ACH Fraud Prevention for Merchants That Accept ACH

Short answer: ACH fraud prevention for a merchant means making sure the person authorizing a bank debit really owns that account, and catching the debits that come back as unauthorized before they pile up. The controls that matter most are account validation before the first debit (Nacha requires it for online consumer debits), an ownership match between the buyer and the bank account, a funds check on large orders, holding goods until first debits clear, and a weekly look at your unauthorized return rate against Nacha's 0.5% level. An unauthorized consumer debit can come back for up to 60 calendar days, and you cannot argue it through the ACH network.

This guide is for businesses that accept ACH debits, such as online stores, membership sites and B2B sellers. It is not about protecting your own business bank account from being drained, which is a question for your bank.

Which ACH fraud are you facing?#

The last row is not fraud, but it is the most common return and it can hide the fraud inside your numbers. Our ACH return codes guide covers every code; here we only need the unauthorized ones.

The unauthorized return codes, in one place#

Nacha's guide to calculating the unauthorized return rate lists six codes: R05, R07, R10, R11, R29 and R51. The two you will see most as an online seller:

• R10. Nacha's definition: "Customer Advises Originator is Not Known to Receiver and/or Originator is Not Authorized by Receiver to Debit Receiver's Account." This is the consumer account version.
• R29. "Corporate Customer Advises Not Authorized", the business account version. Modern Treasury notes the receiving bank must return it within 2 banking days.

Two neighbours are worth knowing:

• R11. "Customer Advises Entry Not in Accordance with the Terms of the Authorization", for example the wrong amount or a debit on the wrong date. Nacha repurposed it on 1 April 2020 and it counts toward the unauthorized rate.
• R07. Plaid's docs describe it as "customer advises authorization to debit account was revoked."

What makes these codes expensive is timing. Plaid's docs say most returns must arrive within 2 banking days of settlement, but consumer unauthorized returns such as R10 and R11 have a 60 calendar day window. Stripe's docs put it this way for consumer accounts: disputes received within the window "are final and can't be contested through the ACH network." And Plaid says "you cannot resubmit a payment after encountering an R10 error."

So a bank payment that looked complete on day 3 can still be lost on day 59, and there is no evidence process to win it back. That is the core difference from card chargebacks, covered in our chargeback protection guide.

How ACH fraud actually happens to a merchant#

Unauthorized debits from typed account numbers#

If your checkout lets a shopper type a routing and account number, anyone holding someone else's numbers can pay with them. The numbers are printed on every paper check. Nothing in the ACH network checks that the person at your checkout is the account holder. The debit often succeeds, the goods ship, and the R10 arrives weeks later.

Account takeover#

Here the criminal uses a real person's access instead of just their numbers. Two versions matter for a store:

• Bank login takeover. If the criminal has the victim's online banking login, they can link the account through an instant bank login flow just as the owner would. Instant verification proves the account is open and reachable. It does not prove the person in front of your checkout is the owner.
• Store account takeover. If your store saves bank accounts for repeat orders, a criminal who gets into a customer's store account can order with the saved account. Watch for changes of email, password or shipping address followed by a large order.

Synthetic identities#

The Federal Reserve's industry-recommended definition of synthetic identity fraud is "the use of a combination of personally identifiable information (PII) to fabricate a person or entity" to commit a dishonest act for personal or financial gain. At your checkout this looks like a customer whose name, email, phone and address belong to no single real person. Synthetic identities matter most for B2B accounts, invoices on terms, rentals and anything you deliver before the money is final.

False Pretenses and first-party disputes#

Since 1 October 2024, the Nacha Operating Rules define False Pretenses as "the inducement of a payment by a Person misrepresenting (a) that Person's identity", or their authority to act for someone else, or ownership of the account being credited. Nacha says it covers business email compromise and vendor and payroll impersonation, but not scams involving fake or poor-quality goods. It is mainly a credit-side concept, but the 2026 monitoring rules use it, so it belongs in your written process.

The opposite case is the real account owner who authorized the debit and later claims they did not. You cannot fight that through the network, so the defence is clear authorization wording, a recognizable statement descriptor, and receipts.

What Nacha already requires#

Two Nacha rules set the floor. Our existing guides explain them in detail, so here is only what you need to act:

• WEB debit account validation (in force since 19 March 2021). For online consumer debits, your fraud detection system must "at a minimum, validate the account to be debited", before the first use of an account number and when it changes. Nacha lists accepted methods such as prenotes, micro-entries, API account validation and commercial validation services. Ownership checks are not required by this rule. See bank account verification for WordPress.
• Fraud monitoring, Phase 2 (19 June 2026, in practice 22 June 2026). All other non-consumer Originators must have risk-based processes "reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses", reviewed at least yearly. Nacha says screening every entry and monitoring before processing are not required. See Nacha's 2026 fraud monitoring rule.

