ACH Fraud

To pay for things like mortgages, utilities, and other monthly bills automatically, customers use ACH (Automated Clearing House). Due to many people using this network, hackers figured out ways to fraud and steal personal data. They use fake emails or harmful viruses to snatch personal details. They can take money from the account once they get a hold of someone’s routing and account number.

It’s tough to say how many people get hit because many don’t even realize they’ve been tricked. Stay alert and guard your info to avoid falling victim to ACH fraud. Also, check out Beem to protect your finances in case of any monetary uncertainties or emergencies.

What is Automated Clearing House fraud?

ACH is a system that helps banks and financial groups transfer money electronically. A fraudster needs your business checking account and bank routing number for ACH fraud. Until you figure out what wrong is, fraudsters will vanish, leaving you to clear the money mess.

When someone transfers money from a bank account without permission using the Automated Clearing House network, this act is known as ACH fraud. ACH is a financial hub for electronic money transfer in the U.S. ACH is used in new digital payment methods, such as Venmo, Paypal, Zelle, and others, to transmit money between people and businesses.

Is Automated Clearing House Fraud Common?

ACH fraud is a big problem that’s getting worse. In 2021, it comprised 37% of all the trickery. Nowadays, 93% of U.S. workers get paid by their bosses through ACH. Also, digital payment apps that use ACH to move money between accounts are increasing. As more people get paid through ACH, the number of crooks tricking people with this network also increases.

Examples of ACH fraud

ACH transactions often have a bit of time delay, giving criminals a small time frame to commit ACH fraud.

Here are a few examples:

• The criminal enters a business customer’s online info, creates an ACH file in the originator’s name, and takes out money (like payroll) before the victim realizes it.
• The criminal gets a retail customer’s info and sets up as a recipient for automatic bill pay.
• In a scenario where someone on the inside is a threat, like an employee of the target company or a bank, changes ACH files to steal money.
• ACH kiting: In a twist on check kiting (a scam where funds are moved back and forth between accounts at different banks), a criminal moves funds between accounts or banks and then take out all the money before the victim (usually a big organization) or the banks notice.
• In a spear phishing scam, an employee authorized for ACH transactions gets an email leading them to an infected site. This site installs a keylogger to get authentication info. The thief can then act like the company’s authorized person and take out money.
• The wrongdoer uses Authorized Push Payments to fool account holders into making ACH transactions, resulting in a payment to the wrongdoer’s bank account.
• The thief can make an ACH transaction using a customer’s info and then take out money from that customer’s account through ACH debit.

Common Ways Hackers Commit ACH Fraud

Getting the bank account and routing number is the hardest part of the ACH fraud process, but there are ways that hackers can get this info and then do ACH fraud.

Here are some common ways that hackers can get a bank account and routing number info and do ACH fraud:

Commercial credentials data breach

When a crook gets access to customer credentials, they can make an unauthorized ACH transaction in the originator’s name and quickly take out the funds through ACH debit. This credential theft usually happens in a significant data breach where crooks get backdoor access to sensitive customer credentials.

Insider threat scenario

An insider threat can access sensitive banking info or credentials. Companies use techniques to stop insider attacks, but some scenarios can’t be avoided because companies still rely on humans, who can sometimes be lazy or choose to do something criminal with the info they have access to.

ACH check kiting scam

A check kiting scam for ACH is a check fraud scheme where the crook takes advantage of the lag time when processing ACH transfers. It’s called check kiting because this started when checks were the primary way to move money. In ACH check kiting, a crook juggles money back and forth between accounts at different banks, so the ACH looks valid when checked, but the money is gone when the transfer happens.

Spear phishing scam

A spear-phishing scam is when an email is sent to someone, and by clicking on it, the person is sent to a website with malware. That site installs keylogger software that records all the keystrokes on a keyboard. Once the keylogger is installed, the crook can monitor the keystrokes and determine when a password is typed.

Debit card fraud

If you lose a debit card, you’re supposed to report it to the bank so the bank account can be turned off. Unfortunately, this doesn’t always happen immediately, so sometimes a scammer can make an unauthorized transaction with a debit card, leading to debit card fraud.

Accessing critical info

Criminals can get sensitive banking info mainly through a malicious attack, either through an external data breach or an insider threat. In many cases, the attack also exposes other vulnerable info like a social security number and could lead to identity theft.

With the authorization credentials, the thief can access authorized info and use it to send themselves an ACH transfer, pay a bill through an ACH transfer, or set up recurring billing through an online banking portal.

How Can Companies Prevent ACH Fraud?

ACH fraud scams are happening more often and on a larger scale. Because even one such event can have a significant impact, businesses and financial institutions need to take steps to protect themselves from ACH fraud.

It’s essential to check account balances and reconcile accounts regularly. Other important practices to prevent ACH fraud include:

• Use strong passwords and change them regularly.
• Limit access to any computer used for ACH transactions.
• Ensure that firewalls and antivirus software are up to date.
• To add an extra layer of security, use multifactor authentication (MFA) on devices and make sure the person doing an ACH transaction is who they say they are (the customer or another authorized person).
• Encourage customers to make a list of allowed regular authorized transactions.
• Use ACH filters so customers can allow ACH transactions only from the parties they approve, protecting their funds from ACH fraud.
• Encrypt all sensitive data, including customer credentials.

