How can businesses reduce ACH fraud under Nacha's 2026 rules?
Risk
November 9, 2026
|
Aeropay Team
This article was written by the payments nerds at Aeropay. Our goal is to provide you with solid insights to help your business operationalize more efficient, value-focused payments.
Most ACH fraud looks like a normal payment when it arrives. An account takeover shows up as a customer paying from their own bank, and a fake vendor invoice shows up as a payment your own team approved. Businesses reduce ACH fraud by verifying each account when it's connected, scoring every payment before it settles, and confirming any change to payment details outside the channel that requested it. Since June 2026, Nacha's fraud monitoring rules also require every business that originates ACH payments to write that process down.
This guide covers the fraud patterns those checks catch, the checks themselves, and what your written process needs to include to satisfy the new rules.
Nacha's 2026 fraud monitoring rules require every non-consumer business that originates ACH payments to run documented, risk-based processes that identify payments initiated by fraud, including payments made under false pretenses. Those processes must be reviewed at least once a year. The rules reached the largest senders on March 20, 2026 and every other originator on June 22, 2026.
The rules are part of a broader risk management package aimed at reducing successful fraud and improving recovery of funds after it happens. Nacha doesn't prescribe a tool. Its Phase 2 summary adds three details:
For the phase-by-phase breakdown, and for how these rules sit alongside Nacha's account validation and data security requirements, see Is pay by bank secure for US businesses?
A written fraud monitoring process says which payments it covers, which checks run on each, who owns those checks, and when the process was last reviewed. It's the document your bank will ask for. A short policy works for a low-volume sender as long as it covers each of the following:
ACH fraud usually enters through a stolen login, a fake account or a deceived employee. It looks routine until a return or a missing payment surfaces days later. The table maps five common patterns to the control that catches each one before money moves.
| Fraud pattern | How it starts | What it looks like at the time | Control that catches it |
|---|---|---|---|
| Account takeover | A fraudster gets into a customer's bank login or account details | A customer paying from their own account | Risk scoring before settlement that flags new devices, unusual amounts and sudden behavior changes |
| Mule or synthetic accounts | Stolen or invented identity details are used to link an account opened to move money | A new customer with a valid account | Ownership and identity checks when the account connects |
| Vendor impersonation | A spoofed or compromised vendor email asks you to send payments to new bank details | A routine invoice your team approved | Confirming the change through a known contact |
| Payroll or payout redirection | Someone posing as an employee or user "updates" deposit details shortly before a pay run | A normal change to payment details | Out-of-band confirmation and a hold on the first payment to a new account |
| First-party disputes | A real customer denies a debit they authorized | A successful payment, later returned as unauthorized | Clear authorization records and recognizable payment descriptors |
Vendor impersonation and payroll redirection are false pretenses fraud. The payment is authorized, but only because someone was deceived. The 2026 rules bring these payments into scope for the first time, so the controls for them belong in your written process.
Fraud is cheapest to stop before funds move, so the strongest controls sit at account connection and before settlement. Each check below also gives you something concrete to record in your written process.
No provider's controls make a business compliant on their own, because the rules require your own documented process. This guide is general information, not legal or compliance advice. Confirm your obligations with your bank and compliance team.
Yes. Phase 2 removed the volume thresholds, so every non-consumer business that originates ACH payments is covered, whatever its size. A small sender's process can be lighter, but it still has to be written down and reviewed each year.
No, not under the originator requirements. If customers push payments to you as ACH credits, your bank monitors those incoming credits as the receiving institution, a duty the 2026 rules added to target money mule activity. A business that collects by ACH debit or sends ACH payouts is an originator, so check how your payments are set up.
An unauthorized payment is one the account holder never approved. A false pretenses payment is one they did approve because someone deceived them, such as paying a fake invoice from a vendor impersonator. The 2026 rules require monitoring for both.
Businesses reduce ACH fraud by verifying accounts at connection, scoring payments before settlement and confirming payee changes through known contacts. Since June 22, 2026, Nacha has required every business that originates ACH payments to document that process, cover false pretenses fraud and review it at least once a year.
Want risk checks that run before every bank payment settles? See how Aeropay verifies accounts and scores fraud risk for US businesses before funds move.