ACH (Automated Clearing House) payments are electronic payments that move funds between bank accounts using the ACH network in the United States. This system is managed by Nacha and facilitates a variety of payment types including direct deposits from employers, payments to contractors, automatic bill payments, and peer-to-peer transfers.

Like other types of electronic payments, ACH transfers are vulnerable to fraud. In 2025, 76% of organisations faced actual or attempted payment fraud, while 30% of respondents reported fraud involving ACH debits.

Below, we'll explain what you need to know about ACH fraud, including common fraud methods, liability in the event of ACH fraud, and how to prevent and detect ACH fraud.

What's in this article?

• Types of ACH fraud
  
• When should you trace an ACH payment?
  
• How to trace ACH payments
  
• Who is liable for ACH fraud?
  
• ACH fraud detection
  
• ACH fraud prevention
  
• How Stripe Radar can help
  

Types of ACH fraud

ACH fraud exploits vulnerabilities in electronic fund transfers (EFTs) through unauthorised debits, compromised credentials, or deceptive payment instructions. These schemes typically involve manipulating payments and deceiving customers and businesses to obtain banking information and redirect funds.

When should you trace an ACH payment?

An ACH trace helps financial institutions track the status and location of funds across the ACH network using a transaction's unique 15-digit trace number.

Consider requesting a trace from your bank or payment processor in the following situations:

• Unexplained payment delays: Funds have been debited from the originator's account, but the recipient has not received the deposit after the standard settlement window (typically 1–3 working days, or more than 5 working days for standard transfers).

• Suspected fraud or unauthorised withdrawals: An unrecognised debit appears on your account statement. Tracing the transaction identifies the Originating Depository Financial Institution (ODFI) and company ID, enabling your bank to initiate an unauthorised return (e.g., return code R10 or R29).

• Duplicate debits or credits: A technical glitch, batch file error, or double submission results in identical transactions processing more than once.

• Incorrect account or routing details: A transfer was initiated with mistyped banking information and has not automatically bounced back as an unpostable transaction (e.g., return code R03 or R04).

• Vendor or payroll delivery disputes: A vendor, contractor, or employee reports non-receipt of payment despite the originator's ledger showing a completed disbursement. Providing the trace ID serves as formal proof of transfer so the receiving bank can locate the funds manually.

How to trace ACH payments

Tracing ACH payments can help resolve issues such as non-receipt of funds, errors, or suspected fraud. The sooner you initiate a trace, the easier it is to track the details accurately.

Here are the steps to trace an ACH payment:

1. Gather payment details
   Compile the exact transaction date, dollar amount, originating and receiving routing/account numbers, and your internal reference ID.

2. Obtain the 15-digit ACH trace ID from the sender
   If you sent the payment, retrieve the 15-digit trace ID from your bank statement, payment processor dashboard, or ODFI. If you are the recipient, ask the sender to obtain this number from their financial institution.

3. Contact the relevant financial institution

   1. If you are the sender: Ask your bank or payment processor to initiate a formal ACH trace request through the network to the receiving bank.
      
   2. If you are the recipient: Provide the 15-digit trace ID to your bank's ACH operations team so they can search clearing queues for held, pending, or misrouted deposits.
      

4. Review the trace resolution and document results
   ACH trace investigations typically take 1–3 working days. Once resolved, review the report for the transaction status, settlement timestamp, or specific Nacha return code (e.g., R01 for insufficient funds, R03 for incorrect account number), and archive the report for accounting and dispute records.

Who is liable for ACH fraud?

ACH fraud liability depends primarily on whether the compromised account belongs to a customer or business. Under the Electronic Fund Transfer Act (EFTA), customers have broad statutory protections for unauthorised debits reported within required timeframes. Businesses are governed by the Uniform Commercial Code and typically bear the loss unless the financial institution failed to follow agreed-upon, commercially reasonable security procedures.

Here's how liability is typically assigned in common scenarios such as unauthorised debits, BEC, or account takeover:

• Unauthorised debits: Banks reimburse consumers for unauthorised debits reported within 60 days of the transmittal of the periodic statement under the US EFTA. Businesses have a much narrower window to dispute unauthorised debits.

• BEC: Liability almost always falls on the business that authorised the payment, since financial institutions are not responsible for verifying the underlying legitimacy of an authorised payment order.

• ATO: Banks generally cover customer losses reported promptly. For business accounts, the business bears the loss unless the bank failed to provide or follow "commercially reasonable" security procedures under UCC 4A, a legal framework that determines who bears losses from unauthorised wire transfers and certain ACH credit payments.

• Data theft: Organisations that suffer breaches face liability, regulatory penalties, and civil damages if a customer's banking details were exposed due to inadequate cybersecurity controls or non-compliance with industry standards.

• Phishing scams: For customers, unauthorised debits resulting from stolen credentials remain protected under Regulation E, a US regulation that protects customers against unauthorised EFTs. For businesses, losses typically fall on the company whose employee or system was compromised.

• Insider threats: Organisations are liable for losses resulting from rogue employees or contractors, particularly when weak internal controls or lack of dual authorisation enabled the fraud.

• ACH kiting: Fraudulent actors face direct criminal and civil liability. Inter-bank losses are allocated based on Nacha rules, with institutions potentially liable if they fail to maintain required risk-monitoring thresholds.

• Fake payments and invoice fraud: The originating company bears the loss for failing to verify altered payment instructions or fraudulent invoices, since banks are legally protected when processing payment orders according to the account numbers provided.

