ACH Fraud Detection and Prevention in 2026

Last updated: October 2026

ACH fraud detection is how banks, credit unions, fintechs and payment companies find fraudulent payments on the Automated Clearing House (ACH) network, and ACH fraud prevention is how they stop those payments before the money moves. This guide covers the six forms ACH fraud takes, the latest figures, Nacha's fraud monitoring rules, where detection ends and prevention begins, and who carries the loss.

TL;DR

• ACH fraud covers six distinct problems: unauthorized debits, account takeover, business email compromise, credit-push fraud into mule accounts, first-party abuse and ACH kiting. Each is seen first by a different party and needs its own response.

• Detection finds a bad entry once it exists. Prevention acts earlier, at account opening, payee changes, first originations and holds on incoming funds.

• Both phases of Nacha's fraud monitoring rules are in force. They require risk-based processes, reviewed at least once a year, and prescribe no method or product.

• Who pays depends on who authorized the payment and whether the account belongs to a consumer or a business.

What is ACH fraud, and how is it detected?

ACH fraud is a payment over the ACH network that the account holder did not authorize, that someone induced by lying about who they are or whom they act for, or that an account holder uses to take money they are not owed. ACH fraud detection spots those entries as they are originated or received, using signals from the payment, the account and the session.

Nacha, which writes the network's rules, calls the second kind a payment made under False Pretenses and treats it separately from an unauthorized entry. ACH fraud prevention moves the control earlier, to account opening, payee changes and holds on incoming funds. Telling the types apart is the hard part of ACH fraud detection, because the types differ in who started the payment, who was deceived and which bank sees it first, and each needs a different response.

How ACH moves money, and where it is exposed

Five parties take part in every ACH payment: the Originator, the Originator's bank (the originating depository financial institution, or ODFI), the ACH operator, the receiving bank (the receiving depository financial institution, or RDFI) and the Receiver.

An ACH debit pulls money from the Receiver's account, and an ACH credit pushes money into it. On a fraudulent debit, the Receiver usually notices money missing and tells the RDFI. On a fraudulent credit, the money has already left the sender's account, and the receiving bank is the last place it can be stopped.

Standard ACH payments settle on a later business day, Same Day ACH payments on the day they are sent. The OCC notes that debit originations carry higher risk for originating banks because returns can arrive up to 60 days later under the Nacha rules, and that window is what float abuse and false claims of unauthorized debits exploit. Business-to-business ACH reached 8.1 billion payments in 2025, up 9.9% from 2024, according to Nacha, which widens the room for redirected vendor payments. Unlike a wire, an ACH credit moves in a batch and settles later, but once the funds are available they are usually just as hard to get back.

The six types of ACH fraud, and how to tell them apart

The six types of ACH fraud differ in who starts the payment and who is lied to. The loss column below gives the usual outcome only; the liability section sets out the rules behind it.

Unauthorized debits

An unauthorized debit pulls money from an account without the account holder's permission, usually with stolen account details, and the receiving bank usually hears first, from a customer who sees money missing. A fraud risk manager at a bank described such an alert from the receiving side: a new payee in another name pulling funds, a call to the customer to ask whether they authorized it, and the longer window to return an unauthorized consumer debit. On the originating side, Nacha requires WEB debits, which a consumer authorizes online, to be screened by a commercially reasonable fraud detection system that at minimum validates the account the first time an account number is used and whenever it changes; validation shows that the account is open, not who owns it.

Account takeover origination

In an account takeover, a fraudster gets into a customer's online banking and sends ACH payments from the real account, so the originating bank is the one placed to see it. The FBI reports that in 2025 its Recovery Asset Team saw more account takeover cases, which can involve 50 or more simultaneous ACH transactions to accounts at multiple banks. A VP and compliance officer at a bank named commercial online banking, where business customers originate wires and ACH, combined with bank-impersonation scams as its most pressing fraud problem, mostly because of the effort it takes to find them. Under Nacha's rules this is an unauthorized entry, not False Pretenses, because the account holder never agreed to send it.

