How do payment providers decide which bank payments to stop?

Payment providers decide which bank payments to stop by scoring each one for fraud and return risk before it's submitted, then approving it, capping it, holding it, asking for more verification or declining it. A fraudulent ACH debit looks normal on the day it's sent and comes back as an unauthorized return up to 60 days after settlement under Nacha's rules, so this decision is the last point where stopping it costs nothing.

A pay by bank provider stops a risky payment before it settles by pairing a risk score with the merchant's thresholds. The score draws on the bank account, the available balance, the device and the customer's history. The thresholds decide whether a payment at that score is approved, capped, held, sent to step-up verification or declined.

What signals go into a bank payment's risk score?

A bank payment's risk score combines signals about the account, the money in it, the device and session, and the customer's past behavior. Each group catches fraud the others miss, which is why providers score them together.

• Account. How the account was connected, how recently, and whether the account holder's name matches the customer. A bank login confirms ownership at connection, while typed-in account and routing numbers are the easiest details for a fraudster to steal.
• Balance. The available balance compared with the payment amount. Checking it before submission separates a customer who can pay from an account opened to bounce payments.
• Device and session. How many bank accounts have been linked from the same device, and whether the login fits the customer's usual pattern. Several accounts linked from one phone is a common sign of mule or synthetic accounts.
• History. The customer's previous payments with the merchant and across the provider's network, plus amount and frequency. A $2,000 first payment from an account connected ten minutes ago scores higher than the same amount from a customer with a year of clean payments.

We built Aeropay Guard to score every pay by bank transaction in real time on signals like these, with models trained on billions of interactions across Aeropay's network. Guard also learns what normal behavior looks like for each merchant's users and flags payments that drift from it. The security side of the same question, including how a bank login protects credentials, is covered in Is pay by bank secure for US businesses?

What can a provider do besides approve or decline?

A provider has five outcomes for a scored payment, and the three in the middle let it stop a risky payment without turning away a good customer. The table shows when each one applies and who carries the loss if the payment still comes back.

When Aeropay Guard declines a payment, the merchant receives a specific reason code (balance-related, risk-score-related or uncategorized) instead of a generic decline. The code tells a support team whether to ask the customer to add funds or to review the account.

A failed payment gets one more path. Smart retries try an insufficient-funds payment again once real-time balance data shows the money is there, which separates a timing problem, like a payment due the day before payday, from a real decline. Guard runs these retries automatically.

Which fraud controls can a merchant set?

The provider supplies the score, and the merchant decides where each cutoff sits. That covers how much a new customer can pay, which payments get held, when to require step-up verification, and which proven customers move to a faster path.

Set each cutoff by what a bad payment costs you. A platform that credits deposits instantly, such as a gaming or trading app, loses the money once a fraudulent deposit is withdrawn, so it needs tight limits on first deposits. A subscription business that ships monthly has a billing cycle to catch problems and can approve more first payments.

Nacha sets the outer limit. Under its Risk and Quality Rules, an originator's unauthorized return rate has to stay under 0.5% of its debits, and when an originator goes over, Nacha requires its bank to submit a plan to bring the rate back under 0.5% within 30 days. Our guide to Nacha's 2026 fraud monitoring rules covers the written process those rules now require.

With Aeropay Guard, merchants tune approval thresholds with our risk team to match their risk tolerance. Guard pairs AI models with human fraud analysts, and merchants can reach our fraud team directly when they see a new threat.

How do you stop fraud without declining good customers?

Put the strictest checks on new accounts and large first payments, and move customers with a clean history onto a faster path. A decline on a real customer costs the sale and often the customer, so controls should get lighter as a customer builds a record of good payments.

Returning customers start ahead. Anyone who has already paid an Aeropay merchant is recognized and pays without linking a bank again. Our guide to raising approval rates for returning customers covers the rest of that approach.

Our Trusted User Program moves proven customers onto a lower-cost payment path, and every trusted payment still gets a real-time balance check and transaction limits. Trusted User payments sit outside Aeropay Guaranteed ACH, which covers eligible bank-initiated returns up to the merchant's agreed coverage limit, so the merchant carries the return risk on those payments. Which payments a provider's guarantee covers is worth settling in writing before you choose one.

Frequently asked questions

What is step-up verification in a bank payment?

Step-up verification is an extra check a provider asks for when a payment scores too risky to approve outright but not risky enough to decline. The customer re-links the bank account, confirms identity details or approves a smaller first payment. A customer who passes completes the payment.

Why would a bank payment be declined when the account has money in it?

Because the balance is only one signal. A payment with funds behind it is still declined when the device, the account's age or the amount points to fraud, such as a large first payment from an account connected minutes earlier. The decline's reason code shows which signal triggered it.

Should a business hold a new customer's first large payment?

Yes, if the business releases goods or funds right away. A hold keeps the merchant from shipping an order or paying out a withdrawal before the checks clear. Once the customer has a run of clean payments, lift the hold or raise their limit.

Do fraud controls slow down checkout?

Only for the payments that need it. Scoring runs in real time as the payment is submitted, and Aerosync links and verifies a bank account in under 10 seconds. Payments in the middle score range see an extra step, and large first payments wait on a hold.

Set the cutoffs before the fraud arrives

Payment providers stop fraudulent bank payments by scoring each one before it settles and sending it to approve, cap, hold, step-up or decline. The score comes from the provider, and the cutoffs come from you. Set them by what a bad payment costs your business, keep them tight for new accounts, and move proven customers onto a faster path.

Want to stop risky bank payments without turning good customers away? Tune your thresholds with Aeropay Guard.