Nacha false pretenses is the term the Nacha Operating Rules have used since October 1, 2024 for an ACH payment that the sender really did authorize, but only because someone lied about who they were, whom they acted for, or who owned the account to be paid. It covers business email compromise, vendor impersonation and payroll impersonation; it does not cover scams over fake or poor goods, or a payment to the right person induced by some other lie. The line matters because it decides which credits a bank must look for under the 2026 fraud monitoring rules, and when a receiving bank may hold funds or return an entry as fraud. Botminds' ACH Fraud Monitoring labels each flagged credit by the part of the definition it meets, so the specialist deciding a hold or a return can see the reason in Nacha's own terms.
Worked examples here come from a fictional sample bank as it runs through the solution; definitions and examples are quoted from Nacha's free rule pages, linked where they appear.
Nacha false pretenses: covered, and not covered, with Nacha's own examples
Not false pretenses: The seller lies about the goods or services
False pretenses: Someone lies about their identity, their authority to act for another, or who owns the receiving account
Not false pretenses: —
False pretenses: A fraudster poses as a CEO or CFO to induce someone with authority to send a payment
Not false pretenses: A real vendor delivers the wrong quantity or poor quality; a dispute between the parties
False pretenses: A fraudster claims to be a vendor the business pays and asks for payment to the fraudster's account
Not false pretenses: —
False pretenses: A fraudster claims to be an employee and asks for pay to the fraudster's account, or gets into the payroll system and redirects payroll
Not false pretenses: —
False pretenses: A fraudster claims to be a settlement agent or attorney and asks for funds to be transferred
Not false pretenses: —
False pretenses: A fraudster claims to be the IRS demanding overdue tax, or the customer's own bank telling it to move funds to a new account
Not false pretenses: A real charity receives a gift and spends it on something else
False pretenses: —
Not false pretenses: An "unauthorized credit": the fraudster sent it from the account, the owner never authorized it
False pretenses: —
What is false pretenses in the Nacha rules?
It is a defined term with three parts. Nacha's rule pages quote it in full.
the inducement of a payment by a Person misrepresenting (a) that Person's identity, (b) that Person's association with or authority to act on behalf of another Person, or (c) the ownership of an account to be credited.
Nacha Operating Rules definition of False Pretenses, as quoted on Nacha's rule pages
Each part names a lie about a person or an account, never about a product or a promise. Part (a) is the impostor who claims to be someone else; part (b) is the one who claims to speak for someone else, such as an executive or a supplier; part (c) is the one who claims an account is theirs, or the payee's, when it is not. Nacha adds that the definition "covers common fraud scenarios such as Business Email Compromise (BEC), vendor impersonation, payroll impersonation, and other payee impersonations" and "does not cover scams involving fake, non-existent or poor-quality goods or services" (Nacha).
The term appears in two places that matter to banks. Since October 1, 2024 it has defined a ground for a receiving bank to delay funds availability and a recognized use of the R17 return code. Since 2026 it has defined what every ODFI, RDFI and non-consumer originator must monitor for, alongside unauthorized entries (Nacha, Fraud Monitoring Phase 2).
What is the difference between unauthorized and false pretenses?
Who pressed send. An unauthorized credit is one the account holder never authorized; Nacha's example is account takeover, where a "Fraudster gains access to the credentials necessary to initiate a transaction and initiates a credit entry from the accessed account". A false pretenses credit is one the account holder did authorize, because it was deceived. Nacha is explicit that the two are separate: false pretenses "complements language on 'unauthorized credits' (i.e., account takeover scenario), but entries made under False Pretenses are not 'unauthorized'" (Nacha FAQ).
The difference has consequences. Unauthorized-entry rules were built around a customer's claim; Nacha notes that "Unauthorized reasons are based on a customer contact, dispute or claim". A business tricked into paying a fraudster cannot say the payment was unauthorized, because it was not. Before October 2024 the rules had no defined return reason for a receiving bank that spotted such a fraud itself; Nacha's guidance had pointed to R17 as the closest code, and the definition gave that use a name.
