ACH fraud monitoring that puts what you send and what you receive on one screen, with the Nacha rule each flag answers and two people on every return
Every flagged entry decided before the money moves, with the rule it answers beside it.
See one case, screen by screen ↓ACH fraud monitoring is a bank's risk-based work to find ACH entries that are unauthorized or authorized under false pretenses, both in what it sends for its clients and partners and in the credits it receives. In ACH Fraud Monitoring, seven agents score both sides, link a mule account's money in and money out, ask the other bank and draft the return; a specialist prepares each decision and a manager who did not prepare it releases it.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
ACH fraud monitoring is no longer optional. Under the 2026 Nacha fraud monitoring rules, a bank must run risk-based processes to find entries that are unauthorized or authorized under false pretenses, on both sides of its business: the entries it sends as ODFI for its business clients and fintech partners, and the credits it receives as RDFI for its customers. Phase 1 began on March 20, 2026 and Phase 2 on June 19, 2026 (first banking day June 22), and the program has to be reviewed at least once a year.
Most teams still work it in pieces. The alerts sit in a detection engine, the payee changes in online banking, the account in the core and the partner's ledger in a portal. A suspect received credit posts at 9:00 a.m. by habit, and nobody sees that the new account it lands in already has a cash-out queued on the sent side. The other bank's fraud contact is found by phone and the conversation lives in email. The person who decided the return keys it. When an examiner asks for evidence that the program is risk-based and reviewed, the answer is a policy document written from memory.
Estimated split of one flagged received credit's working minutes, by hand and with the agents: our estimate, kept modest. Waiting for the other bank's reply is not counted. The decision itself stays with the specialist and takes about as long either way.
Seven agents score both sides, link the mule's in and out, ask the other bank and keep the program; a specialist prepares and a manager checks.
Thursday, October 22, 2026, at Tessaly Community Bank, a community bank that sends ACH for 14 fintech partners and 1,100 business clients. Overnight, a Delmar Freight payroll credit for Marcus Hollis arrived for an account opened two days earlier. Here is how the agents read it and the people decided it.
Priya opens Today. On the left are the entries Tessaly sent as ODFI: 38 flagged of 138,100. On the right are the credits it received as RDFI: 53 flagged of 76,200. Between them stand the six rules each finding answers, joined to each one-line story by a thin line. Twelve flags need her, and a quiet notice says Tallowbrook Pay's 8:00 a.m. partner ledger file is 52 minutes late.
The Federal Reserve file brings 31,204 credits settling Friday. One is DELMAR FREIGHT, PAYROLL, PPD, $3,412.66 to MARCUS T HOLLIS, account ••••8817, opened Tuesday at 11:06 p.m. through the Orrin Wallet app. Delmar Freight has paid him into his own account ••••2204 every other Friday since June 2019, 192 credits. Rule FM-03 fires, and the money clock shows 24 h 08 min before the funds must be available.
On the sent side, ••••8817 has a $3,400.00 Orrin Wallet cash-out queued for Friday at 9:05 a.m., five minutes after the payroll would be available. The device that opened it, D-77F2, opened two more accounts in other names. The credit is held under the funds availability exemption. Each of the seven steps of the run shows its time, its confidence and its hand-off.
“False pretenses, identity. Someone posing as the employee changed where his pay goes.”
The Contact agent finds Corvane National Bank's ACH Fraud Desk in the ACH contact registry and asks it to confirm, under standing rule FM-07. At 8:41 a.m. Rhea Lindqvist replies: Delmar Freight received the direct deposit change by email on Monday from marcus.hollis@delmarfreight-hr.com, a look-alike of delmarfreight.com. She asks for the return, and says Delmar will send a corrected credit to ••••2204 on Friday.
The agent drafts the fraud notice and the return with the R17 return code and QUESTIONABLE, with R06 one click away. The letter states that the entry goes back in Tessaly's 10:30 a.m. return file and that the funds were never made available. Priya can edit it or ask for a shorter version. Nothing is sent yet.
Asked 2:16 a.m., answered 8:41 a.m., 6 h 25 min: inside Tessaly's one-business-day reply standard.
