An ACH fraud filter is a service a bank offers its business customers that rejects ACH debits to their accounts unless the debiting company is on a list the customer approved, identified by its ACH company ID; an ACH debit block rejects all of them. Both stop unknown companies pulling money out. Neither sees fraud that pushes money: a business tricked into paying a fraudster, a hijacked online banking session sending credits, a payroll diverted to a new account, or a customer's account used to receive stolen funds. Those are what Nacha's 2026 fraud monitoring rules require banks themselves to watch for, on the entries they send and the credits they receive. Botminds' ACH Fraud Monitoring does that bank-side monitoring, and works beside the filters and positive pay a bank already sells; it does not replace them.
The screens show a fictional sample bank, Tessaly Community Bank. Descriptions of debit blocks and filters come from government payment instructions, which explain them to the businesses that must work around them.
What a client's ACH fraud filter sees, and what the bank's own fraud monitoring sees, case by case
An unknown company debits a business account
Client's ACH filterStops itBlocked: the company ID is not on the allowed list
Bank's fraud monitoringPartlyNot the RDFI's credit duty; the debiting company's bank watches its return rates
An allowed company debits too much, or twice
Client's ACH filterPartlyPasses, unless the bank's filter also checks an amount or the client reviews it
Bank's fraud monitoringPartlyUnauthorized returns follow; the debiting company's bank sees its rate rise
The client is tricked into sending a credit to a fraudster
Client's ACH filterMisses itCannot see it: the client sent the payment itself
Bank's fraud monitoringCan flag itThe client's bank, as ODFI, flags a payment to new or recently changed bank details
A fraudster takes over the client's online banking and sends credits
Client's ACH filterMisses itCannot see it: credits leaving the account are not debits
Bank's fraud monitoringCan flag itThe ODFI flags a new device, a new payee, a reset token or an unusual Same Day amount
An employee's pay is diverted to a new account at another bank
Client's ACH filterMisses itCannot see it: neither the employer's nor the employee's filter is involved
Bank's fraud monitoringCan flag itThe receiving bank flags PAYROLL into a new account; the employer's bank flags the changed account
A customer's account is used as a mule, receiving stolen credits
Client's ACH filterMisses itCannot see it: filters screen debits, and the mule welcomes the credits
Bank's fraud monitoringCan flag itThe RDFI flags several credits from different payers into a new or dormant account
What is an ACH fraud filter?
It is a rule the bank applies to incoming ACH debits on a customer's account, letting through only those from companies the customer has approved. The names vary by bank. A federal agency's instructions to the organizations that pay it explain that automatic debits to a business account "may be blocked by the bank through a security feature called an ACH Debit Block, ACH Positive Pay, or ACH Fraud Prevention Filters", and that to let a payment through, "an organization must provide a list of allowed ACH Company IDs to enable automatic debits from authorized companies" (HHS, Centers for Medicare & Medicaid Services, VMPC FAQ).
State tax departments describe the purpose plainly. New York's says "Debit blocks protect your bank accounts from unauthorized electronic charges" and, once the customer has authorized the state's company ID, "Your bank will process only these authorized transactions" (New York State Department of Taxation and Finance). Virginia's calls a block protection "from unauthorized electronic access" (Virginia Tax).
What is the difference between ACH block and ACH filter?
A block refuses every ACH debit to the account; a filter refuses all but the debits from approved company IDs, and sometimes only those within approved amounts. HHS lists ACH positive pay alongside blocks and filters; as commonly offered, it adds a review step, presenting debits that do not match the customer's rules for the customer to pay or return rather than refusing them outright.
