- Where ACH losses usually begin
- Treat returns as operating data, not clerical cleanup
- Separate payment creation, approval and release
- Verify changed payment instructions independently
- Monitor outgoing credits for patterns that do not fit
- Prepare a response process before a fraudulent payment occurs
- Editorial Verdict
- Sources
Where ACH losses usually begin
Business ACH losses often begin before a file reaches the bank. A compromised employee mailbox can produce a fake vendor change, a stolen treasury credential can release a legitimate looking payment, or a weak approval workflow can allow one person to create and send the same batch. The control objective is therefore broader than protecting a password. The business needs to protect the instruction, the person approving it, the beneficiary data and the release step. In 2026 this is especially important because Nacha expanded fraud monitoring responsibilities across non-consumer ACH originators. The rules call for risk based processes reasonably intended to identify entries initiated because of fraud.
A practical design starts by identifying payment types with the greatest loss potential. New vendor credits, first payments to a changed account, unusually large payroll adjustments and files created outside normal hours deserve more scrutiny than a stable recurring payment. For example, if a company normally sends vendor ACH credits of $2,000 to $20,000, a first time $185,000 credit to a newly changed account should not travel through the same unattended workflow. The business can combine dollar thresholds, velocity checks, account change flags and independent verification instead of relying on one universal rule.
Treat returns as operating data, not clerical cleanup
ACH returns tell the business whether its payment process is producing valid instructions. Some returns are routine, such as a closed account or insufficient funds, while others point to authorization, account data or fraud problems. A treasury team should code returns by reason, track the rate by payment stream and investigate sudden changes. Nacha maintains an unauthorized debit return threshold of 0.5 percent, while administrative and overall debit return levels are also monitored. Even when a business is comfortably below a network threshold, a local increase can reveal a broken onboarding process or a compromised payment channel.
Consider a subscription business that sends 8,000 debits in a month. If unauthorized returns rise from 8 items to 32 items, the absolute count is still small, but the increase is operationally meaningful. The team should determine whether the issue is concentrated in one sales source, one authorization form or one date range. Returned credits also matter. A rejected payroll credit may leave an employee unpaid, while a returned vendor payment can trigger late fees or duplicate payment attempts. The return workflow should identify an owner, a deadline and the evidence needed before the payment is reissued.
Separate payment creation, approval and release
Segregation of duties limits the damage that one compromised user or one mistake can cause. A common structure lets one employee create a payment file, another review it and a separate authorized user release it when the amount or risk level is high. Smaller businesses may not have three finance employees, but they can still separate roles by using an owner or outside controller for approval above a defined threshold. The key is that the second person must perform a real review rather than simply clicking an approval button.
The reviewer should see the beneficiary name, account change status, total file amount and unusual individual items. A useful rule might require two approvals for any new beneficiary and any batch above $50,000, even if recurring smaller files need only one. Administrative rights deserve separate control because an administrator may be able to create users, reset authentication or raise limits. Review user entitlements quarterly and immediately after job changes. Access that was appropriate during an implementation project should not remain indefinitely once the project is complete.
Verify changed payment instructions independently
A changed bank account is one of the strongest fraud signals in business payments. Email alone is weak evidence because business email compromise attacks often imitate the vendor or take over the real mailbox. When instructions change, contact the vendor through a telephone number or other channel already on file. Do not use a phone number included in the same message that requested the change. Record who verified the instruction, when it was verified and what information was confirmed.
The control should also cover internal payments. Payroll direct deposit changes, executive reimbursements and transfers to related entities can be manipulated through compromised accounts. A company with frequent changes can use a structured form and a callback queue rather than treating each change as an exception. If a vendor asks on Tuesday to move a Friday $72,000 payment to a new account, verification should occur before the ACH file is created. If verification cannot be completed, delaying the payment is usually safer than weakening the control because of an artificial deadline.
Monitor outgoing credits for patterns that do not fit
The 2026 Nacha rules put greater emphasis on credit push fraud, where the victim is induced to send money rather than having money pulled without permission. Monitoring can therefore include velocity checks, behavioral tolerances, pattern recognition and anomaly detection. A business does not need the same technology as a bank, but it should know its normal payment profile. Amount, beneficiary age, time of day, user, originating location and number of payments can all help distinguish routine activity from an outlier.
For example, a company that normally sends one payroll file and twenty vendor credits on Thursdays might flag a Sunday evening batch containing twelve new beneficiaries. The alert should lead to a defined action, not merely an email that nobody reads. High risk alerts can pause release until an independent person confirms the activity. Lower risk alerts can be reviewed the next morning. The monitoring design should be tested periodically so the team knows that thresholds still reflect current transaction volume and that alert recipients are active employees.
Prepare a response process before a fraudulent payment occurs
When a suspicious ACH credit has already been released, speed matters. The business should have the bank fraud contact, treasury service number and internal escalation list readily available. Staff should know who can request a return, who can suspend user access and who can preserve the email or device evidence. A request to return an ACH entry is not a guaranteed recovery, so prevention remains more reliable than trying to reverse a completed payment.
Run a tabletop exercise using a realistic scenario. Assume a controller approves a $95,000 vendor credit and learns thirty minutes later that the vendor never changed banks. The team should be able to identify the bank contact, freeze the compromised user, preserve logs, warn the actual vendor and document what happened. After the exercise, fix gaps such as outdated phone numbers, missing approvers or unclear authority. A response plan that exists only in a policy document will not help if nobody knows how to activate it during a real payment incident.
Editorial Verdict
Treat ACH control design as part of payment operations.
The strongest ACH process combines fraud monitoring, independent verification, meaningful approval separation and disciplined return analysis. In 2026 every non-consumer ACH originator should also review how its procedures satisfy the expanded Nacha fraud monitoring requirements, rather than assuming the bank alone carries that responsibility.