Business email compromise and payroll or vendor redirection

In business email compromise, the account holder sends the payment themselves, to an account a fraudster supplied while posing as a vendor, an employee or an executive; a changed bank account on an invoice, or a switched direct deposit (payroll diversion fraud), is the usual opening. Since October 1, 2024, Nacha has called this a payment made under False Pretenses: one induced by someone misrepresenting their identity, their authority to act for another person, or the ownership of the account to be credited. An SVP of deposit operations at a bank said business email compromise is most of the fraud the bank cannot stop, because clients report it only after the payment has gone. Since March 20, 2026, wage and salary credits must carry the Company Entry Description PAYROLL, which helps a receiving bank spot new or multiple payroll credits to one account.

Credit-push fraud into mule accounts

Credit-push fraud is the receiving side of business email compromise and ACH scams: stolen or induced credits land in accounts opened or rented to move the money on. Nacha asks RDFIs to monitor incoming credits in a risk-based way that need not happen before posting, and since September 18, 2026, funds from non-Same Day ACH credits must be available by 9:00 a.m. in the RDFI's local time on the Settlement Date, which leaves less time to look. An SVP and deposit operations officer at a bank said most of its fraud comes through accounts opened online and how they are funded, with money mules the largest single fraud type it sees.

First-party abuse

In first-party abuse, the account holder is the fraudster: they authorize a debit, spend the value and claim it was unauthorized, or they fund a new account by ACH pull and drain it before the debit comes back. Nacha puts the ACH Network's average unauthorized debit return rate at 0.05%, a return rate rather than a fraud rate, and suggests RDFIs investigate if their own rate runs well above it. Nacha formed a short-term workgroup on first-party fraud in October 2025.

With no innocent account holder to protect, the response changes. The fraud risk manager at a bank mentioned above said the team may "shut down a customer completely, especially if they're first party fraud, right? Shut down access across the board."

ACH kiting

ACH kiting is the float abuse that check kiting made familiar, carried out with ACH entries. The OCC defines check kiting as a customer presenting checks at two or more financial institutions and using the uncollected funds while the items settle, in effect taking an unauthorized, interest-free loan. In ACH kiting, money moves by ACH between accounts at different institutions, or into an app, and is spent before the entries settle or return.

A senior director of operations at a consumer fintech described what it sees as "like check kiting, but not check kiting, instant cash kiting," with money routed through different bank accounts that end up in one. A chief operating officer at a fintech trading platform described the same timing from the funding side: bad actors fund an account by ACH pull and spend the balance the minute the clearing period ends.

ACH fraud statistics: what the latest data shows

No public source counts ACH fraud losses across the network, so these figures on ACH fraud trends are markers to read an institution's own return rates, claims and losses against, not an ACH fraud rate.

• Network size: In 2025 the ACH Network carried 35.2 billion payments worth $93 trillion, up 4.9% in volume and 7.9% in value from 2024, according to Nacha.

• How often organizations are hit: 76% of US organizations experienced attempted or actual payments fraud in 2025, according to the 2026 AFP Payments Fraud and Control Survey.

• Which payment methods are targeted: In the same AFP survey, paper checks were the payment method most often targeted in 2025 (58% of organizations), followed by ACH debits (30%) and wire transfers (25%).

• Business email compromise: The FBI's Internet Crime Complaint Center (IC3) received 24,768 business email compromise complaints with $3.05 billion in reported losses in 2025, the second-largest loss category after investment fraud. IC3 counts wire and ACH together, so this is not an ACH-only figure.

• Consumer fraud: Consumers reported losing $15.9 billion to fraud in 2025 across all payment methods, up from just over $12 billion the year before, according to the FTC. Bank payments were the method behind the highest reported losses; the FTC ranks them but gives no dollar figure for them.

• Unauthorized returns: Nacha puts the ACH Network's average unauthorized debit return rate at 0.05%, against a rule threshold of 0.5% for an individual Originator. This is a return rate, not a fraud rate.

What Nacha's fraud monitoring rules require

Both phases of Nacha's fraud monitoring rules are now in force: Phase 1 from March 20, 2026, for every ODFI regardless of size, for non-Consumer Originators, Third-Party Service Providers and Third-Party Senders that originated 6 million or more ACH entries in 2023, and for RDFIs that received 10 million or more in 2023; Phase 2 from June 19, 2026 (June 22 in practice, because June 19 is a federal holiday), which removed those thresholds for everyone else. Each party must have "risk-based processes and procedures," relevant to its role, "that are reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses," and must review them at least once a year. The rules do not require monitoring entries before they are processed and prescribe no method or product; the 2026 Nacha fraud monitoring rules are explained in full in our guide. What each role has to have in place under those rules is set out in our readiness guide to the 2026 Nacha fraud rules.

