U.S. ACH Fraud Protection: Dual Approval Meets 2026 Nacha Rules

Brokerage staff independently verify an ACH payment

ACH fraud protection means combining prevention, detection, and response so that unauthorized or fraudulently induced transfers through the ACH network get stopped before money leaves your account, or recovered quickly if it does not. The single most important move you can make today is layered verification: confirm any new or changed payment instruction through a second channel before you send funds, and call your bank immediately the moment something looks wrong. Nacha, the Federal Reserve, and the FBI all point to the same priority: verify first, move money second.

TL;DR:

  • Unauthorized debits trigger Regulation E consumer protections, while credit push scams involve a transfer the victim approved and are harder to reverse.
  • Require two people to approve new or changed payment details, then verify them by calling a number already on file, not one in the request.
  • Nacha’s monitoring amendments phase in through 2026, requiring covered organizations above volume thresholds to use monitoring based on risk and review processes annually.
  • After suspected fraud, call your bank immediately to request a recall or hold, preserve records, and report the incident; recovery is never guaranteed.
  • Brokerages should route commission and referral payments through accounts controlled by the brokerage, recording each approval and linking every disbursement to its transaction record.
Brokerpay
Keep Brokerage Payments Compliant
BrokerPay tracks, documents, and processes agent splits, referral fees, and co-op commissions, helping brokerages avoid risky payment workarounds.
Visit BrokerPay

Table of Contents

What counts as ACH fraud: unauthorized debits vs. credit-push scams

Federal law draws a clear line between two types of incidents. Under Regulation E, an unauthorized electronic fund transfer happens when someone other than the account holder initiates a debit without actual authority, and consumer liability and error-resolution rules kick in. Credit-push fraud is different: the account holder’s own employee authorizes the transfer, but a scammer tricked them into sending it to the wrong place. Nacha emphasizes this second category because a clicked “approve” button no longer proves a payment was legitimate. How you classify an incident changes who investigates it, which reporting path applies, and how quickly you can expect a resolution.

Unauthorized debit versus employee-authorized credit-push fraud

Common ACH fraud schemes and the red flags that give them away

Most ACH fraud starts with deception, not a hacked bank account. Business e-mail compromise often involves a scammer impersonating an executive or a vendor and asking someone in accounting to rush a payment or update a bank account on file. Account takeover works differently: a criminal steals valid login credentials, then initiates transfers that look routine to anyone not watching closely. Mule accounts, often opened specifically to receive stolen funds before they disappear, tend to be new or recently reactivated.

Watch for these signals before you release a payment:

How fraudsters get in: phishing, stolen credentials, and malware

Phishing and spear-phishing remain the entry point for most business e-mail compromise cases, tricking an employee into revealing login details or wiring money directly. Credential stuffing, where attackers try passwords leaked in unrelated data breaches, lets criminals log into email or banking portals without ever touching your network. Once inside, malware can quietly harvest additional credentials, monitor outgoing invoices, and alter payment details before a legitimate bill ever reaches accounting. Each vector requires a different control: phishing calls for employee training and email filtering, credential stuffing calls for unique passwords and multi-factor authentication, and malware calls for patched systems and endpoint monitoring. None of these controls works alone, which is why layered defenses matter more than any single tool.

Prevention controls that actually stop ACH fraud

Strong ACH fraud prevention is less about buying a single tool and more about building habits that catch mistakes before money moves.

  1. Build a documented, layered workflow. Require dual approval for any new vendor or changed payment instruction, with a pause-and-escalate step before funds go out, an approach Nacha recommends scaling to your organization’s risk level.
  2. Verify out-of-band. Call the vendor or employee using a phone number you already had on file, never one provided in the suspicious message, and require a second person to sign off on any account change, a practice the FBI recommends specifically for real estate transactions.
  3. Strengthen authentication. Turn on multi-factor authentication everywhere you can, and favor hardware tokens or biometrics over SMS codes where your systems support them.
  4. Validate accounts and vendors before paying. Confirm new banking details directly with the payee through a known channel, not through the invoice or email requesting payment.
  5. Protect stored account numbers. Render any stored ACH account numbers unreadable at rest through encryption, tokenization, or truncation, consistent with Nacha’s data security rules.
  6. Keep operational hygiene tight. Remove system access the moment someone changes roles or leaves, patch software promptly, and reconcile accounts daily so anomalies surface fast.

Pro Tip: Treat every bank account change request as suspicious until you’ve verified it through a channel the requester didn’t provide.