Organizations can also stop unauthorized transfers from customers’ accounts and use secure application programming interfaces (APIs) to find fraud. They can also use behavioral or biometric analytics systems that tell the difference between expected and unexpected (like fraudulent or malicious) account behaviors. Both technologies let institutions reduce risk as soon as it happens (almost in real-time) and lower instances of ACH fraud.

Institutions increasingly use fraud detection solutions powered by AI and machine learning that check identities, screen payments, and watch transaction data. These solutions offer extra protection that helps lower ACH fraud risk and keeps the institution and its customers from losing money.

The Impact of ACH Fraud

While ACH fraud can affect anyone using the ACH network for Electronic Fund Transfers (EFTs), the impact on businesses and financial institutions is much more significant than on individuals.

If a receiving bank faces multiple instances of ACH fraud, its losses from fraud can add up fast. This is because receiving institutions are financially responsible for chargebacks if they allow their customers to use received funds before they are fully cleared.

The institution sending an ACH transaction can also suffer financially from ACH fraud. If they let a transaction leave a customer’s account without the customer’s authorization, which is an unauthorized transaction, they might have to compensate the customer for the lost funds.

Besides financial losses, the institution might face damage to its reputation, affecting existing customer relationships. The bank might also struggle to attract new business if it experiences a large-scale ACH fraud scam.

Companies dealing with ACH fraud might have to pay fines for violating regulations. Depending on the scale of the scam, they might also end up in a legal battle with affected customers.

How to Detect ACH Scams

Two primary ways are usually used to detect any automated clearing house fraud:

Secure APIs

Secure APIs are crucial in protecting against ACH payment fraud in various ways. They allow authentication of connections using API keys, tokens, and certificates. This prevents fake bank domains and safeguards login credentials. 

Secure APIs enable the validation of requests through signing or other cryptographic methods, helping to identify poorly formed requests that don’t come from your systems. Proper API permissions scoping restricts access to only necessary functions, reducing potential harm from compromised credentials.

Monitoring API activity, including logging and analytics, allows early detection of unusual behavior that may indicate potential fraud. It also controls rate limiting, input validation, and request size limits to prevent common API attacks like injection and denial of service. Finally, mutual authentication, API security scanners, web application firewalls, and other tools offer additional analysis and protection against attacks exploiting APIs. Implementing this layered security strategy maximizes the safety and integrity of ACH payments initiated through well-designed APIs.

Biometrics

Biometric authentication methods, such as fingerprint, facial, or voice recognition, offer strong protection against ACH fraud when used to control access to payment initiation systems. By linking transaction approvals to individual biological traits, biometrics ensures that requests come from authorized individuals.

Even if credentials are stolen, scammers can’t pretend to be staff to make fraudulent payments. Well-implemented biometrics can significantly decrease unauthorized account takeovers and fraudulent money transfers. They also create audit trails that trace payments to specific approved individuals. 

How to Prevent ACH Fraud?

Guarding against ACH fraud is, fortunately, simple. Here are four straightforward methods:

ACH freeze

An ACH fraud filter is a barrier to preventing unauthorized withdrawals from your account. It lets you stop all incoming debits or specify a list of allowed debits and credits, blocking all others.

ACH fraud filter

An ACH fraud filter is a barrier to preventing unauthorized withdrawals from your account. It lets you stop all incoming debits or specify a list of allowed debits and credits, blocking all others.

Authorized user list

As part of your ACH fraud filter, you can create an authorized user list if you have regular transactions with a limited list of other parties.

One-time authorization

As the name suggests, a one-time authorization allows you to permit a single payment to a specific company. The bank will check the transaction but won’t process any others.

How Can Companies Prevent ACH Fraud?

Companies must review their credits and debit daily to spot fraudulent activity. Additionally, companies should consider services from their banks, such as ACH Blocks, ACH Filters, and positive pay-type services.

• ACH Debit Block: This service automatically sends back all ACH debits and credits directed to a specific bank account. No customer action is needed once the service is set up.
• ACH Debit “Filter”: It automatically returns all ACH items for a designated account, except those pre-authorized. Authorized ACH Originators are identified by providing the bank with specific identifier information, like originating company ID, individual ID number, etc. Some banks offer flexibility, allowing customers to further adjust their payment criteria based on maximum dollar amounts, exact dollar amounts, and the maximum number of occurrences.

ACH Fraud on Business Accounts

A personal account holder has a 60-day window to report ACH fraud to their bank, while businesses only get 24 hours. This is because Regulation E doesn’t cover businesses. Instead, the Uniform Commercial Code (UCC) governs ACH fraud protection for businesses. Once 24 hours pass, the business, not the bank, becomes responsible for the transaction. Companies must reconcile accounts quickly and regularly check online activity to detect ACH fraud early and lower the risk of fraud losses.

Other ACH Scams

Work-from-home scams, overseas money transfers, and fake offers of free or heavily discounted products are common tactics used by fraudsters. 

In schemes involving overseas scams, scammers typically promise to pay a person a significant amount if they pay smaller sums over time. As anticipated, the promised enormous sum of money has yet to be received. Consequently, the victim is often left with thousands of dollars in debt. 

Conclusion

You can enhance your protection by scheduling an appointment with your banker. They can assist you in reviewing all your options to shield yourself from scammers. By taking proactive steps and following these measures, you can help safeguard yourself from fraud and maintain the safety and security of your accounts. Protect your personal information, data, and accounts with top-tier identity theft protection with Beem and stay confident in the face of identity threats.

FAQs