How ACH fraud detection works

ACH fraud detection layers several checks, because each one catches some types of fraud and misses others. The main methods are:

• Account validation and name matching: does the account exist, and does it belong to the person named?

• Velocity and amount anomalies: is this payment out of line with the customer's own history?

• Payee and destination-change checks: did the payee, or the payee's bank details, just change?

• Device and session signals at origination: who is logged in, and on what device?

• Return and incoming-credit monitoring: are an Originator's returns rising, and do incoming credits fit the account receiving them?

Whether to run these checks as rules, models or both is a separate decision. Because the same customer's risk often has to be read across card, ACH and wire, it also helps to know how to evaluate fraud scoring across card, ACH and wire. How each of these methods works, what it catches and what it misses is covered method by method in our guide to ACH fraud detection methods.

ACH fraud detection vs prevention

ACH fraud detection finds a bad entry once it exists; ACH fraud prevention acts before the entry exists or before its funds can move. The VP and compliance officer at a bank mentioned above put the aim as acting "left of boom": "get it before the transaction occurs, the boom is a transaction."

A VP of fraud operations and governance at a credit union described the prevention approach: "my strategy has been to get as far upstream in the member customers lifecycle as possible and stop the fraud there."

Late detection still helps an investigation, but it cannot stop the payment. A leader of BSA/AML and fraud prevention at a credit union said root-cause reviews often found that the institution's anti-money laundering monitoring had flagged the activity only after the team had already found it some other way: "So, yes, it's flagging but it's flagging too late, right?"

Nacha's rules do not require monitoring before processing, though Nacha says monitoring before processing "provides the greatest opportunity for detecting and preventing potential fraud," so acting early is each institution's choice. The fraud risk manager at a bank described earlier said its ACH alerts fire before settlement, which leaves the team time to intervene. Business customers can add ACH fraud protection of their own through their bank, such as ACH debit blocks and ACH positive pay, which stop unexpected debits to their accounts.

How to prevent ACH fraud without blocking good payments

Blunt controls stop fraud by stopping good payments too. A fraud risk strategy lead at a large bank described a cap on ACH funding for new accounts that contains the risk but turns away larger legitimate deposits, and said the bank wants better controls so it can lift the cap.

The better route is precision: match the response to the type of fraud, so good payments go through and only the risky ones meet friction. In practice that means a step-up check when a payee's bank details change, a hold on an incoming credit that does not fit the account, and a call to the customer before a first large debit, rather than one limit for everyone, with each rule change tested on past payments before release. An SVP of operations at a savings bank said the technology is the easy part; the hard part is getting deposit operations, who see transactions first, and the BSA team, who review them afterwards, to work as one team.

Mistakes that block good payments or let fraud through

• Treating ACH fraud as one problem: a single rule set misses the types it was not built for and blocks good payments that resemble them.

• Relying on returns to find fraud: a return arrives after settlement, when the money may already be gone.

• Skipping checks on small payee changes: business email compromise often starts with a routine request to change bank details.

Who is liable for ACH fraud?

Liability for ACH fraud depends on who authorized the payment and whether the account belongs to a consumer or a business. Generally, an unauthorized debit goes back to the Originator and its bank, while a payment the account holder authorized under false pretenses usually stays with the account holder unless the funds can be recovered.

The originating bank's warranty. Under the Nacha Operating Rules, the ODFI warrants that every entry it sends is authorized. A receiving bank can bring a warranty claim for an unauthorized debit within one year of settlement for a business account, or within two years for a consumer account.

Consumer accounts. ACH debits and credits to a consumer account are electronic fund transfers under Regulation E. A consumer who reports an unauthorized ACH debit within 60 days after the bank sends the statement showing it generally owes nothing; the $50 and $500 limits in Regulation E apply only when a lost or stolen access device, such as a debit card, is involved. The receiving bank can return such a debit in an extended window, so that it reaches the originating bank by the opening of business on the banking day after the 60th calendar day following settlement, with the consumer's Written Statement of Unauthorized Debit.

