Sending bank-to-bank transfer is easy with same day ACH payment. However, as is the case with all financial transactions, there are inherent risks.
Additionally, most payment requests using ACH are submitted online, and these could make the ACH transaction subject to more malicious attackers and fraud.
All payments sent electronically come with some risk. In order to mitigate this risk, this article will provide you with an overview of:
- ACH payment processing
- Common risks of ACH payments
- How to prevent fraud on ACH systems
- How to prevent hacking risks on ACH systems
- Safety and security best practices for ACH
ACH Payment Processing
An ACH transfer is a payment that moves from one bank account to another. This transfer must go through the Automated Clearing House (ACH) Network in the U.S. The ACH Network is made up of ACH Operators, such as the Clearing House, the Federal Reserve, financial institutions, and the Operators and Receivers who submit and receive the ACH transaction request (us!).
In order to provide ACH processing within the ACH network, and to send and receive bank-to-bank transfers, a bank or financial institution needs to be approved by NACHA, the National Automated Clearing House Association, to be a Receiving Depository Financial Institution (RDFI) and/or an Originating Depository Financial Institution (ODFI).
In order to process an ACH payment, the ODFI will need to have an account with the bank or financial institution that the transaction will be sent from.
They will then need the following information in order to make the transaction request:
- The bank account number of the person receiving the funds
- The bank name or financial institution that the bank account resides under
- The routing number
- And the name associated with the account
As you can see, every payment using the ACH Network requires the bank or credit union to process sensitive financial information. Therefore, there are risks associated with processing a payment of this sort. Customers and financial institutions should be wary of fraud and should always abide by the NACHA guidelines to mitigate ACH risk.
Common Risks of ACH Payments
Payments using the ACH Network can fall victim to ACH fraud, even when the financial institution follows all of the NACHA guidelines. Protecting against ACH fraud can be difficult to do.
In order to better understand the risk associated with ACH fraud, the common risks have been organized as five categories: credit risk, debit risk, operational risk, fraud risk, and systemic risk.
ACH Credit Risk
ACH credit risk arises with an ACH credit and when one party fails to make a payment that is required to settle under the ACH credit contract. This might occur when a company suffers large financial losses such as going bankrupt.
Usually, the bank will take the greatest fall for payment failure, especially if they do not allow for NACHA recommended procedures and use risky practices when processing same-day ACH transfers.
ACH Debit Risk
ACH debit risk is a common way that scammers manipulate the ACH debit system. Malicious attackers obtain account details, such as the bank account number and routing number, and are then able to complete an unauthorized debit from this account.
In this case, most banks will support the owner of the bank account that falls victim to ACH fraud.
However, not all financial institutions can provide this service, and there may be exceptions that apply. Scammers will gain the misappropriated funds and the bank’s reputation will be tarnished.
ACH Operational Risk
Electronic and clerical errors that are made can present an ACH risk. These can include computer network failures, telecommunication failures, power failures, hard and software failures, natural disasters, staffing issues, and other security system failures.
These risks might include data loss, data alteration, and data duplication.
ACH Fraud Risk
Fraud risks can occur when the employees of ACH Operators alter data in a customer account and embezzle funds.
Since employees typically have access to customer accounts, they may be able to illegally obtain protected data, terminals, or files and use them to misappropriate funds.
ACH Systemic Risk
Systemic ACH risk usually occurs when transactions are made with higher dollar and higher capital. Systemic ACH risk is similar to ACH credit risks but with a series or frequency of transactions.
For example, a customer may fail to settle an account, and then this causes over parties or an entire system to not settle. Fraud and human error are typical for this kind of risk, but bankruptcy and financial difficulty can also contribute to systemic ACH risk.
How to Prevent Fraud on ACH Systems
It is up to the bank to set up security measures to protect their accounts and customers against fraud on ACH systems.
Putting in security measures will add an extra line of defense so that sensitive financial data is not subject to ACH fraud. Rely on these three best practices to secure the payment against data fraud:
Encryption: This involves the ciphering and deciphering of data by passing the characters through an algorithm locked with a key. Another algorithm and the same key unlocks the data so that anyone with key access can decipher the ciphered text. Encryption can also come through cryptocurrency transfers.