The Federal Reserve's own scam taxonomy draws the same line from the other direction. Its ScamClassifier model sorts scams by whether the payment was authorized, defining an authorized payment as one "entered or requested by a legitimate" account owner or user (Federal Reserve, ScamClassifier model). On our reading, most of that model's impostor scam types would be false pretenses in Nacha's terms; its merchandise scams would not.
Does false pretenses cover scams?
Some scams, not all. It covers the scams where the fraudster pretends to be someone: an executive, a vendor, an employee, a settlement agent, a government agency or the customer's own bank, all of which appear among Nacha's examples. It does not cover scams where the fraudster is who they say they are but lies about something else.
Two exclusions are written into Nacha's FAQ. Disputes "regarding the quality or condition of, or warranties or timing of delivery for, goods or services" are for the parties to settle, not the ACH Network. And a payment "made to the right person but induced on a fraudulent basis is not considered to have been made under False Pretenses"; Nacha's example is a donation to a charity that spends it on something other than what it promised. Investment frauds and romance scams therefore sit outside the definition unless the fraudster also lied about identity, authority or account ownership. The question for each case is what the lie was about.
Is BEC a false pretenses entry?
Yes, when it is paid by ACH. Business email compromise is the first scenario Nacha names, and its CEO and CFO example is the classic form: a fraudster "impersonates someone with the authority to order payment (e.g., a CEO/CFO via business email compromise) to induce someone with authority to originate a payment from the credit account to make a payment" (Nacha FAQ).
The scale is why the definition was needed. The FBI's Internet Crime Complaint Center recorded $3,046,598,558 in business email compromise losses in 2025 on 24,768 complaints (FBI IC3, 2025 Internet Crime Report), and counted $55,499,915,582 in exposed losses across 305,033 domestic and international incidents from October 2013 to December 2023 (FBI IC3, September 2024). Those figures cover every payment type, not ACH alone, and rest on reported complaints. The FBI describes BEC as a scam that targets people "who perform legitimate transfer-of-funds requests", which is exactly the kind of payment the definition was written for.
Each part of the definition, the lie it names, and what a receiving bank can actually see
| Part of the definition | Typical case | What the RDFI can see on its side | In ACH Fraud Monitoring |
|---|---|---|---|
| (a) Identity | An impostor poses as an employee to redirect pay | Pay for one person arriving in a new account; the same pay previously landing elsewhere | Pay history compared with the new account's age and device |
| (b) Association or authority | A fraudster poses as a CFO or a known vendor | A business payment into an account that never received from that payer; a corporate SEC code into a personal account | SEC code against account type; first credit from this originator |
| (c) Ownership of the account | A fraudster says a new account belongs to the vendor or the employee | A gross mismatch between the name on the entry and the account holder, once a flag has been raised | Name compared only on flagged entries, as Nacha's advisory group recommends |
The receiving bank never sees the email that started the fraud. What it sees is the effect of each kind of lie on an account it holds, which is why the 2026 rules trust it with a share of the monitoring. Payroll diversion, traced from the email to the credit, shows the identity case in full.
What return code is used for false pretenses?
R17, with the word QUESTIONABLE, when the receiving bank acts on its own; R06 when the sending bank asks. Nacha's October 2024 rule "will explicitly allow, but not require, an RDFI to use R17 to return an entry that it thinks is fraudulent", keeping "the current requirement to include the descriptor QUESTIONABLE in the return addenda record" (Nacha). The 2026 FAQ adds that an RDFI may return such an entry "using Return Reason Code R17 'QUESTIONABLE' or, at the ODFI's request, using Return Reason Code R06" (Nacha).
R17 carries no extra time. Nacha's FAQ says "The standard 2-day return period applies when using R17": the return must reach the ODFI by the opening of business on the second banking day after settlement. Unauthorized return codes do not fit, because a false pretenses entry was authorized.
