New Nacha rules strike at push-payment fraud

Dive Brief:

Nacha, the national clearinghouse that manages electronic money movement, has approved new rules requiring fraud monitoring of ACH payments, according to a Monday press release.
All parties involved in an ACH transfer, excluding consumers, will be required to monitor the transactions, the release said. The rules also empower the receiving bank to return a suspicious transaction without waiting for a request or customer claim.
The rules are meant to move ACH fraud monitoring from a good practice to a compliance requirement, Nacha Executive Vice President Michael Herd said in an interview Monday. “With respect to transaction monitoring for fraud, it would no longer be acceptable to do nothing,” he said.

Dive Insight:

Nacha is a nonprofit organization that governs, but does not operate the ACH Network, an account-to-account money transfer system overseen by The Federal Reserve and The Clearing House. There were 31.5 billion ACH Network payments made last year, valued at $80.1 trillion.

One type of scam Nacha is looking to prevent is a business email compromise scam, the release said. A BEC scam involves getting into a corporate email account to then conduct unauthorized transfers using payment methods such as ACH.

In the past, a victim of ACH payment fraud, along with the consumer’s bank, would need to reach out to the bank that received the funds and request a return, said Herd, who is responsible for administering the ACH network. “Time is of the essence because once payments are received into an account, the fraudsters will try to withdraw or move those funds on as quickly as they can,” Herd said.

The new rules will have a gradual roll-out from October through early 2026, according to Herd.

Banks that receive the funds will continue to not be held liable for fraudulent transactions, though they will now have a “defined role in monitoring” ACH payments and be able to delay the availability of funds to examine a suspicious transfer, the release said. The bank that sent the funds will be able to request their return “for any reason.”

Herd declined to share the prevalence or cost of ACH payment fraud, pointing to a report issued by the Federal Bureau of Investigation’s Internet Crime Complaint Center. In the report, the IC3 said that last year it received about 21,500 complaints of BEC scams costing victims nearly $3 billion.

And while the rules will apply solely to ACH transactions and not to other payment rails, including wire transfers or peer-to-peer payments services such as Zelle, “their principles and techniques are more broadly applicable to all types of credit-push payments,” the release said.

Zelle, in particular, has come under scrutiny from lawmakers including Sen. Elizabeth Warren. The senator, along with two Democratic colleagues, wrote an open letter to Zelle operator Early Warning Services last month, requesting data related to fraud and scams on the service.