ACH fraud.

ACH fraud is any scheme that uses an ACH payment to take funds the fraudster isn't entitled to. Every ACH payment passes through two banks. The ODFI (originating depository financial institution) sends it for its customer, the Originator; the RDFI (receiving depository financial institution) posts it to the receiver's account.

Who is liable for ACH fraud?

It depends on whether the payment was authorized. The ODFI warrants that every entry it sends is authorized, so an unauthorized debit's loss generally runs back to the ODFI and its Originator,⁠[3] and consumers also have Regulation E.⁠[4]

A credit the account holder sent because it was deceived was authorized under False Pretenses, so that loss generally stays with the sender.⁠[5]⁠[6] If stolen credentials sent a business's credit, UCC Article 4A generally asks whether the bank followed an agreed, commercially reasonable security procedure in good faith.⁠[6] Nacha's 2026 rules don't change any of this.⁠[2]

Reports of ACH fraud have risen every year for a decade.

• 34% of banks and credit unions saw ACH fraud attempts in the prior 12 months, and 10% had losses, in a 2026 Federal Reserve Financial Services survey of 403 institutions.⁠[7]
• $3.05 billion in business email compromise losses were reported to the FBI in 2025, from 24,768 complaints. The FBI counts wire and ACH together as one way victims paid.⁠[8]

A SAR counts a report, not a loss.

Most fraudulent ACH credits follow the same four steps.

1. 1Get access or a pretext. Steal online banking credentials, or pose as someone the payer trusts: a vendor, an executive, an employee or the bank.
2. 2Change where the money goes. Send new bank details for an invoice or a direct deposit, or add a payee inside the compromised online banking.
3. 3Let the bank send it. The payment goes out as a correctly formatted entry, often to a new, dormant or mule account at another bank.
4. 4Move it on. The money leaves the receiving account by wire, P2P or cash, often before the sender knows.

Account takeover can move fast: the FBI's Recovery Asset Team says one takeover can involve 50 or more ACH transactions to different accounts at several banks at once.⁠[8] With a fraudulent debit, the money comes back fastest if someone catches it inside a return window.

Which schemes are growing? In the Federal Reserve's 2026 survey, account-holder scams led — 41% of institutions said they were increasing — followed by business email compromise (19%), unauthorized debits (13%) and account takeover (12%).⁠[7]

Red flags

• A corporate (CCD) credit to a consumer account, or another SEC code that doesn't fit the account
• A high-dollar credit out of character for the receiving account
• Several payroll or benefit credits to one account in a short time
• Any of these landing in a new, dormant or suspected mule account
• A vendor's or employee's bank details changed shortly before a payment
• A login from a new device or location just before a payee change or ACH batch
• A payee name that doesn't match the receiving account holder
• Money moved out by wire, P2P or cash soon after a credit posts

The first four are Nacha's own examples of credit signals an RDFI can watch for.⁠[2]

Nacha's 2026 rules require every ODFI and RDFI, and every business Originator and its processors, to have risk-based processes reasonably intended to identify entries suspected of being unauthorized or authorized under False Pretenses, and to review them at least once a year.⁠[2]

Phase 1, on March 20, 2026, covered every ODFI, plus Originators and processors with 6 million or more entries in 2023 and RDFIs that received 10 million or more.⁠[10] Phase 2 covered everyone else from June 19, 2026.⁠[2]

Does Nacha require banks to screen every ACH entry?

No. The rules don't require screening every entry or monitoring before processing, and they don't prescribe tools. But a risk-based approach can't conclude that no monitoring is needed: a risk assessment that separates higher-risk transactions from lower-risk ones is the minimum. For debits, a robust return and return-rate monitoring program, plus the existing fraud rules for WEB debits and Micro-Entries, is enough as a minimum.⁠[2]

What does “False Pretenses” mean?

Nacha defines it as inducing a payment by misrepresenting your identity, your association with or authority to act for someone else, or who owns the account to be credited. It covers business email compromise and vendor, payroll and other payee impersonation, but not scams over fake, non-existent or poor-quality goods or services.⁠[5]

ODFI vs RDFI: who does what?

What changed on September 18, 2026?

An RDFI must now make a non-same-day credit available by 9 a.m. local time on the settlement date, even one that arrived after 5 p.m. the day before.⁠[13] An RDFI that suspects fraud may still delay availability, as long as it tells the ODFI.⁠[5]

A business account's unauthorized debit has to be returned within two banking days of settlement. A consumer's can be returned for 60 calendar days, with a signed written statement.⁠[3] Three other clocks run alongside them.

