Risk Management and Fraud Prevention
The risk framework
ODFIs manage ACH risk with credit and exposure limits set for each Originator and Third-Party Sender, periodic underwriting review, and daily monitoring of volume, dollar value, and return activity. Exposure is the maximum dollar amount outstanding before settlement - not the same as a credit line.
Nacha's return-rate thresholds
An ODFI must investigate an Originator whose activity exceeds:
- 15% overall return rate
- 0.5% unauthorized return rate (consumer debits)
- 3% administrative return rate (R02, R03, R04 and similar)
Persistent breaches can mean reduced limits or termination of origination.
Fraud typologies
Account takeover and phishing; business email compromise and vendor or payroll impersonation (credit-push fraud); debit-push fraud against a Receiver; first-party misuse where a consumer claims an authorized debit was unauthorized; and altered files at a service provider.
Controls the Rules require
- Commercially reasonable fraud detection for WEB debits.
- Account validation before the first use of a consumer account for a WEB debit.
- Micro-entry standards: entries of $1.00 or less used for validation must be identified as such and never used to move real payments.
- OFAC screening of Originators and Receivers, plus a same-day recall procedure for fraud.
Traps
Computing the unauthorized rate using all returns; assuming the Receiver's bank eats the loss on an authorized push payment; treating WEB fraud screening as optional.
Rule of thumb: returns are the early-warning system - read them by dollar value and reason code, not just count. Worked example: 2,000 debits with 60 returns, 12 of them R10 → 3% overall and 0.6% unauthorized, above the 0.5% threshold and actionable.