Business accounts. When a business says an ACH debit was unauthorized (return code R29), the return must reach the originating bank by the opening of business on the second banking day after settlement, which is one reason business losses often stay with the business. For business credit transfers, UCC Article 4A applies where no part of the transfer is governed by the Electronic Fund Transfer Act. If the bank and the business agreed on a commercially reasonable security procedure and the bank followed it in good faith, a payment order can be treated as the business's own even if the business did not send it.

False Pretenses. A receiving bank may return an entry it believes was originated under False Pretenses with return code R17 and the descriptor QUESTIONABLE, within the standard two banking days. Using R17 is optional, and it has no extended return window.

At some institutions, each ACH fraud claim is still worked out by hand. A DDA support manager who handles ACH disputes at a bank described the questions every claim raises: "what are they liable for? What are they not liable for?" The same manager said each claim has to follow both the Nacha rules and Regulation E.

What each return code means, and which codes count toward Nacha's return-rate thresholds, is covered in our guide to ACH return codes. The account agreement and state law also shape the outcome, so take legal advice on any specific loss.

Choosing a tool for ACH fraud detection

ACH puts a few demands of its own on any tool: it has to see both origination and receipt, act on an entry before funds are released, and let the fraud team change and test its own rules. If you are choosing a platform to run these checks, our guide to the best ACH fraud detection software sets out the criteria to compare.

Where Oscilar fits

Oscilar sells software in this category, so read this section with that in mind. Oscilar is a unified platform: real-time data fabric, device and behavior intelligence, rules, and case management in one stack. The platform is specified for decisions in under 100 milliseconds. Nacha named Oscilar a Preferred Partner for Account Validation, Fraud Monitoring, and Risk and Fraud Prevention.

Two customers have published results. SoFi reduced their time-to-market for new risk policies by 50% using Oscilar's no-code risk policy interface. Fluz implemented Oscilar's platform and achieved a 20% increase in ACH approval rates.

For how Oscilar applies this to ACH and other payments, see Oscilar's transaction fraud protection.

Frequently asked questions about ACH fraud

What is ACH kiting?

ACH kiting is float abuse carried out with ACH entries: money moves by ACH between accounts at different institutions, or into an app, and is spent before the entries settle or return. It works like check kiting, which the OCC defines as presenting checks at two or more financial institutions and using the uncollected funds while the items settle.

Who is liable for ACH fraud: the bank or the customer?

It depends on who authorized the payment and on the type of account. Under Regulation E, a consumer who reports an unauthorized ACH debit within 60 days of the statement generally owes nothing, while a business has only two banking days to return one. A payment the account holder authorized because of a scam usually stays with the account holder unless the funds can be recovered.

What does Nacha mean by False Pretenses?

Since October 1, 2024, Nacha has defined False Pretenses as the inducement of a payment by someone misrepresenting their identity, their association with or authority to act for another person, or the ownership of the account to be credited. It covers business email compromise and payee impersonation, but not disputes over fake or poor-quality goods, and not account takeover, which is an unauthorized entry.

How does Same Day ACH change fraud risk?

Same Day ACH settles payments on the day they are sent, which leaves less time to spot a bad payment before the funds move. Nacha reports 1.4 billion Same Day ACH payments worth $3.9 trillion in 2025, up 16.7% in volume from 2024, and the limit per payment rises from $1 million to $10 million on September 17, 2027.

Which data signals and workflows are needed for ACH fraud detection?

ACH fraud detection needs signals on the payment, the account, the payee and the session, plus each customer's return and claim history, scored together because each is weak on its own. Those scores feed holds on suspicious entries and incoming funds, step-up checks on payee changes and first originations, and case review.

How can teams reduce ACH false positives without increasing fraud loss?

Teams reduce ACH false positives by scoring each payment against the customer's own history and matching the response to the type of fraud, instead of applying one threshold or limit to everyone. Testing each rule change on past payments before release shows whether it cuts alerts without letting more fraud through.

How can AI help detect ACH payment fraud for Nacha compliance?

Nacha's rules require risk-based processes and procedures, not AI or any other specific method. Machine learning models can rank entries by risk alongside rules, so review time goes where it matters. Whatever the method, a record of what the monitoring did supports the review each party must carry out at least once a year.