ACH Fraud: What It Is and How Businesses Prevent It

What is ACH fraud?

ACH fraud is any kind of scheme that uses the ACH network to steal money, either by tricking a business into sending an ACH payment to a criminal's account or by pulling money from a business's account. Unauthorized debits hit more organizations, but fraudulent payments your own team sends are harder to undo.

ACH (Automated Clearing House) moves payroll, vendor payments and direct debits between US bank accounts. It's cheap and reliable, which is exactly why fraudsters target it. This guide covers how ACH fraud happens, the most common types, why it's hard to recover, and the best ACH fraud prevention steps you can take.

How does ACH fraud happen?

ACH fraud can come in many forms, but usually it comes in from two directions. Either a criminal tricks a company into sending money to their account or a criminal pulls money out of a business's account by obtaining key credentials.

Type	How it works	Main warning sign
Changed vendor bank details	A fraudster poses as a real vendor and asks AP to update its bank account. The next real invoice is paid to them. See payment diversion fraud.	A bank change request by email, often with urgency
Fake invoices	A fraudster sends an invoice from a fake or lookalike vendor with their own bank details.	A new vendor, or a familiar name with a slightly different email domain
Business email compromise	A criminal takes over or spoofs a real email account, yours or a vendor's, and uses it to request payments or bank changes.	A real-looking email asking for something unusual
Unauthorized ACH debits	Someone uses your account and routing number to pull money from your account.	Debits you don't recognize on your statement
Account takeover	A criminal gets into your online banking or payment system and sends ACH payments themselves.	Logins or payment batches you didn't create
Payroll diversion	A fraudster poses as an employee and asks HR or payroll to change their direct deposit account. The next paycheck goes to the criminal.	A direct deposit change requested by email, especially right before payday
Insider schemes	An employee adds a ghost employee to payroll or sets up a fake vendor, then pays it by ACH.	One person can create a recipient and release payment without a second approval

How common is ACH fraud for US companies?

Very common. Most US organizations face payment fraud attempts every year, and ACH is one of their favorite channels to steal money.

• 30% of US organizations saw fraud target ACH debits in 2025, out of the 76% that faced attempted or actual payments fraud overall (AFP 2026 Payments Fraud and Control Survey).
• 35.2 billion ACH payments worth about $93 trillion moved in 2025, including about 8.1 billion business-to-business payments (Nacha). That volume is why fraudsters target it.
• Insiders are part of the problem. In the United States and Canada, billing schemes showed up in 25% of occupational fraud cases and payroll schemes in 14%, and the typical case cost $110,000 (ACFE, Occupational Fraud 2026: A Report to the Nations, p. 96). These schemes usually pay out through the same channels as legitimate payments, often by ACH.
• Money pulled from accounts is hit more often, but email scams go after the payments you send. In 2024, 38% of organizations saw fraud on ACH debits and 20% on ACH payments they sent (AFP 2025 Payments Fraud and Control Survey, key highlights). Yet 50% of organizations reported business email compromise attempts aimed at tricking them into sending an ACH payment (AFP).

Whether the attack comes from inside or outside, every company that pays by ACH is at risk.

Can ACH payments be reversed after fraud?

Sometimes, but it's hard once a payment has gone out to a criminal's account.

• Reversals are for errors only. Nacha allows a reversal within 5 banking days for a duplicate payment, the wrong receiver, the wrong amount or the wrong date. Sending a reversal for any other reason is improper (Nacha, Reversals and Enforcement).
• You can ask, but the other bank doesn't have to say yes. Your bank can request a return "for any reason," including fraud, but the receiving bank "is not required to comply." It must tell your bank its decision within 10 banking days (Nacha, Risk Management Topics).
• The money moves fast. By the time a fraud is noticed, criminals have often moved the funds out of the receiving account.
• FinCEN warns that these fraudulent payments are "often irrevocable" and that identifying fake payment instructions before payments are issued is essential (FinCEN Advisory FIN-2019-A005). That's why prevention matters more than recovery.

ACH fraud prevention: how businesses stop it

ACH fraud prevention comes down to sharing bank details in a secure way while also knowing who you are actually doing business with.

For payments you send

1. Treat every bank detail change as high risk. Confirm it by calling the vendor on a number you found yourself, never one from the request. See callback verification.
2. Treat direct deposit changes the same way. Confirm an employee's bank change in person or by calling a number already on file, not by replying to the email.
3. Collect bank details through a secure channel if you have one. If you don't, treat details that arrive by email, PDF or phone as unverified until you've confirmed them.
4. Verify the account belongs to the vendor. A valid account number only proves the account exists. See what bank account ownership verification is.
5. Require two people. One person sets up or changes a vendor or employee bank account, a different person approves it, and payments above a set amount need a second approver.
6. Watch the first payment. The first payment to a new account, or right after a bank change, deserves an extra look.

For money pulled from your account

1. Ask your bank about ACH positive pay, debit blocks or filters. These let you review or block debits from companies you haven't approved.
2. Reconcile accounts daily, so unauthorized debits are caught inside the return window.
3. Lock down online banking. Use multi-factor login and require a second approver to release ACH batches.

Since June 2026, Nacha's fraud monitoring rules require every business that sends ACH payments to have a risk-based process for spotting payments made under false pretenses, reviewed at least once a year (Nacha, Fraud Monitoring Phase 2). The controls above are a solid starting point for that process.

What should you do in the first hour after an ACH fraud?

Moving fast is key. The sooner the banks know the better chance the money is still in the receiving account.

1. Call your bank's fraud line now. Give the payment details and ask them to request a return from the receiving bank right away.
2. Stop further payments to the suspect account, and freeze any pending payments to that vendor.
3. Call the real vendor on a number you already had on file to confirm what happened.
4. Report it to the FBI at ic3.gov. FinCEN notes that fraudulent wire transfers reported to law enforcement within 24 hours are more likely to be recovered, and speed matters just as much for ACH (FinCEN Advisory FIN-2019-A005).
5. Secure your email. If an inbox was compromised, reset passwords and check for forwarding rules the attacker may have set up.
6. Save everything: the emails, invoices, bank change requests and payment records.
7. Tell your insurer if you have crime or cyber coverage, since many policies have notice deadlines.

Always run a post mortem on how this happened and the steps to take to prevent this from happening again. Check out our vendor onboarding checklist for more on onboarding best practices.

What's the best way to stop ACH payment fraud?

Much of ACH fraud is based around deception through email and mobile communication, so having a tool that can create a secure channel to transmit bank details and verify the vendor's bank account and the individual sending you the bank details is very important.

Verifying the account also stops honest mistakes such as mistyped numbers or a company sending their old account on accident.

With Coffr, we create the secure channel for bank details to be shared and we verify the person and bank account match so you don't have to guess whether the bank details you were shared are real, or edited.

Each verification is recorded on an immutable blockchain ledger, so a later change to those details stands out.

See how Coffr can prevent ACH Fraud in your business. Book a demo.

Sources

• AFP 2026 Payments Fraud and Control Survey
• AFP 2025 Payments Fraud and Control Survey, key highlights
• AFP press release on the 2025 Payments Fraud and Control Survey
• ACFE, Occupational Fraud 2026: A Report to the Nations
• Nacha, ACH Network volume 2025
• Nacha, Reversals and Enforcement
• Nacha, Risk Management Topics
• Nacha, Fraud Monitoring Phase 2
• Nacha, Originator Essentials
• FinCEN Advisory FIN-2019-A005
• CFPB, Regulation E, 12 CFR 1005.2
• UCC 4A-202, Cornell Legal Information Institute