The Vendor Who Changed Banks by Email

No on both counts, and the distinction is the entire case.

Not unauthorized. "Unauthorized" in the ACH Rules and in Regulation E means the receiver, or the person whose account was debited, did not authorize the entry. Here Hartline authorized the credit; it was induced to authorize it by an impostor. That is a commercial fraud loss on the Originator. No R05 or R10 has any application, and the receiving bank has no basis to return a credit that was properly posted to the account its own customer controlled.

Reversal does not reach it either, in substance. Reversals correct specific origination errors - wrong amount, wrong account, duplicate - within a short window, and they only work if the RDFI can debit the receiving account. Two weeks later, with the balance withdrawn from an account opened by a fraudster, there is nothing to debit and the window has closed. The ACH network is a settlement system, not a recovery system.

Work several channels at once, and fast.

• Receiving bank: contact its fraud/BSA team directly - not the ACH operations queue - with the trace, amount, settlement date and the fraud narrative. Request an immediate hold on any remaining balance and a voluntary recall. This is a commercial courtesy, not a Rules remedy; the receiving bank has no obligation to debit its customer, but a newly opened account under fraud review often still has funds or a pending transfer.
• Law enforcement: file with the FBI's Internet Crime Complaint Center and locally, and give the receiving bank the case number. Banks move faster with a report in hand.
• The receiving bank's own obligations: a mule-type account is a BSA event; the RDFI should be evaluating a SAR, and the ODFI should assess its own reporting obligations if it is aware of the scheme.
• Other potential victims: the same actor is almost certainly running the same email against other payers of Landmark. Warn the real vendor and any shared counterparties.

Recovery odds are poor once the money leaves the account; the quality and speed of the receiving bank contact is what determines whether anything comes back.

Originator side. The change was authenticated against a number supplied by the request itself. A callback to the phone number in the signature block is not verification - it is a courtesy to the fraudster. The controls that would have stopped it: a callback to a number already in the vendor master, dual approval for any bank-detail change with an approver independent of the person who received the email, a hold period before the first payment to a changed account, and a name-match check between the payee name on the account and the vendor name in the master.

ODFI side. This should have surfaced in monitoring rather than in a phone call. A first-time payment to a brand-new account, for an amount large relative to the payee's history, made within days of a bank-detail change, is a textbook queue-for-review profile for payment monitoring. The ODFI also has its own obligation to know its Originator's business and risk profile, including whether Hartline's AP controls are adequate for the dollar volume it originates. An Originator risk assessment that never looked at vendor-change controls was the gap behind the gap.