How can my business protect itself from ACH fraud on its bank account?

The Automated Clearing House, commonly known as ACH, is a system that lets money move between bank accounts electronically instead of physically. The network is run by the National Automated Clearing House Association (NACHA), and it handles the most common electronic payments including payroll direct deposit, paying contractors, automatic bill pay, peer-to-peer transfers and more. But as convenient as ACH payments are, this system carries its own risks. An Association for Financial Professionals (AFP) survey found that 80% of companies experienced at least one payment fraud attack or attempt in 2023, up 15 percentage points from the year before, and 30% could not recover the lost money.

Article 4A

Federal Reserve Regulation E limits consumer liability for unauthorized transfers reported within 60 days for consumer accounts, but that doesn’t apply to business and corporate accounts. These accounts fall under the Uniform Commercial Code, Article 4A.

When an unauthorized transfer hits a business account, Article 4A puts the bank on the hook for the loss. If an order is unauthorized, the customer suffers if it authorized the person who made it. That said, when the bank establishes that it followed a security procedure the customer agreed to, then the loss falls to the customer, assuming the bank acted in good faith. These security procedures can include access codes, PIN numbers, biometrics, encryption or callbacks. The Uniform Commercial Code requires a bank’s security procedures be commercially reasonable.

To bypass the security procedure, the fraudster needs to know how it works and know codes or how to gain access to any devices used to make them work, then get into the bank’s transmission system. That insider information almost always comes from the customer or someone on the customer’s side or from the bank on the other side. If the customer can prove it’s not from its agents, former agents or any source it controls, the loss shifts to the bank. The customer has that burden.

Moreover, the Uniform Commercial Code places the onus on the business owner to notify the bank of a disputed transaction promptly. The window to report an unauthorized ACH transaction may be as short as 24 hours.

Don’t be surprised if the bank contests its own liability. The bank routinely argues that the fraud came from the customer’s own lapses in safeguarding rather than any failure of its security procedures.

To protect your business, think about getting cyber insurance. It can cover losses from cyber-related incidents.

To keep close tabs on your finances, check your account every day. Every month, check your statements for any changes you didn’t authorize. The moment you find something strange, pick up the phone and call your bank right away.

Do the business’s banking and financial work on as few computers or devices as you can. Keep those machines away from general web surfing.

Never access your accounts through public Wi-Fi, as it can be unsecured. Attackers can steal data or drop malware on your device without you knowing it.

Using a free webmail service may cost you. They can be easier for hackers to break into. If you choose one of these providers, make sure you can set up two-factor authentication.

Phishing and Social Engineering

Once your fee, invoice, bill or some other demand for payment comes, phone the other party right away to confirm the amount and payee. Do it at a number you got on your own; don’t use any numbers in an email or text. Never switch how you pay based on an email or text message alone.

Be wary of any email with changes to details on an existing bank account. Treat any email requesting a routine wire transfer go to a new bank account with extra suspicion.

Fraudsters sometimes pose as trusted vendors. Before paying, take time to double check that the request matches a genuine invoice.

Tempting though it may be, avoid clicking any links or opening any attachments that land in your in-box or text messages that you don’t know or haven’t verified. Even messages that seem to be from people you know could be phishing attacks for login or account information, and links can deliver malware and viruses.

Check the sender’s address very closely. These days, crooks spoof a sender address to make it look like it came from someone or somewhere you recognize.

When somebody asks you to change or update a bank account, don’t reply to the email. The fraudster may control the account, or your reply might go straight into the fraudster’s hands.

Urgency is a warning. Scammers drive for an instant transfer and often demand email as the only way to talk. Don’t let anyone push you to send money immediately.

Beware of what you put on your business social media feeds and website. Fraudsters comb for details they can use to sound like they know you.

To cut risk in fund transfers, think about two-factor authentication or dual control.

If you use a domain for email, set up intrusion detection rules that trigger on emails from domains that are almost but not quite your own, such as .co instead of .com. If you can, go and register the almost domain names on your own.

Tell everyone in your business how to detect phishing and social engineering, and let them know how to handle ACH payments. Make sure they know to report any hints of fraud they find.

Having one person initiate the payment, another approve it, and a third one reconcile it against the books reduces the risk of a single insider committing fraud.

Make sure you install software updates as soon as they come out. When they do, you get the latest bug fixes and security patches.

Don’t forget to pick a good, trusted antivirus program.