On average, more than 140 million Automated Clearing House (ACH) transactions happen every day. Pay by bank transactions, such as ACH transfers, are generally safe, but to fully understand the safety risks, you need to know how they work. Cards and bank transfers have safety mechanisms that operate differently, and businesses that aren’t aware of these differences can either unnecessarily avoid bank payments or process them without the right controls in place. A secure payment processor can help you navigate things correctly.

Below, we discuss how bank payments are regulated and protected, common bank payment risks, and what to look for in a secure payments provider.

Key takeaways

• Modern pay by bank flows often use bank connections based on Open Authorization rather than shared credentials, which means no raw account numbers or banking passwords are stored or transmitted.

• ACH payments operate within a tightly governed system of Nacha rules and federal Regulation E protections, which give businesses and consumers defined rights and recourse.

• Bank payments generally carry lower fraud risk than card transactions.

Is pay by bank safe for consumers?

Pay by bank transactions are generally safe for consumers. Modern pay by bank flows work differently from how bank-linked payments did a few years ago; the main difference is how the bank connection is established. Instead of asking consumers to share their banking username and password, modern pay by bank flows authenticate the consumer directly through their bank’s own interface using Open Authorization (OAuth). The bank issues a token authorizing a specific, limited connection. No credentials are shared with the business or the payments provider, and access is limited to what the transaction requires.

If an unauthorized debit appears on a consumer’s account, they can dispute it with their bank, which is required to investigate. The burden isn’t on the consumer to prove fraud. The bank works through the network to establish whether the origination was authorized.

Are ACH payments safe?

ACH payments are a type of pay by bank transaction in the US and have the same protections as other bank-to-bank payment methods. Like any payment method, the chance of fraud isn’t zero, but fraud risks are generally low with bank-to-bank payments such as ACH.

How are bank payments regulated and protected?

Regulation E, a federal rule protecting electronic funds transfers (EFTs), sets consumer protections in the US. If someone reports an unauthorized debit within 60 days of their statement, their bank must investigate and provisionally credit the account if that investigation takes more than 10 days.

ACH payments in the US run on a system that is tightly governed. The network is administered by Nacha, a self-regulatory organization with operating rules that bind every financial institution that originates or receives ACH transactions.

Nacha requires originators to obtain proper authorization before debiting an account, retain that authorization for two years, and respond to return requests within defined time frames. If an originator’s unauthorized return rate hits 0.5%, Nacha can investigate and take enforcement action.

Transactions pass through at least two regulated institutions: the originating depository financial institution and the receiving depository financial institution. Both are subject to federal oversight and Nacha compliance requirements.

What are the common bank payment risks, and how are they managed?

The risks businesses tend to encounter with bank payments fall into a few distinct categories. Here’s what to know:

• Unauthorized ACH debits: These happen when someone initiates a transaction using account and routing numbers they don’t have the right to use. This is the scenario many businesses might picture when they worry about ACH fraud, and the one most directly addressed by account verification tools.

• Account takeover: This involves a legitimate account holder’s credentials being compromised and a third party originating transactions in their name. It overlaps with broader identity fraud rather than vulnerabilities specific to pay by bank transactions.

• Return abuse: This is when consumers dispute legitimate charges by claiming they weren’t authorized. It’s less understood but still has a substantial effect on operations. Unlike card chargebacks, pay by bank disputes run through the bank rather than a card network, and the timelines and evidence standards differ.

• Insufficient funds returns: While not considered fraud, these are a frequent source of failed transactions. Without the right provider terms, the financial impact can land on the business.

Managing these risks can go beyond network-level monitoring, which sets return rate thresholds but doesn’t substitute for proactive controls. Here are some viable options for mitigating exposure:

• Account verification before origination: Confirming that the account exists, is open, and belongs to the person authorizing the transaction either through microdeposit verification or instant OAuth bank connections eliminates a common fraud entry point.

• Fraud scoring: Behavioral signals around the transaction, such as device, velocity, account age, and transaction history, can flag high-risk originations before they’re submitted.

• Authorization documentation: Clear records of how and when a customer authorized a debit satisfy Nacha requirements and serve as a first line of defense if a dispute arises.

Link, a digital wallet built by Stripe, handles bank payments with a checkout experience that looks and behaves consistently, which reduces the customer hesitation that a generic “enter your account number” form might create. Link also automatically populates returning customers’ payment details. Rather than reentering details that could be wrong or manipulated, the consumer reauthenticates through the same flow.

How do bank payments compare to cards on safety?

Bank payments and cards carry different risk profiles, and the comparison isn’t as simple as one being safer than the other. Consider the following:

• Chargebacks vs. ACH disputes: Card disputes run through the card network, and the business bears the burden of proving the charge was legitimate. ACH disputes run through the bank, where the origination records are evaluated against the consumer’s claim.

• Fraud: Card-payment fraud risk is generally higher than ACH fraud risk.

• Liability structure: Card disputes that go against the business result in a chargeback plus a fee. With ACH, liability for returns depends on the originator’s authorization practices.

• Return rates in context: ACH returns can arise due to insufficient funds, closed accounts, or mismatched details. These originate as an operations issue that can be addressed through provider terms rather than fraud controls.

Consumers using pay by bank don’t have the same zero-liability protections applied to card transactions, and the dispute window and provisional credit rules under Regulation E differ from card network rules as well. While customers typically won’t notice a big difference, it’s still important.

What should you look for in a secure payment processor?

If you’re evaluating bank payment options, the due diligence questions you ask should be specific. The answers will tell you a lot about where the risk actually sits and who’s responsible for managing it. Here’s what to pay attention to.

How account verification is handled

Microdeposit verification is better than none, but it introduces a multiday delay and creates a window for misuse. Instant verification through OAuth-based bank connections is faster and can be more reliable. Ask whether it’s available and how it works for your customer base.

Who bears the liability for returns

Standard ACH places return liability on the originator. In this situation, the terms matter.

What fraud detections are run on transactions

Network-level Nacha monitoring is a floor. Ask what else the provider does to detect fraud, including risk scoring, velocity checks, device signals, and behavioral flags.

How consumer data is handled

Specifically, ask if raw account numbers are stored or if credentials ever pass through their systems. A provider using OAuth bank connections should be able to answer both questions clearly.

What the dispute process looks like

When a consumer disputes a bank transaction, ask how much notice you get, what documentation you need to provide, and what the timelines are. Make sure you have these answers before going live.

How Stripe Payments can help

Stripe Payments provides a unified, global payments solution that helps any business—from scaling startups to global enterprises—accept payments online, in person, and around the world.

Stripe Payments can help you:

• Optimize your checkout experience: Create a frictionless customer experience and save thousands of engineering hours with prebuilt payment UIs, access to 125+ payment methods, and Link, a wallet built by Stripe.

• Expand to new markets faster: Reach customers worldwide and reduce the complexity and cost of multicurrency management with cross-border payment options, available in 195 countries across 135+ currencies.

• Unify payments in person and online: Build a unified commerce experience across online and in-person channels to personalize interactions, reward loyalty, and grow revenue.

• Improve payments performance: Increase revenue with a range of customizable, easy-to-configure payment tools, including no-code fraud protection and advanced capabilities to improve authorization rates.

• Move faster with a flexible, reliable platform for growth: Build on a platform designed to scale with you, with 99.999% historical uptime and industry-leading reliability.

Learn more about how Stripe Payments can power your online and in-person payments, or get started today.