A false pretenses return drafted in ACH Fraud Monitoring, with R17 and R06 side by side
Can an RDFI delay funds for false pretenses?
Yes, for a credit its monitoring has flagged, and it must tell the ODFI. Since October 1, 2024 Nacha's rules give RDFIs "an additional exemption from the funds availability requirements to include credit entries that the RDFI suspects are originated under false pretenses", alongside the existing one for credits suspected to be unauthorized (Nacha). Nacha lists as an impact that "RDFIs taking advantage of this exemption are required to contact the ODFI to inform them of the exemption".
Two limits apply. Regulation CC still governs: Nacha says so, and Regulation CC requires electronic payments to be available by the business day after the banking day of receipt (12 CFR 229.10(b)). And the exemption follows a flag, not a habit; an RDFI cannot use it simply because it has not yet looked at a credit. Early availability before settlement narrows the window further, which Nacha's guidance on early funds has warned RDFIs about since 2021 (Nacha, 2021).
When was false pretenses added to the Nacha rules?
On October 1, 2024, in the first part of Nacha's risk management package. That release defined the term, codified R17 for suspected fraud, expanded R06 to any reason, added the funds availability exemption, and changed two debit rules, on the timing of written statements and on prompt returns (Nacha). The fraud monitoring rules that use the term followed on March 20 and June 19, 2026.
The order is deliberate. Banks were given the vocabulary and the tools, a code to return with and a ground to hold on, before being required to look. The 2026 monitoring rules set out who must now look, and how a receiving bank does it is traced credit by credit.
How false pretenses shows up in a bank's numbers
False pretenses covers the impersonation schemes that institutions report growing fastest. The Federal Reserve's 2026 risk officer survey found 41% of institutions reporting ACH account holder scams increasing and 19% reporting more business email compromise (Federal Reserve Financial Services, 2026; not independent academic research, margin of error ±6%). The sample bank's 90 days show what that can look like in one bank's numbers.
Confirmed ACH fraud at the sample bank in 90 days, by type, with false pretenses on top
The split changes the work. Unauthorized debits come with a customer's statement and a return window; false pretenses credits come with no claim at all, only a pattern the bank must notice before the funds are spendable. A program that still measures itself mainly by unauthorized return rates is watching the smaller part of its fraud. To see how each flagged credit is classified on a bank's own files, start from ACH Fraud Monitoring.
The verdict in ACH Fraud Monitoring, in Nacha's terms: false pretenses, identity
Questions people ask
Is false pretenses the same as the crime of obtaining property by false pretenses?
No. The crime of that name is defined in criminal law, with its own elements. Nacha's term is a network-rule definition with three specific misrepresentations: identity, authority to act for another, and ownership of the account to be credited. A payment can fall under one without the other.
Is a romance scam payment false pretenses under Nacha rules?
Only if the fraudster lied about identity, authority or account ownership, which romance scammers often do by using a false identity. If the payee is who they claim to be and the lie is about their intentions, Nacha's rule that a payment "made to the right person but induced on a fraudulent basis" is not false pretenses applies.
Does a consumer get a refund because a payment was false pretenses?
Not because of the definition. Nacha's term gives banks grounds to hold and return entries; it does not create a consumer refund right. Consumer rights for electronic transfers come from Regulation E, which treats a transfer the consumer authorized differently from one a fraudster made.
Can an ODFI ask for a false pretenses credit back?
Yes. Since October 1, 2024 an ODFI may ask an RDFI to return an entry for any reason, using R06, and indemnifies the RDFI for complying. The RDFI may decline but must give its decision or the status within ten banking days.
How does a bank decide which part of the definition applies?
By what the evidence shows was misrepresented. A new account receiving one person's pay points to identity; a business payment to an account the payer never used points to authority or ownership. Recording the part, not just "fraud", makes the annual review and the return reason easier to defend.