Nacha's new WEB Debit rule aims to fight fraudulent activities

Dive Brief:

Nacha, the governing body of ACH networks, has implemented the new WEB debit rule to fight rising digital payments fraudulent activities. The rule, which aims to validate accounts before processing a transaction online, came into effect on March 19th.
The rule will affect organizations that allow consumers to make payments via the internet or mobile devices and directly debit payments from consumers' checking accounts.
The new rule will require businesses to validate a consumer's bank account information when initiating an ACH debit transaction as WEB Debit Entries have always been susceptible to fraud, Ryan Stinneford, Partner at Hudson Cook LLP told Payments Dive.

Dive Insight:

The new rule comes into effect as digital payments and identity fraud surged during the pandemic. It aims to safeguard against the misuse of account information and account information errors, according to Nacha.

"While fraud on the ACH Network is rare, we did observe several specific fraud scenarios that occurred, in which better screening of payment information could have helped," Nacha told Payments Dive in an email.

Although approved in 2018 by the Nacha board of directors and enacted last week, "Nacha will not enforce this rule for an additional period of one year from the effective date with respect to covered entities that are working in good faith toward compliance."

ACH payments made over the internet or phone are given the standard entry class (SEC) code "WEB" and are known under the Nacha Operating Rules as "WEB Debit Entries."

"The rule change explicitly identifies account validation as a required part of an Originator's "commercially reasonable fraudulent transaction detection system" Stinneford said. "This means that any time a consumer authorizes a payee to initiate an ACH debit, the ‘payee' must validate the consumer's deposit account."

With the new rule, originators now have to take an extra step rather than just validating a payer's account number, Brandon Rembe, Chief Product Officer at Envestnet, said.

"A step beyond that [account number validation], which is looking at the previous 90 days of transactions or X number of days of transactions to look at fraudulent behavior," Rembe said. "Or to look at high and low cash balances, especially if it's going to be recurring payments."

The new rule will go a level deeper to pull in more personalized information about the customer to understand what is a customer's ability to pay, Rembe said.

"Originators can select the method for validation that is best for them," Nacha said. "The rule is neutral with respect to specific methods or technologies."

Originators can use ACH pre-notification entry, ACH micro-transaction verification, or any commercially available services.

While many financial institutions already have an account validation procedure, companies that are doing origination services for businesses, may not have a process in place, Janice Weisz, Financial Institution Advisor at Saltmarsh, Cleaveland & Gund, said.

Originators or businesses might have to bear some of the costs to validate and verify the ACH debit transactions.

"Whether or not it's going to increase the cost depends on the route that they go," Weisz said. "If they're going to originate a pre-notification, the cost is very low."

Costs will vary by the financial institution and could be offset by a reduction in payments that are returned, and subsequent and accounting and collection efforts, Nacha said.

Digital payments fraud has picked up pace during the pandemic according to research from Javelin Strategy. In 2019, 48% of all payment frauds in the US were attributed to online purchases.

There has been an increase of almost 35% in fraud attempts [in 2020], which indicates that criminals are more active in breaking through digital channels, the report stated.

Automated Clearing House (ACH) payments smashed records in 2020, increasing by 8.2% to 28.6 billion transactions, according to Nacha.

"While fraud on the ACH Network is rare," Nacha said, "keeping the ACH Network and consumers safe and secure is always a priority."