ACH fraud detection

Detecting ACH fraud requires diligent monitoring, reviewing, and sharing information.

Here's what you should know:

Transaction monitoring

Implement specialised software that continuously analyses your ACH transactions against established baselines and historical patterns. Artificial intelligence and machine learning can learn your business’s typical payment behaviour and flag potentially suspicious transactions based on complex patterns that humans might miss. The following might be signs of potential fraud.

• Unusual IP addresses or devices associated with transactions

• Deviations in transaction volume or amounts compared to historical averages

• Payments to new beneficiaries, especially those in high-risk geographic locations

• Irregular transaction times (outside of standard business hours)

• Urgent requests (e.g., emails or calls demanding immediate action) pressuring businesses to expedite payments or send money to unfamiliar accounts

• Inconsistencies in names, account numbers, or other details within a payment request

Review procedures

• Manual scrutiny of high-risk transactions: Carefully examine the transactions that your monitoring tools flag. Dedicated staff should check for irregularities in beneficiary details, payment history, and any associated communications.

• Spot audits: Conduct random audits on a subset of ACH transactions. Even if you do not discover any fraud, some fraudulent actors might be deterred if they know a business is scrutinising transactions closely at any time.

• ACH return analysis: Monitor ACH returns closely. High return rates can point to unauthorised debits or fraudulent beneficiary information. Analyse reasons for returns and look for patterns.

Know Your Customer (KYC) practices

• Customer verification: Before initiating recurring payments or adding new beneficiaries, conduct due diligence. Verify addresses and business legitimacy and check against sanctions lists and fraud databases.

• Relationship monitoring: Regularly check for changes in recipient behaviour, communication style, or updated bank account information that could indicate an account has been compromised.

Information sharing

• Bank collaboration: Maintain open communication with your bank’s fraud prevention department. They can alert you to emerging fraud patterns and collaborate on investigations.

• Industry networks: Join industry associations and fraud prevention networks. Sharing threat intelligence and best practices helps everyone stay a step ahead of fraudulent actors.

Fraud response plan

Don’t wait until an incident happens to decide what to do. Proactively create a plan that includes the following steps:

1. Mitigate further damage: Freeze compromised bank accounts, revoke active user sessions, reset online banking credentials, and rotate API keys. Place emergency ACH debit blocks and positive pay filters on the affected accounts to halt any pending or scheduled outgoing transactions.

2. Notify your bank’s fraud or treasury management team: Contact your bank’s dedicated fraud desk or treasury relationship manager immediately. Provide the transaction details, request an immediate ACH trace, and ask the bank to initiate an unauthorised return request or recall with the receiving institution.

3. Execute internal reporting and investigation protocols: Document the complete incident timeline and preserve logs. Brief internal stakeholders, legal counsel, and compliance teams to assess reporting requirements under applicable state and federal data protection laws.

4. File reports with law enforcement and regulatory agencies: Report the incident to local law enforcement and submit an online complaint to the FBI’s Internet Crime Complaint Center. If a customer’s personal identifiable information or financial records were exposed, notify the appropriate state attorneys general and regulatory bodies within required timeframes.

ACH fraud prevention

ACH fraud poses a significant threat to businesses, including lost funds and reputational damage.

Here’s how to fortify your defences and prevent ACH fraud attempts:

• MFA: Enforce MFA for all logins and financial transactions. Require an additional verification step beyond just a username and password. This reduces the risk of unauthorised access even if login credentials are compromised.

• Preauthorised payments: This ACH debit verification system allows businesses to preauthorise legitimate recipients and amounts for ACH debits. Any deviations trigger alerts for review before processing, preventing fraudulent withdrawals.

• Staff training: Train staff to recognise phishing attempts, social engineering tactics, and red flags associated with ACH fraud. Educate them on proper procedures for handling ACH transactions and reporting suspicious activity.

• Segregation of duties: Implement a system in which different employees handle tasks such as initiating payments, approving transactions, and reconciling accounts. This reduces the risk that a single employee will manipulate the system for fraudulent purposes.

• Real-time monitoring: Use real-time transaction monitoring tools to identify anomalies and suspicious activity and stop them before they’re processed.

• Reconciliation procedures: Establish thorough reconciliation procedures to compare expected payments against actual debits and credits. Regularly review bank statements and identify any discrepancies that could indicate fraudulent activity.

• Data encryption: Ensure all sensitive data, including account information and financial records, is encrypted at rest and in transit. This makes it much harder for fraudulent actors to steal valuable information even if they breach your systems.

• Access controls: Implement strict access controls for financial data and ACH processing systems. Only grant access on a need-to-know basis and use strong password policies with regular password changes.

• Fraud prevention services: Consider partnering with fraud prevention specialists that offer advanced threat intelligence and monitoring services. These services can provide additional layers of security and expertise in detecting sophisticated fraud attempts.

• ACH network participation: Participate in ACH network risk mitigation initiatives. These initiatives offer resources and tools to identify emerging threats and best practices for combating ACH fraud.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe’s global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar’s AI learns from more than US$1.9 trillion in annual transactions across Stripe’s global network, helping it identify and block fraud patterns that individual businesses might not catch on their own.

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types.

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats.

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar’s intelligence through programmable APIs, whether you process payments on Stripe or not.

Learn more about Stripe Radar or get started today.