Priya previews the secure message to Marcus Hollis: his pay was sent to a different account after someone asked his employer to change his direct deposit, it was stopped, and Delmar Freight is paying him on Friday. The holder of ••••8817 sees only that a deposit is under review and transfers out are paused. Neither view, nor the notice to Corvane, mentions the referral to the BSA Officer.
The package returns the credit as R17, keeps the hold, restricts ••••8817, stops the cash-out, sends the notice and the customer message, and refers three accounts to the BSA Officer, marked Confidential. Priya signs with reason code FP-01, Payroll diversion, false pretenses, identity. The screen tells her plainly that she prepared it, so she cannot check it.
Owen checks the evidence and releases six actions to the core, the partner ledger, the return file and the other bank. The R17 return is in the 10:30 a.m. file, and Corvane acknowledges at 11:02 a.m. On Friday at 10:52 a.m., Delmar Freight's corrected Same Day credit of $3,412.66 arrives for ••••2204 and posts at 1:00 p.m. The cash-out never leaves.
Orrin Wallet says it holds cash-outs for 72 hours, but the hold counts from the first deposit, not the opening, which is how ••••8817 could queue a cash-out with no deposit. The Mirror agent proposes holding every Orrin Wallet cash-out from an account under 5 days old for 24 hours, which would have stopped 17 cash-outs in 30 days, 12 of them confirmed fraud. Ingrid prepares it; Owen applies it.
The audit trail for R-0422 lists every action by a person or an agent, with who, what, why and the evidence, from the 1:44 a.m. flag to the Friday watch closing at 10:52 a.m. It is append-only and kept five years. One click builds the FDIC examination pack, the Nacha rules compliance audit, an internal audit sample or the BSA Officer's confidential pack.
The same diverted payroll, seen by the people who carry it: what their day looked like, and what it looks like now.
Seven agents score both sides, link the mule's in and out, ask the other bank and keep the program; a specialist prepares and a manager checks.
Reads every Federal Reserve file and fintech partner ledger as it lands, routes each entry to the sent or received side, and reports late files.
Scores every entry the bank sends before its file releases, against payee changes, online banking sessions and the program rules.
Scores every received credit before posting, against the account's age, the receiver's own pay history and the rules, with the funds availability clock beside it.
Joins sent and received entries that share an account, a device, a partner or a receiver, so one decision stops the money in and the money out.
Finds the other bank's fraud contact in the ACH contact registry, asks it to confirm, reads the reply into the case, and drafts the notice and the R17 or R06 return.
Keeps each program rule's outcomes, proposes threshold changes replayed over 90 days, and drafts the annual review and the board report.
Builds export packs for examiners, the Nacha audit, internal audit and the BSA Officer, redacted and fingerprinted.
Checks what the specialist prepared. The agents propose; a named person decides.
The specialist can ask about the entry in front of her, a partner or the rules. Each answer cites the record, the reply or the rule it rests on, and opens the screen it talks about.
Why is the Delmar Freight credit flagged?
Because the pay did not change but where it goes did. Delmar Freight has paid MARCUS T HOLLIS into his own account ••••2204 every other Friday since June 2019, last $3,412.66 on Oct 9. This credit, the same amount, goes to ••••8817, opened two days ago through Orrin Wallet from a device that opened two more accounts. Corvane National Bank confirmed at 8:41 a.m. that the change came by email from a look-alike domain.
Could this be a real change by the employee?
Unlikely. A real change would usually go to an account he already uses or one opened in his own app and device; this one was opened at 11:06 p.m. from a device that opened two more accounts in other names, and Corvane says Delmar Freight received the change from a look-alike domain. If he did change it, the return costs him nothing: Delmar is paying him Friday into ••••2204.
Why R17 and not R06?
Both are allowed here. R06 answers a request from the sending bank; Corvane did ask at 8:41 a.m. R17 with QUESTIONABLE says that Tessaly found it as the receiving bank and suspects false pretenses, which is what happened at 1:44 a.m. You can switch the code in the notice.
What do the Nacha rules ask of us, and since when?
As the bank that sends entries, risk-based monitoring for unauthorized and false-pretenses entries from Mar 20, 2026. As the bank that receives them, credit monitoring from Mar 20, 2026 too, because Tessaly received 17.4 million entries in 2023, over the 10 million threshold. Thirteen of the fourteen partners came in with Phase 2 on Jun 19, 2026. Both must be reviewed at least annually.
