Since 20 March 2026, Nacha's fraud monitoring rules have required every originating bank (ODFI), and the larger originators and receiving banks (RDFIs), to look for unauthorized and falsely induced ACH payments. Phase 2 extended them to everyone else on 19 June 2026. Before 20 March 2026, Nacha made originators screen only WEB debits and Micro Entries.
ACH fraud at a glance: which types hit which accounts?
ACH fraud is one of the fraud types that run through a payment network.
Table 1. ACH Fraud at a glance. Types, victims and the control that fits.
| Type | Common Tactics | Victim | Control |
|---|---|---|---|
| Unauthorized Debits | A debit taken by someone with no authority to start it | Consumer or business account holder | Debit blocks or filters; statement review |
| Fraudulent Credits | A credit pushed out of the payer's account without authority or under a lie | The paying business or person | Dual approval of new payees |
| Account Takeover | A criminal controls the online banking login and sends credits | The account holder | Payment limits and dual approval |
| Business Email Compromise | A fake vendor or executive email asks for payment to a new account, a form of impersonation fraud | The paying business | Call back on a known number |
| Payroll Diversion | A spoofed employee email moves a salary to a new account | The employee, then the employer | Call back before any deposit change |
| False Unauthorized Claims | A customer calls an authorized debit unauthorized so the bank returns it, generally with code R10 (Nacha) | The originator | The bank's review of the claim |
What is ACH fraud?
Regulation E calls a transfer from a consumer's account unauthorized when someone other than the consumer starts it "without actual authority" and the consumer "receives no benefit" (12 CFR 1005.2).
Nacha's False Pretenses covers payments the account holder did approve: "the inducement of a payment by a Person misrepresenting (a) that Person's identity, (b) that Person's association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited." Nacha says the term reaches business email compromise and payroll impersonation, not scams over poor quality goods.
From Ufuk Gürdaş, who reviewed this entry: "Since 20 March 2026 an employer has to label salary credits PAYROLL, which Nacha says gives the receiving bank better information about new or multiple payroll payments to an account, so a paycheck landing in an account opened last week is now a signal the bank can see."
What is ACH, and why do fraudsters target it?
The ACH Network is the US system for Direct Deposits and Direct Payments, governed by Nacha. In 2025 it carried 35.2 billion payments worth $93 trillion (Nacha, 5 March 2026). Nacha names pay, bills and vendor payments among its uses, so a fake payroll or vendor credit blends into the file.
Which rules apply to ACH fraud, and who sets them?
Table 2. ACH fraud rules by rule maker.
| Rule | Who sets it | Covers | Clock or penalty |
|---|---|---|---|
| Nacha Operating Rules, fraud monitoring | Nacha, for the ACH Network | Every ODFI plus the larger RDFIs, business originators and service providers in Phase 1, all of them in Phase 2: procedures to identify unauthorized and False Pretenses entries | Phase 1 20 March 2026; Phase 2 19 June 2026; reviewed at least annually |
| Nacha Company Entry Descriptions | Nacha | Wage credits labeled PAYROLL; consumer ecommerce debits labeled PURCHASE | 20 March 2026 |
| Regulation E, 12 CFR 1005.6 and 1005.11 | Consumer Financial Protection Bureau | Consumer accounts: liability for unauthorized transfers, error resolution | 60 days from the statement to give notice; 10 business days to investigate, 45 if the account is credited provisionally |
| UCC Article 4A, 4A-202 and 4A-108 | Uniform Commercial Code, state law | Funds transfers outside the Electronic Fund Transfer Act; an order counts as the customer's "whether or not authorized" if the bank accepted it in good faith under an agreed, commercially reasonable security procedure | No clock in these sections |
| Federal criminal law, 18 U.S.C. 1343 and 1344 | Congress; federal prosecutors | Wire fraud; bank fraud | Wire fraud: a fine, up to 20 years, or both; up to $1,000,000, 30 years, or both if it involves disaster or emergency benefits or affects a financial institution. Bank fraud: up to $1,000,000, 30 years, or both |
Nacha's 2026 rules expressly disclaim any change to UCC Article 4A rights and obligations, which Nacha says avoids upsetting "the allocation of liability among Nacha participants under otherwise applicable law". The AML in the United States whitepaper covers the money laundering framework around them.
What do the 2026 Nacha fraud monitoring rules require?
Every covered party needs risk based procedures "reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses", reviewed "at least annually". Nacha does not require screening every entry individually or monitoring before processing.
- Phase 1, 20 March 2026. Every ODFI; business originators, third party service providers and senders with 6 million or more entries in 2023; RDFIs receiving 10 million or more.
- Phase 2, 19 June 2026. Everyone else; in practice Monday, 22 June, after the federal holiday.
What does Regulation E give a consumer after an unauthorized ACH withdrawal?