And one number to watch: the unauthorized return rate, with a 0.5% level, worked out over 60 days or two calendar months. See Nacha return rate thresholds for the formula and a worked example. Your processor may be stricter: Plaid's Transfer docs set Plaid's maximum unauthorized debit return rate at 0.4%.

ACH fraud controls that work, in order#

1. Validate every new account before the first debit#

This is required for online consumer debits and it stops typos and dead accounts. Instant bank login is the strongest form because the shopper proves they can sign in to the bank. Stripe's ACH docs give customers 10 days to confirm micro-deposits, and Nacha says you cannot treat silence on a micro-entry as success.

2. Match the account owner to the buyer#

Validation proves the account exists. An ownership match is what catches a stranger using someone else's account. Plaid's Identity Match compares the name, phone, email and address you supply with the details on the bank account and returns a score for each field; Plaid's docs suggest a threshold of 70 or higher per field. Treat a poor name match on a first order as a reason to hold, not to approve.

3. Check funds on large debits#

A balance check before a big debit avoids R01s and catches the empty mule account a fraudster has just opened. Plaid's Signal product goes further and estimates "the likelihood that a transaction will result in an ACH return", covering insufficient funds, closed or frozen accounts, administrative returns and consumer authorized returns. It covers US domestic ACH only.

4. Hold what you cannot take back#

ACH confirms slowly. Stripe's docs say ACH Direct Debit "can take up to 4 business days" to confirm success or failure. For first orders paid by bank, high-value orders and anything resold easily, wait for the debit to settle before you ship or grant access. That still leaves the 60-day unauthorized window, so combine the hold with steps 1 and 2.

5. Make authorization and descriptors impossible to miss#

Show authorization wording at checkout, send a copy of the authorization, and use a statement descriptor customers recognize. Stripe notes the descriptor is truncated to the first 16 characters on the bank statement. For recurring debits, Stripe says you must give customers at least 7 calendar days notice if you change the timing.

6. Stop the account after an unauthorized return#

Never retry an R10 or R29. Stop any recurring schedule for that customer, contact them, and collect a fresh authorization only if the debit turns out to be a misunderstanding. Stripe blocks a bank account from reuse if the customer disputes a later payment.

7. Watch the rate weekly, not monthly#

A rolling 60-day unauthorized rate tells you whether a problem is starting. Alert well before 0.5%, so you have time to tighten controls before your bank or processor calls.

8. Write it down#

Phase 2 asks for a risk-based process and an annual review. A one-page document that lists the controls above, who reviews returns, and what triggers a change is a reasonable start for a small store. Keep the monthly numbers with it.

Which setup fits your business?#

How ChargeWarden helps with ACH fraud#

ChargeWarden watches the bank payments that BankBridge takes through Plaid Transfer. It does not validate accounts itself or decide whether a debit goes ahead; BankBridge and Plaid do that part. What ChargeWarden adds, per its ACH and Nacha monitoring doc:

• Rolling 60-day return rates for the unauthorized family (R05, R07, R10, R11, R29, R51), the administrative family and all returns, compared with Nacha's 0.5%, 3.0% and 15.0% levels, with an email when a rate reaches your watch level (by default half of the level, so 0.25% for unauthorized) and again at your warning level.
• A record of how each account was validated when the debit was created, such as a bank login through Plaid or verified micro-deposits, and a flag on first-use WEB debits with no recorded validation.
• A monthly PDF and CSV report of volumes, return rates, returns by code, validation and checkout controls, with space to record who reviewed it. It supports your own process; it is not a certification and does not show compliance with the Nacha Operating Rules.
• An order risk rule that adds points when the Plaid Signal score BankBridge saves is above your threshold (default 70), so risky bank payments land in the review queue with the reason written out. See gateway risk data.

BankBridge itself can run Plaid Balance before a debit, Plaid Identity and Identity Match to compare the account owner with the buyer, and Plaid Signal for return risk. Plaid bills those products to your own Plaid account.

What it cannot see: debits sent by another processor, including BankBridge's processor-token mode with Stripe or Dwolla, and anything you originate outside your website. Your bank calculates the official rates from every entry you originate, so ask which 60-day method it uses. If you take ACH only through Stripe, Stripe's own Radar for ACH and dispute tools are the place to start.

You can see the ACH screen and the monthly report on the live demo. On our pricing page on 26 October 2026, ChargeWarden is $129 a month for a single store, $199 for 5 stores and $349 for unlimited stores, billed monthly, with a 14-day store credit return. Pick a plan.

This guide is general information, not legal or financial advice. Rules, return windows and prices come from the providers' and Nacha's public pages on 26 October 2026 and change over time; ask your bank how the rules apply to you. Nacha, Plaid, Stripe and other names are trademarks of their owners. PluginLoom is not affiliated with or endorsed by any of them.