Debit block, debit filter and ACH positive pay: the same aim, three levels of control
Debit block or filter: A block: every debit refused. A filter: the debiting company's ACH company ID, sometimes an amount limit
ACH positive pay: The customer's rules, with exceptions shown to the customer for a decision
Debit block or filter: Nobody in the moment: an unlisted debit is returned
ACH positive pay: The customer, usually by a cut-off time the same day
Debit block or filter: A legitimate debit is rejected; New York warns the bank "may reject the payment" and the state may bill penalty and interest
ACH positive pay: A missed review deadline lets the bank's default decision apply
Debit block or filter: Company IDs change; Virginia added one and told filers to add it "to avoid your bank rejecting your payment"
ACH positive pay: Rules and approved payees kept current by the customer
Debit block or filter: Credits: payments the customer sends, and money arriving
ACH positive pay: Mostly the same: it reviews debits, though some banks offer positive pay on credits too
The difference matters to the bank as well as the client. A block is cheap and blunt; a filter needs the client to keep company IDs current; positive pay needs someone at the client to look every day. Each is a treasury management product offered to the business, and the business runs it. Positive pay exceptions are their own piece of work, handled by Botminds' solution for that desk.
What ACH fraud do filters miss?
Every fraud that moves money by credit, which is now most of the fraud banks report growing. A filter guards one direction, debits pulled into a customer's account, so it is blind to payments the customer pushes out and to money arriving. In the Federal Reserve's 2026 risk officer survey, the fastest-growing ACH fraud was account holder scams, reported increasing by 41% of institutions, and business email compromise by 19% (Federal Reserve Financial Services, 2026; not independent academic research, margin of error ±6%). Both end in the customer sending money itself.
Filters also miss debit fraud that wears an approved ID. A fraudster who debits through a company the client already allows, or who changes an approved vendor's bank details so that the client's own payment goes astray, passes the filter. The OCC warned years ago that "transactions are sometimes coded incorrectly to mask fraud" and told banks to verify the use of SEC codes, not to trust the label on the entry (OCC Bulletin 2006-39).
Can an ACH filter stop credit fraud?
No. A credit-push fraud succeeds when the account holder, deceived, sends the payment, or when a fraudster with stolen credentials sends it from the account; either way the entry is a credit leaving the account, and a debit filter does not look at it. The FBI's 2025 report describes account takeover cases in which fifty or more ACH payments go out at once to accounts at many banks (FBI IC3, 2025): every one is a credit the victim's filter lets pass, because it was never built to look.
What stops credit fraud is monitoring on both banks. The sending bank can see a new payee, a changed account, a new device or an unusual amount before its file releases. The receiving bank can see the money landing in an account that should not be receiving it. Nacha's 2026 rules require exactly those two views.
The day in ACH Fraud Monitoring: sent entries on one side, received credits on the other
Does ACH positive pay stop fraud?
It stops much of the debit fraud it is set up for, and institutions rate it. Respondents to the Federal Reserve's 2026 survey listed "ACH Positive Pay with name verification controls" first among their solutions to ACH fraud losses (Federal Reserve Financial Services, 2026), and Nacha's advisory group, describing a scheme in which fraudsters impersonate both bank and client to reset a security token, told banks to "Encourage Positive Pay for debits and credits" (RMAG, January 2025).
The same advisory group was careful about what that scheme is for: its goal "is to defeat controls imposed by a financial institution to prevent corporate account takeover". Positive pay helps the client catch what it did not expect. It does not help when the client, or someone wearing the client's credentials, sent the payment on purpose. That remains the bank's monitoring to catch.
Do ACH filters meet the Nacha monitoring rule?
No, because the rule is the bank's, not the client's. Nacha's 2026 rules put the monitoring duty on ODFIs, RDFIs, non-consumer originators and third parties, each for its own role (Nacha, Phase 2 FAQ). A filter is a service the bank sells; offering it does not identify the entries the bank sends or receives that are suspected of being unauthorized or authorized under false pretenses.
There is one place filters and the rule meet. For debits a bank originates, Nacha accepts strong return and return-rate monitoring as the minimum fraud monitoring, and a client's filter returning an unknown debit feeds the debiting company's bank exactly that return signal. The filter helps another bank meet its rule; it does not meet the filtering bank's own. Return-rate monitoring itself, and originator underwriting, belong to ACH originator risk assessment.
