Nacha Fraud Monitoring Rule 2026: What Online Stores Must Do

Nacha's fraud monitoring rules now apply to every business that originates ACH debits. Phase 1 took effect on 20 March 2026 for the largest originators; Phase 2 took effect on 19 June 2026 (in practice Monday 22 June 2026) for everyone else, including online stores that take bank payments. Each must have risk-based processes to spot unauthorized or false-pretenses payments and review them at least once a year. This guide explains who is covered, what the rule asks for and what records help. It is general information, not legal advice.

What changed in 2026?#

Before 2026, Nacha's rules only required Originators to use "a commercially reasonable fraudulent transaction detection system" for WEB debits (online consumer debits) and Micro-Entries. The 2026 rules widen this to every ACH entry an Originator sends, in two phases (Nacha, Phase 1 (opens in a new tab), Phase 2 (opens in a new tab), both checked 24 October 2026).

Two notes on Phase 1. Nacha's FAQ words the threshold as volume that "exceeded 6 million entries", while the rule page says "6 million or greater"; and the volume is all ACH origination, not WEB debits only.

Does it apply to my store?#

If your business pulls money from customers' bank accounts by ACH, through Plaid Transfer, a processor such as Stripe or Dwolla, or your own bank, you are an Originator. Unless you are a consumer, you are a non-consumer Originator, and Phase 2 covers you from June 2026. A store sending fewer than 6 million entries a year was not in Phase 1.

What does the rule actually require?#

From Nacha's FAQ, covered parties must:

"establish and implement risk-based processes and procedures, relevant to the role it plays in the authorization or Transmission of Entries, that are reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses; and review (at least annually) these processes and procedures and make appropriate updates to address evolving risks."

Three points from the same pages matter for small businesses:

• Risk-based. Nacha removed "commercially reasonable" and "detection system" from the final rule and replaced them with "processes and procedures". It does not prescribe a tool.
• Not pre-processing. Nacha clarifies that monitoring is not required before an entry is processed.
• False Pretenses means a payment induced by someone misrepresenting their identity, their authority to act for someone else, or the ownership of an account to be credited. Nacha says it does not cover scams about fake or poor-quality goods.

What does a reasonable process look like for an online store?#

There is no single answer; your bank's expectations matter. Most store processes cover four things:

How does WEB debit account validation fit in?#

Nacha's WEB debit rule, in force since 19 March 2021, says the fraud detection system for online consumer debits "must, at a minimum, validate the account to be debited" on its first use and when the account number changes (Nacha (opens in a new tab)). Validation means the account is "a legitimate, open account to which ACH entries may be posted"; ownership checks are not required by the minimum standard. Accepted methods include prenotes, micro-transactions, validation services and API-based tools such as bank login through Plaid.

Which numbers should I watch?#

Your return rates. Nacha's levels for an Originator's debits, measured over the preceding 60 days or two calendar months (Nacha (opens in a new tab), calculation guide (opens in a new tab)):

Rising unauthorized returns are the clearest sign your process is missing fraud. See our guide to Nacha return rate thresholds.

What evidence should I keep?#

Keep enough to show your bank what you do and that you review it:

1. A short written description of your process and who owns it.
2. Monthly return rates by family, with the return codes.
3. A record of how each WEB debit account was validated.
4. The checkout controls in place and what they stopped.
5. The date and outcome of your yearly review.

How ChargeWarden helps#

For stores taking ACH payments with BankBridge, ChargeWarden tracks rolling 60-day return rates by family with alerts, records how each WEB debit account was validated through Plaid when the debit was created, and produces a monthly PDF and CSV evidence report with space for your review. It supports your own risk-based process; it is not a certification, and your bank calculates official figures. See ACH and Nacha monitoring.

Sources#

Checked October 24, 2026.

• Nacha: Fraud Monitoring Phase 1 (opens in a new tab)
• Nacha: Fraud Monitoring Phase 2 (opens in a new tab)
• Nacha: Supplementing Fraud Detection Standards for WEB Debits (opens in a new tab)
• Nacha: ACH Network Risk and Enforcement Topics (opens in a new tab)
• Nacha: How to calculate the unauthorized return rate (opens in a new tab)

This guide is general information, not legal or financial advice.