Modern ACH risk: What has changed and how to assess it

Automated Clearing House (ACH) payments have remained popular in part because they’re low-cost and accessible. But like most other payment types, they come with risks, especially for returns. Often the result of fraud or insufficient funds, an ACH return is a rejected or incomplete payment. At scale, returns can eat into profits, counteracting ACH’s low cost. 

In response, companies often implement several-day ACH holds to prevent losses from returns. But this extends the ACH timeline and damages the customer experience. Additionally, changes in ACH have introduced newer risks that some financial institutions aren’t aware of—and don’t have measures in place to counteract. 

With the addition of same-day ACH in 2016 and recent updates to Nacha rules, ACH continues to adjust to changing consumer needs. However, that evolution also brings a shift in how return risk is evaluated. 

As Brian Dammeir, Plaid’s Global Head of Payments & Financial Management, explains, "A return comes in, a dispute gets filed, the finance team chases a recovery that often never lands. That model worked when ACH was slow enough to give you time to spot trouble. It doesn't work anymore. Faster payments and AI-driven fraud have collapsed the window, and firms have to update their technology to match."

ACH risks: settlement risk and fraud 

Settlement risk 

Settlement risk stems in part from the timing of ACH payments. Unlike payments that provide real-time confirmation, like credit cards, ACH transitions can take 1 to 3 business days to settle, unless the payer uses same-day ACH.  

If a company releases funds to a customer before an ACH payment settles and the transaction is later returned, it may have to absorb the loss if the funds cannot be recovered from the customer.

Other common returns result from account or payment information issues. For example, R02 can indicate a closed account, while R03 and R04 can result from invalid or incorrect account information. These returns are generally initiated by the receiving bank and typically occur within two business days.

Customers can also initiate certain returns, including when they claim a payment was unauthorized or didn't follow the terms of their authorization. For these types of returns, customers generally have up to 60 calendar days to notify their bank.

Fraud 

The several day settlement period between initiating an ACH payment and confirming that the funds are available also creates a gap that fraudsters can exploit.

For example, in ghost funding, a fraudster funds an online account using ACH without having sufficient funds to cover the payment. If the business allows the customer to use those funds before the ACH payment settles, the fraudster can make purchases or move money using funds that were never actually available.

Fraudsters can also use stolen account information or compromised customer accounts to initiate unauthorized ACH payments. Common ways this can happen include:

• Account takeover (ATO) attacks occur when criminals gain control of accounts using stolen credentials or other compromised information, allowing them to initiate payments from a victim's account. 

• Phishing attacks use malicious emails, websites, or messages to trick people into revealing login credentials or other information that can be used to access their accounts. 

• First-party fraud occurs when someone uses their own personal information to commit fraud. With ACH, for example, a fraudster could move money between accounts they control through a fintech service, then claim the debit was unauthorized. If the company refunds the payment, the fraudster profits from the transaction.

• Social engineering attacks can take a variety of forms, but they all involve tricking people into sharing sensitive information, like account details or login credentials that can be used to facilitate fraudulent ACH activity.

It’s also important to note that preventing ACH fraud requires checks at multiple points in the payment flow. Upfront checks can help businesses establish whether a user and their account are legitimate before allowing them to transact. Transaction-level assessments provide another layer of protection when money is actually being moved. 

→ Plaid Signal provides an instant risk assessment and enables you to customize payment flows based on the likelihood of an ACH return.

How to assess ACH risk and reduce returns 

There are a number of tactics companies can use to assess ACH risk and prevent returns:

Timing holds correctly 

Getting hold timing right is key to reducing returns. An ACH hold happens when a transaction is pending, but funds are not yet available to use because the transaction hasn’t been fully cleared yet. 

If a company or partner bank times holds correctly, they won’t have to pay any insufficient funds (NSF) returns out of pocket. This is because the funds stay in the company or partner bank’s control while the payment is settling and can be used to cover the return. Note that this method prevents losses but does not prevent NSF returns from happening, which means that the organization could still exceed Nacha return rate thresholds and receive fees for the returns.

Step up risk checks

ACH is just one part of the risk to your company, so working with other departments can help mitigate risk across the organization. While every payment method’s risk considerations are unique, other teams’ learnings can often be applied to ACH. 

Part of this is holistically understanding transaction risk, from return patterns to device signal analysis. Plaid Signal uses machine learning to assess over 1,000 unique risk factors and deliver customer-initiated and bank-initiated return risk scores. 

With this information, you can add dynamic protection measures to defend your business. For instance, you can release funds immediately for low-risk transactions, hold payments for those with moderate risk, and route elevated risk transitions to instant payment rails. The highest risk transactions can either be blocked or require additional risk checks.

This way, you’re neither adding unnecessary roadblocks for safe transactions nor leaving the gate wide open for risky ones. 

Try dynamic payment rail routing

Payment rails are the infrastructure behind money movement and every payment type has its own rail with benefits and tradeoffs. Many companies already employ a multi-rail strategy, accepting payments using multiple methods to meet customer preferences. As instant payment rails like RfP become more common, companies have more options than ever. Dynamic payment routing goes one step further by helping companies optimize the payment flow to mitigate risk, save on fees, increase completion rates, and more. 

Routing payments dynamically means using data about the transaction to determine the best payment rail. For example, if a customer does not have sufficient balance in their bank account for an ACH payment, a card or another available payment rail can be used as a fallback, preventing an insufficient funds return. For eligible transactions, RfP can also provide a way to move funds instantly rather than waiting for ACH to settle.

That said, companies should bear in mind that the user’s overall trustworthiness, and not just their trust in a specific payment method, should be taken into account.  

As more payment rails emerge, including instant payment options like RfP, dynamic payment routing will likely become more commonplace. 

Gradual rollout 

If your organization is new to ACH, consider a partial rollout instead of making it available to all customers on day one. This will help limit the amount of returns you get upfront.  

For example, you may consider only offering ACH payments for transactions below a certain amount. Or you may only offer it to customers who are part of a loyalty program. This way, only a small portion of your customer base has access to the payment method, and you can identify and work out issues with a smaller group, rather than risk losing more money with your entire customer base. 

Mitigate risk and prevent ACH returns with Plaid Signal 

ACH offers customers low fees and convenience, but fighting returns is critical to the success of an ACH program. Strategies like assessing risk holistically, using data to identify risk, and dynamic rail routing, can help mitigate ACH risk.  

Plaid Signal can also help businesses move from reactive return management to proactive risk assessment. Signal Transaction Scores uses machine learning to evaluate proposed ACH transactions and predict their likelihood of returning, using over 1,000 network risk factors. 

Businesses can then use Signal Rules to translate risk scores into actions that match their risk tolerance—for example, approving lower-risk transactions immediately while holding, reviewing, or declining higher-risk payments. And recent updates to the platform make Signal even more accurate over time–by feeding your decisions and return outcomes back into the network, the model gets smarter over time. 

However, Signal isn’t a stand-alone ACH risk prevention tool. It is still important to conduct upfront checks on users using products like Protect and IDV. Together, these capabilities can help businesses reduce ACH return risk while making faster, more informed payment decisions.

→ Learn more about Signal