Authentication: This involves the verification of the identity of the receiver of the ACH transfer in congruence with account verification. A risk-based approach to authentification allows organizations to take into account the type of transaction, the type of customer, and the stakeholders involved.
Authorization: This is when the originator and the receiver enter into an agreement that allows the Originator to initiate a debit entry to the receiver’s bank account. This is essential because the Receiver is granting access to the bank account and the Receiver needs to be able to prove that they trust the other party.
How to Prevent Hacking Risks on ACH Systems
ACH processing is usually initiated and performed through online payment methods. This presents an inherent and elevated risk for malicious attackers to compromise ACH transactions. Current ACH users are threatened by cyberattacks, email phishing, account takeovers, vendor impersonation, and much more.
To protect ACH systems against hacking risk, consider the following:
- Store data on PCI approved hardware and software
- Use only NACHA approved service providers, those who undergo extensive testing (done through a QSA, see below) and is marked as a PCI DSS Validated Entity
- Do not store card security number or electronic track data
- Encrypt the electronic storage of all credit card and debit card account information and cardholder data
- Encrypt phone recordings containing sensitive account information
Providing the secure storage of both sensitive financial information and electronic payment data is crucial for the success of a bank, credit union, or TPPP to authorize ACH Network payment processing.
Safety and Security Best Practices for ACH
Since targeted ACH fraud attacks can be so devastating, financial institutions typically set up protective measures around unauthorized ACH transaction requests. These are the two most common safety measures that could protect an account from ACH fraud:
ACH Debit Block: A service that auto-returns ACH debits and/or credits directed at a specific bank account.
ACH Debit Filter: A service that auto-returns all ACH items for a designated account unless the ACH item was pre-authorized.
To mitigate an attack on an ACH transaction or a payment fraud, NACHA-approved financial institutions will need to continually improve their financial cybersecurity literacy.
Consider the following security best practices for improving cybersecurity literacy:
- Be FDIC insured.
- Use NACHA’s third-party risk management resources, such as registration for Third-Party Senders, Direct Access registration, Terminated Originator Database, and the Financial Institution Contact Database.
- Audit your institution’s cybersecurity model. There should be multiple lines of defense set up so that your cyber risk exposure is distributed.
- Allot an appropriate amount of funding to cybersecurity.
- Seek an appropriate NIST maturity level, which focuses on identifying cybersecurity procedures, protecting sensitive data, detecting anomalies, responding and mitigating attacks, and recovering after an attack.
- Perform an ACH risk assessment to determine the specific risks associated with completing an ACH transaction. The higher risks are typically associated with same day ACH and payment made electronically. While an ACH audit is done by a NACHA representative every two years, internal audits need to be completed to maintain compliance.
- Test for return codes and proper authorization procedures is a requirement for being approved.
It is also important that customers are educated about the best practices to protect against ACH fraud. Customers should be encouraged to:
- Never share their account information over the internet unless the server is verified to be secure and/or encrypted
- Carefully consider how VOID checks are sent out as if sending electronically, they should be sent as an encrypted PDF or password-protected file, or sent by fax or mail
- Avoid clicking on phishing emails
- Set up two-factor authentication when sending on to online banking
To operate as an ODFI or RDFI on the ACH network, the bank must ensure that they are always compliant under NACHA guidelines. Therefore, it is in the best interest of the financial institution to protect customers against all measures of ACH risk.
ACH API for Fraud Protection
While ACH fraud is unavoidable, it is up to the financial institution, bank, or credit union to set up security measures so that fraud is at least minimized or mitigated.
Banking apps can also add protective measures since many apps are built using secure APIs and encryption. They can also be integrated with digital wallets so that online payment processing is smoother.
Serious concerns about ACH fraud could significantly impact your day-to-day banking. One company that seeks to mitigate ACH fraud and other security risks is Sila.
Sila’s API is an ACH API that can send NACHA’s approved ACH transfers through cryptocurrency, which is considered to be the most secure currency globally. Cryptocurrency can also provide customers with smart contracts, which means that the contract under a smart contract ensures compliance through blockchain technology.