13 screens from the working solution, on its sample data. Pick one to see it large.
Every setting is the bank's own, versioned, made by one person and checked by another. The Nacha fraud monitoring rule dates and the network rules are locked.
| Setting | Default | Choose from |
|---|---|---|
| Hold suspect received credits under the funds availability exemption | On | On or off; a held credit is examined first |
| Hold automatically from a confidence of | 0.85 | 0.80, 0.85 or 0.90; below it the agents flag but do not hold |
| Escalate to the manager when the clock is under | 4 hours | 2, 4 or 6 hours for received credits; sent entries escalate 1 hour before their file |
| Standing rule FM-07: ask the other bank to confirm | On | Requests to confirm only, never a notice of a decision, to a registered fraud contact |
| Answer another bank's notice within | 1 business day | Same day, 1 business day or 2 business days |
| Call the contact when there is no reply after | 4 hours | 2, 4 or 8 hours; the call goes on the specialist's list |
| Assert a finding from a confidence of | 0.90 | 0.85, 0.90 or 0.95; between 0.75 and this the agent asks a question instead |
| Retention and redaction | 5 years · last four digits | Locked: the Bank Secrecy Act period; a full account number opens only on a named request with a reason |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (FBI IC3 business email compromise losses, reported by Nacha on April 24, 2025: $2.8 billion in 2024 and nearly $8.5 billion from 2022 to 2024) · Rules: Nacha Operating Rules on fraud monitoring by ODFIs, originators, third parties and RDFIs (Phase 1 March 20, 2026; Phase 2 June 19, 2026), False Pretenses and R17 (October 1, 2024), credits available by 9:00 a.m. on the settlement date (September 18, 2026); 31 CFR 1010.430 (record retention). Tessaly Community Bank, Corvane National Bank, its partners, businesses, accounts, routing and trace numbers, and the people named on this page are fictional: characters and sample data in the working solution.
ACH fraud monitoring is a bank's risk-based work to find ACH entries that are unauthorized or authorized under false pretenses, both in what it sends for its clients and partners and in the credits it receives. In ACH Fraud Monitoring, seven agents score both sides, link a mule account's money in and money out, ask the other bank and draft the return; a specialist prepares each decision and a manager who did not prepare it releases it.
Phase 1 took effect on March 20, 2026 for every bank that sends entries and for large receiving banks; Phase 2 followed on June 19, 2026 for every other receiving bank, originator and third party. Each must run risk-based processes reasonably intended to find unauthorized and false-pretenses entries, and review them at least once a year. The program screen keeps each rule with its version and outcomes, and drafts the annual review.
False pretenses covers payments induced by someone posing as an employee, a vendor or the customer, as when a payroll is redirected after a spoofed email. A receiving bank that suspects it can return the entry with R17 and QUESTIONABLE; R06 answers a return request from the sending bank. The Contact agent drafts either, and the specialist chooses.
Yes. The main screen puts the entries the bank sent as ODFI on the left and the credits it received as RDFI on the right, with the rule each flag answers between them. The Mirror agent joins entries on both sides that share an account, device or partner, so one decision can stop a diverted credit and the cash-out waiting behind it.
Yes. Each partner shows its rule phase, volumes, flags and what it attests it monitors next to what the bank tested. Per-partner thresholds are replayed over 30 days before they change, and an originator restriction is prepared by the partner risk manager and applied by the ACH operations manager.
People decide. The agents score, link, ask, draft and propose, but never release, return, cancel, restrict, change a rule or sign. Every return, hold, restriction and notice is prepared by one person and released by another, and an override needs a reason code.
A referral is marked Confidential and never appears on a customer view, a customer message, a notice to another bank or any export pack but the BSA Officer's. Before signing, the specialist previews exactly what each customer will see.
The Agentic Solution Engine builds and deploys it from your requirements and documents: your program rules, reason codes, partner list and the systems you already run. It goes live once every quality gate has passed.
Alerts from every engine in one case, each memo sentence tied to its source.
1-min demoCheck Fraud DetectionBad checks stopped before the money leaves; good deposits released the same day.
1-min demoNew Account Fraud DetectionBad accounts restricted before the first big deposit clears, with partners told on time.
1-min demoWe'll run ACH Fraud Monitoring on a sample of your own sent and received entries and your program rules.