Two-banking-day returns: R29 and R172 banking days from settlement

When a business says a debit wasn't authorized, its bank must get the return, usually coded R29, to the ODFI by the opening of business on the second banking day after settlement. An RDFI that decides a credit looks fraudulent may return it as R17, marked QUESTIONABLE, in the same window.

Nacha Operating Rules, Appendix Four, Part 4.2⁠[3]⁠[5]

The SAR deadline30 calendar days from detection

A SAR is due 30 calendar days after first detecting facts that may support one, or up to 60 if no suspect has been identified. The SAR filing guide covers thresholds, the narrative and continuing activity.

31 CFR 1020.320(a)(2), (b)(3) · 12 CFR 21.11(c), 208.62(c), 353.3(a), 748.1(d)⁠[14]

Consumer unauthorized debits: R05, R07, R10, R1160 calendar days from settlement

An RDFI may return an unauthorized consumer debit until the opening of business on the banking day after the 60th calendar day following settlement, with the consumer's signed Written Statement of Unauthorized Debit (WSUD). R10 is no authorization; R11, a debit that didn't follow its authorization; R07, a revoked authorization; R05, an unauthorized corporate (CCD or CTX) debit to a consumer account.

Nacha Operating Rules, Sections 3.12–3.13; Appendix Four, Part 4.2⁠[3]⁠[15]⁠[16]

The consumer's Regulation E notice60 days from the statement

The bank must investigate a consumer's notice of an unauthorized transfer received within 60 days after it sends the statement that first shows it. Because this clock starts at the statement and Nacha's at settlement, the bank can owe the consumer after its return window has closed, and then generally recovers by warranty claim. The debit card fraud guide has the full timelines.

12 CFR 1005.6(b)(3), 1005.11(b)(1), (c)⁠[4]⁠[3]

Warranty claims against the ODFIOne year from settlement, business accounts

After the return windows close, an RDFI can claim on the ODFI's warranty that the entry was authorized: within one year of settlement for a business account, or two years for a consumer's, with debits in the first 95 days after the first unauthorized one always covered. The ODFI can still show the entry was authorized.

Nacha Operating Rules, Section 2.4⁠[3]⁠[15]

• Watch incoming credits, not just outgoing payments. Start with Nacha's four credit signals, the first red flags above. When one needs a closer look, delay availability and tell the ODFI.⁠[2]⁠[5]
• Offer business customers ACH debit blocks, filters and positive pay. Regulation E covers only consumer accounts, and a business gets two banking days to object to an unauthorized debit.⁠[4]⁠[3]
• Verify bank-detail changes out of band. A business should confirm a vendor's or employee's new account on a phone number already on file, not one in the email.
• Report fast when money has gone. Ask the receiving bank to freeze or return the funds the same day, and have the customer report to the FBI's IC3, which can help banks and law enforcement freeze funds.⁠[8]

Why ACH fraud investigations take so long

Deciding is quick once the picture is complete. Getting the picture is the slow part: the evidence for one flagged entry sits in seven systems, and some of it sits at the other bank. In the Federal Reserve's 2026 survey, a large community bank named the common ACH problem as being unable to reach the other bank in time.⁠[7] When every entry takes that long, review gets rationed, and the credits nobody had time to look at are released at 9 a.m.

Socratix AI coworkers take on the gathering. For every flagged ACH entry, they pull the evidence from each system, compare the entry with the originator's and the receiving account's history, and hand your analysts a recommendation with the reasoning laid out. Your team still makes every call — it just stops spending the day assembling the picture.

Fraud has learned to move fast, and the rules now ask every ODFI and RDFI to keep up.⁠[2] Your team can't add analysts that fast. AI coworkers do the gathering — every flagged entry, around the clock — so the people you have spend their time on the decision. Regulators have backed trying since 2018, when they said BSA/AML pilot programs “should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful.”⁠[17]

1. GatherPulls the entry and SEC code, the originator's history and return rate, recent payee and bank-detail changes with the login and device behind them, and the receiving account's history, into one case.
2. AssessChecks the entry against your risk assessment and the patterns for each ACH fraud type, and watches the return and availability clocks.
3. RecommendRelease, delay availability, return as R17, call the customer or contact the other bank — with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnLearns from each decision — your policies, your risk appetite, your analysts' judgment — and every step is logged for the examiner.

Related guides

• Wire fraud and BEC Business email compromise, payment diversion and why a wire is so hard to get back.
• Check fraud Washed, counterfeit and forged checks, mail theft, and the deadlines that decide who takes the loss.
• Debit card fraud Card-not-present fraud, skimming and BIN attacks, and the Regulation E dispute clock.
• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.