Regulation E protects accounts "established primarily for personal, family, or household purposes" (12 CFR 1005.2), so a business account falls outside it. Picture a consumer whose 3 June statement shows a $400 debit she never approved. She should tell her bank within 60 days of that statement or risk liability for later transfers. The bank has 10 business days to investigate, or up to 45 if it credits her account provisionally within 10.
How does ACH fraud work, step by step?
Picture payroll diversion at an illustrative 40 person firm:
- Email. HR gets an email, seemingly from a staff member, asking to move her salary to a new account.
- Change. HR updates the details without a call back.
- Credit. The next payroll sends her pay, labeled PAYROLL, to an account opened six days earlier.
- Cash out. The money moves on within hours.
- Discovery. She reports a missing paycheck, and the firm asks its bank for a recall.
The hack route skips the lie. In account takeover the criminal sends the credits, and the FBI's Internet Crime Complaint Center (IC3) says such incidents "can contain upwards of 50 or more transactions" at multiple banks at once "via ACH transactions" (2025 Internet Crime Report, p. 17).
What is the impact of ACH fraud, and how common is it?
In the 2026 AFP Payments Fraud and Control Survey of 465 US treasury practitioners, 30 percent named ACH debits as targeted by fraud in 2025, and 74 percent of organizations were hit by business email compromise.
- Financial Losses. 48 percent of organizations under $1 billion in revenue and 66 percent above it reported payments fraud losses in 2025.
- Reputational Damage. An unpaid employee or vendor finds out first.
- Legal Consequences. Fraudsters can face the federal criminal statutes in Table 2.
IC3 tells victims to contact their bank at once and request a recall, then file at ic3.gov whatever the amount. In 2025 its Financial Fraud Kill Chain handled 3,900 incidents, not ACH alone, and froze $679,013,183 of the $1,163,919,846 attempted, 58 percent.
How do you detect ACH fraud before the money settles?
Nacha's Phase 1 guidance says a receiving bank's monitoring can consider velocity, an SEC code that does not fit the account type, and account age and balance, which "aligns with AML monitoring practices in place today." Each row below can become one of a bank's transaction monitoring rules.
Table 3. ACH fraud red flags from Nacha's own examples.
| Indicator | Data the bank reads | Control |
|---|---|---|
| A corporate CCD credit to a consumer account | SEC code against account type | Hold funds availability; contact the ODFI |
| A large amount atypical for the receiving account | Account history | Hold and review |
| Several payroll or benefit payments in a short period | Company Entry Description, count | Review before release |
| Any of the above into a new, dormant or money mule account | Account age and activity | Return with R17, or R06 at the ODFI's request |
| A debit claim where the entry name does not match the account | Individual Name field | Supports the customer's claim |
| A claim on a debit that caused a negative balance | Balance history | Look harder at the claim |
| Repeated unauthorized claims | Debit card disputes, returned checks and ACH claims | Customer education or a review for abuse |
Rows one to four are Nacha's examples; five to seven are factors some RDFIs use to review a customer's written statement of unauthorized debit. Transactions that match a row go to a person. Before paying a new vendor, check the vendor against fraud news.
How do banks and businesses prevent ACH fraud?
Nacha suggests originators put change controls on vendor and payroll payment instructions. ACH fraud protection and prevention, control by control:
- Debit blocks and filters. The bank returns debits from originators the holder has not approved.
- Account validation. A prenotification or Micro Entry confirms a new account before the first payment.
- Dual control and call back. Two people approve payee or payroll changes, and one confirms on a number already on file.
- Ongoing Monitoring. Regular monitoring "can establish baselines of typical activity, making atypical activity easier to identify" (Nacha); see how fraud detection works.
complead, formerly Sanction Scanner, checks the payer, the payee and any intermediary bank on each inbound or outbound transfer in its bank transaction fraud monitoring, and scores the transfer before it is carried out.
What can an account holder do to help prevent ACH fraud?
- Unusual Account Activity. Read each statement; Regulation E's 60 day clock runs from it.
- Suspicious Communications. Confirm bank detail changes on a known number.
- Malware. Bank online only on a patched device you control.
ACH fraud vs wire fraud vs check fraud: what changes for the victim?
A consumer's ACH claim runs under Regulation E, and the return under Nacha's rules. Under UCC Article 4A, a business that sends a payment relies on the security procedure agreed with its bank (4A-202). In AFP's survey, checks are still the most targeted (58 percent), against 30 percent for ACH debits and 25 for wires.
In Williams v. United States (1982), the Supreme Court described check kiting: a check far in excess of the balance at one bank, deposited at a second, then the process reversed.
What a bank checks before it sends a wire is the subject of the wire fraud entry.
Related terms
- Wire fraud. A scheme to defraud run by wire, radio or television; a federal crime (18 U.S.C. 1343).
- Account takeover fraud. A criminal takes over a real account.
- APP fraud. Authorized push payment fraud: the victim pays a payee they believe is real.
- Check fraud. Fraud with checks, from forgery to kiting.