Who owns which ACH control, and what each one is for
| Control | Whose decision | What it protects | Required by the 2026 Nacha rules? |
|---|---|---|---|
| Debit block or filter | The business customer, with its bank | The customer's account against unknown debits | No; a product the bank may offer |
| ACH positive pay | The business customer, reviewing exceptions | The customer's account against unexpected debits, sometimes credits | No; a product the bank may offer |
| Consumer stop payment | The consumer, by notice to the bank | A consumer account against a preauthorized debit | No; a right under Regulation E |
| ODFI fraud monitoring | The bank that sends the entry | Its clients against credits induced by fraud, and the network against bad entries | Yes, since March 20, 2026 |
| RDFI credit monitoring | The bank that receives the credit | Victims elsewhere, by stopping its own accounts being used to receive stolen money | Yes, for all RDFIs since June 22, 2026 |
Who sets up an ACH debit filter?
The business customer, through its bank's treasury management service. The customer decides which company IDs to allow and tells the bank; the government instructions quoted here all start there. New York tells businesses "you must communicate with your bank to authorize these payments", and HHS tells them to give the bank its agency location code so the debit is allowed (HHS).
Consumers have a different tool. Regulation E lets a consumer "stop payment of a preauthorized electronic fund transfer from the consumer's account by notifying the financial institution orally or in writing at least three business days before the scheduled date of the transfer" (12 CFR 1005.10(c)). It is a right over one known debit, not a filter, and like a filter it does nothing about money the consumer sends.
Filter, monitoring or both: how to choose
Both, because they answer different questions: a filter decides which debits a client accepts; monitoring decides which entries the bank should stop, hold or question. For a bank weighing what to buy, the choice is not between them but about where its own obligation and its clients' losses sit.
For a bank deciding what to offer clients and what to run itself
- Offer filters and positive pay to business clients
They stop unknown debits cheaply, and Federal Reserve survey respondents rank positive pay with name checks among their best ACH controls.
- Do not count them toward the Nacha rule
The monitoring duty is the bank's, on the entries it sends and receives, and a client product does not discharge it.
- Monitor sent credits before each file releases
New payees, changed bank details, new devices and unusual Same Day amounts are where business clients lose money.
- Monitor received credits before funds fall due
Payroll into new accounts, business credits into personal ones and several payers into one new account are where the bank's accounts are used.
- Join the two sides
A diverted credit and the cash-out behind it often sit in the same bank; seen together, one decision stops both.
- Measure each control by what it catches
Filters by debits returned and complaints; monitoring by flags confirmed and frauds missed, reviewed at least annually.
The work queue in ACH Fraud Monitoring across both sides, with the rule each flag answers
Payroll diversion is the clearest case of a fraud no filter touches, and the 2026 rules set out the duty filters do not meet. For buyers comparing tools, the software guide lists the questions to ask. To see both sides of a bank's own files on one screen, start from ACH Fraud Monitoring.
Questions people ask
Why was my payment rejected because of an ACH debit block?
Because the payer's bank was told to refuse debits from companies not on the account's approved list, and the debiting company's ID was not on it. Government payees tell businesses to give their bank the payee's ACH company ID; Virginia warned filers that a newly added ID had to be added to avoid rejected payments.
Does an ACH filter protect against business email compromise?
No. In business email compromise the business itself sends the payment, as a credit, to an account the fraudster controls. A filter screens debits coming into the account. Callbacks on changed payment details, and the bank's monitoring of credits it sends, are the controls that apply.
Can consumers get an ACH debit filter?
Filters are generally a business banking product. Consumers have a legal right under Regulation E to stop a preauthorized debit with notice at least three business days before it is scheduled, and to dispute an unauthorized debit.
Is ACH positive pay the same as check positive pay?
No. Check positive pay matches presented checks against the issuer's list of checks written; ACH positive pay reviews incoming ACH debits, and sometimes credits, against the customer's rules. Both send exceptions to the customer for a decision.
Should a bank still offer debit blocks now that it must monitor?
Yes. They protect clients from a fraud the bank's own monitoring sees only partly, unknown companies debiting a client's account, and they cost little. The monitoring covers what they cannot see.