Detecting fraud: baselines, FedACH tools, and the 2026 Nacha rules

Detection starts with knowing what normal looks like. The Federal Reserve recommends establishing baselines of typical dollar amounts, transaction velocity, batch sizes, and receiving accounts, then flagging activity that breaks the pattern, such as a sudden spike in volume or a payment to a dormant account. FedACH offers anomaly notification services, and many financial institutions configure RDFI alerts around unusual files, batches, or receiver items, though availability depends on your bank.

Ask your bank directly:

Nacha’s fraud-monitoring rule amendments, phased in through 2026, require ODFIs, non-consumer originators, third-party senders, and RDFIs above certain volume thresholds to build risk-based processes that identify entries suspected of being unauthorized or authorized under false pretenses, and to review those processes at least annually. In practice, that means daily monitoring, a clear path for reporting red flags internally, and an escalation process everyone on the finance team actually knows how to use.

If you suspect ACH fraud: what to do right away

Speed matters more than almost anything else once you suspect a fraudulent transfer, and recovery is never guaranteed.

  1. Call your bank immediately and request a reversal, recall, or hold, and ask them to pursue it, following the approach the FBI recommends regardless of the dollar amount involved.
  2. Preserve every record, including emails, phone numbers, invoices, authorization approvals, and full transaction details.
  3. Report the incident to the FBI’s Internet Crime Complaint Center and to the FTC at ReportFraud.ftc.gov.
  4. Follow instructions from your bank and from investigators, and keep your documentation organized for audits or insurance claims.

Compliance beyond Nacha: what real estate brokerages need to watch

Brokerages face a layer of exposure that general ACH guidance does not fully cover. Commission disbursements, referral fees, and earnest money transfers routinely involve multiple parties, tight closing timelines, and large dollar amounts, which is exactly the profile fraudsters target with payment-redirection scams. Brokerages should review their recordkeeping obligations and maintain clear documentation of commission splits and payments alongside their fraud-prevention processes.

Before using a peer-to-peer payment app for commission payments, check whether its controls and records meet your brokerage’s operational and compliance needs. A brokerage routing agent splits co-op commissions and referral fees through consumer payment apps should ensure it can document who approved each transfer and why. The practical fix is a payment workflow that keeps funds inside brokerage-controlled accounts, logs every approval, and ties each disbursement to the underlying transaction record.

Why layered verification matters more than any single tool

Commission payments are a favorite target for payment-redirection scams precisely because brokerages move money fast and under deadline pressure. I’ve seen the same pattern across industries: the fraud succeeds not because a system failed, but because nobody paused to verify. Documented, dual-approval workflows and preserved audit trails do not just prevent fraud, they also make recovery and investigation possible when something slips through. For brokerages building that kind of workflow around co-op and commission payments, our compliant payment guides are worth a look.

— Wes

BrokerPay: built for brokerages that can’t afford a payment mistake

We built BrokerPay specifically for the exposure brokerages carry every day: commission splits, referral fees, and co-op payments moving through accounts that need to stay RESPA-compliant and auditable. Every transfer routes through brokerage-controlled accounts with built-in approval workflows and a full audit trail, which maps directly to the layered controls described above: dual approval, centralized account control, and a documented record for every dollar that moves.

Brokerpay

We also point brokerages that process a high volume of ACH and card transactions toward CARDZ3N for processing-side fraud and chargeback protection, since payment processing and commission payment compliance solve different problems. If you’re ready to move your brokerage off manual payouts or spreadsheets, visit BrokerPay to see our Starter, Growth, and Enterprise plans and find the fit for your office.

FAQ

Is it possible to dispute an ACH payment?

Yes, you can dispute an ACH payment, and the process depends on whether it was unauthorized or authorized under false pretenses. For unauthorized transfers, Regulation E gives consumers specific notice periods and liability tiers, while business disputes typically start with a direct call to your bank requesting a reversal or recall.

What does fraud prevention do?

Fraud prevention reduces the chance that a fraudulent transfer succeeds in the first place, through controls like dual approval, out-of-band verification, and account validation before payment. It works alongside detection, which flags suspicious activity through baseline and anomaly monitoring, as described in Federal Reserve guidance on FedACH tools.

Will the bank refund a fraud transaction?

For unauthorized electronic fund transfers, banks generally have ten business days to investigate, or 20 if the account is less than 30 days old, and may issue a temporary credit during that review. Credit-push scams where the transfer was technically authorized are harder to reverse, so contacting your bank immediately and asking them to reach the receiving institution gives you the best chance at recovery.

What is the 10/80-10 rule for fraud?

This isn’t a recognized ACH or Nacha rule, and no authoritative source defines a “10/80-10 rule” for fraud prevention. If you’re thinking of a specific framework, check the source directly rather than relying on an unverified name, since Nacha’s actual 2026 rules focus on risk-based monitoring and annual program review rather than a fixed ratio like this.

Sources