For more than a decade, the popularity of ACH transactions has been snowballing. In 2023, the ACH Network handled 31.5 billion payments—valued at $80.1 trillion, of those, Early Warning® helped manage the risk of 2.1B payments. That marks the 11th consecutive year of more than $1 trillion in year-over-year growth.1
As usual, financial criminals are paying close attention to banking trends—and they continue to devise new fraud schemes and scams that target ACH transactions.
In response to rising ACH fraud threats, Nacha—the entity that governs the ACH Network—is proposing a series of updates to its rules and regulations. Here we’ll explain the latest information available about the coming changes and their implications for financial institutions (FIs).
New ACH fraud threats demand new Nacha rules and regulations.
Traditionally, Nacha's risk management strategies have focused on preventing unauthorized ACH debits — transactions in which the originator fraudulently withdraws (or “pulls”) funds from the recipient's account into their own.
Increasingly, however, fraudsters are turning their attention to ACH credit payments—electronic transactions in which the originator requests to send (or “push”) funds from their own account to the recipient's. In these types of schemes, known as “credit-push fraud,” the originating account holder is often tricked into authorizing the transaction.
In response to the unique challenges presented by credit-push fraud, Nacha developed a new Risk Management Framework with the following key objectives:
- Increase awareness of fraud schemes that use credit-push payments
- Reduce the incidence of successful fraud attempts
- Improve the recovery of funds after frauds have occurred
In alignment with its new approach to risk management, many of the coming changes to Nacha’s rules and regulations aim to improve the security of credit-push payments.
The role of RDFIs is expanding.
Nacha's upcoming rules changes focus on enhancing fraud detection, monitoring and recovery processes within the ACH network. Because credit-push fraud is a growing threat—and because this type of fraud often involves authorized transactions—it is critical that RDFIs scrutinize incoming credit transactions for signs of potential fraud. As such, RDFIs play a bigger role in the updated Nacha Operating Rules.
The updates to the Nacha risk framework include multiple changes to its rules and regulations, phased across 3 important dates.
Summary of key changes:
- Expand Use of Return Reason Code R17: The proposed change allows RDFIs to use Return Reason Code R17 for returning ACH entries that are questionable or suspected to be fraudulent. By providing clarity on the use of R17, this update aims to improve fund recovery and prevent future fraudulent transactions.
- Expanded Use of Request for Return: This amendment allows ODFIs to request returns from RDFIs for a broader range of reasons. It aims to enable quicker fund recovery and reduce the impact of unauthorized transactions on account holders.
- Additional Exemption from Funds Availability Requirement: RDFIs will be provided with an exemption for credit entries suspected to be part of a fraud scheme or event—thereby enhancing their ability to manage suspicious transactions and mitigate fraud risks.
- Timing of Written Statement of Unauthorized Debit (WSUD): The proposed change allows RDFIs to obtain WSUDs from account holders before unauthorized debits post to accounts—to enable quicker management of transaction data and reduce the impact of unauthorized transactions on account holders.
- RDFI Must Promptly Return Unauthorized Debit: RDFIs will be required to promptly return unauthorized debits upon receiving a consumer's completed WSUD, enhancing fund recovery and reducing future fraud risks.
- Fraud Monitoring by Originators, TPSPs and ODFIs: Non-Consumer Originators, Originating Depository Financial Institutions (ODFIs), Third-Party Service Providers and Third-Party Senders are required to establish risk-based processes and procedures for fraud detection in ACH entries. By enhancing fraud detection capabilities, the update aims to reduce successful fraud attempts within the ACH network.
- RDFI Monitoring of Received ACH Credits: Requires RDFIs to establish risk-based monitoring processes and procedures for incoming credit transactions, with the goal of reducing successful fraud and facilitating fund recovery. The amendment provides RDFIs with flexibility in designing their monitoring procedures to identify and prevent fraudulent transactions effectively.
- Standard Company Entry Descriptions: Standardized Company Entry Descriptions must be used for “PAYROLL” and “PURCHASE” transactions aim to improve transaction monitoring, risk management and fraud detection within the ACH network.
Early Warning helps FIs comply with Nacha rules and regulations.
Nacha regularly updates its rules and regulations to proactively address emerging fraud threats in the ACH network. As an official preferred Nacha compliance partner, Early Warning offers risk mitigation solutions that help FIs comply with evolving Nacha rules. Verify Payment identifies high-risk payments with a single account inquiry in real-time and Verify Account confirms whether your customer’s personal information is a match with the authorized account owner and authorized signer. Both solutions can help FIs fight ACH fraud in compliance with Nacha rules.
Stay tuned for compliance dates and details: The first round of rules updates take effect as early as October 2024, with others phasing in through March 2026. Early Warning does not provide legal advice on how to comply with Nacha rules and regulations. Financial institutions and companies are solely responsible for interpreting Nacha rules.
Source and disclaimers
1. ACH Network Volume and Value Statistics | Nacha https://www.nacha.org/content/ach-network-volume-and-value-statistics