. banks and credit unions, was rated good overall. But it was the only service that ranked below average on data security and data privacy, which were weighted heavily in our ratings. The Zelle app lacks features that keep you from accidentally sending money to the wrong person. That could happen if you mistype a phone number. 

Contacted by CR for this report, Zelle said it would soon adopt the practice of asking senders to confirm recipients before transferring the money, the current practice of some banks and credit unions that offer the Zelle service.

Zelle app makes changes for misdirected payments:

In mid-September, the Zelle mobile peer-to-peer service was updated by its operator, Early Warning Services, to add measures to help prevent users from inadvertently sending money to the wrong person.

Consumer Reports tested the Zelle stand-alone app and found that it now includes a pop-up warning for users that send money to someone not in their contacts. When CR first tested the stand-alone Zelle app earlier this year, we found it lacked that security feature. 

An Early Warning spokesperson said the new security pop-ups also are available on Zelle apps that are sponsored by individual banks. The spokesperson said participating banks are required to display a message that says, "Money should only be sent to people you trust." It also says, "Once payments are sent, they cannot be reversed."

Consumer Reports article:

Peer-to-Peer Payments Are Generally Safe, But Consumers Must Be Aware of Risks outlining steps that users, providers and policymakers should take to alleviate privacy and security concerns: The article reported that most companies are investing significant resources in security and allow users to set up extra layers of security. But nearly all of them could do more to keep users safe.

In particular, they could design their apps to “default” to the highest security level, meaning users would have to actively chose to opt out. Instead, Venmo, Square's Cash App, and Facebook Payments in Messenger require no password, PIN, or fingerprint for repeat access to the app or to initiate a transaction when their default security settings are in place. Only one provider, Apple, requires users to confirm a payment before it is sent.

Written Testimony:

Consumer Reports’ Senior Policy Counsel, Christina Tetreault submits to U.S. House of Representatives Financial Services Committee Task force on Financial Technology. The recommendations include: 

• Congress should create a strong federal floor of consumer payments protections.
• Congress should pass strong privacy legislation, including curbs on data collection.

In addition to submitting written testimony, CR testified in person. We also presented these results to the Federal Reserve Board Mobile Payments Working Group in Boston (June 2019), at the Clearinghouse's annual meeting in Fall 2018, and in presentations to at least a half dozen more other industry and consumer organizations.

Consumer 101 video:

Consumer Reports expert, Octavio Blanco shows how consumers can protect themselves when using peer-to-peer payment apps.