ACH fraud risk is outpacing platform detection on payment rails

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Riskified's blog post: ACH is becoming a more attractive fraud rail because attackers can cash out through legitimate-looking account activity before platforms detect the loss.

Why it matters: Merchants using ACH need fraud controls that account for delayed settlement, bank-detail changes, and velocity patterns, not just card-style authorization logic.

Context

ACH payments create a governance gap when platforms treat them as a lower-risk alternative to card payments without matching controls to the rail's delayed confirmation and return process. Fraudsters can exploit that delay by using compromised bank access, recent account changes, and low-value transactions that look ordinary until funds have already moved.

The identity angle is operational rather than theoretical. A bank account, an IP address, and even a familiar session can all look legitimate while the underlying account access has been abused, which means payment risk now depends on identity-linked behavioural signals as much as transaction rules.

Key questions

Q: What breaks when ACH is treated like a safer payment rail?

A: The main failure is assuming slower settlement means lower fraud risk. In practice, ACH can give attackers more time to cash out because fulfilment may happen before returns or NSF signals arrive. Merchants need controls that evaluate account changes, settlement timing, and transaction sequences together, rather than relying on card-style authorisation logic.

Q: Why do recent bank-detail changes increase ACH fraud risk?

A: A recent bank-detail change can indicate that the funding account, or the access to it, has changed hands. That makes the transaction more likely to involve takeover or monetisation activity, especially when it appears shortly before checkout. Merchants should treat the change itself as a risk event, not just the transaction that follows it.

Technical breakdown

Why ACH abuse bypasses card-style detection

ACH lacks the immediate authorisation step that card payments use, so merchants often receive a weaker signal before fulfilment. That makes the payment rail vulnerable to delayed fraud discovery, especially when the account holder's bank later returns the transaction. The security issue is not simply payment type, but the mismatch between settlement timing and fulfilment timing. Fraudsters exploit that gap by using real accounts, plausible logins, and normal-looking activity patterns that fit consumer behaviour closely enough to pass initial review.

Practical implication: Treat ACH as a delayed trust decision and move fraud checks earlier in the fulfilment flow.

Why bank-detail changes are a high-signal control point

Bank detail updates often represent a privilege change over the payment instrument itself. When an established customer changes bank details shortly before an ACH transaction, the fraud surface increases because the payment destination and the account control may both have shifted. That is why account lifecycle monitoring matters: the transaction may be legitimate in isolation, but risky in context. In identity terms, this is a change-of-control problem, not just a payment-verification problem.

Practical implication: Flag recent bank-detail changes as a separate risk event and require step-up review before ACH settlement proceeds.

How velocity and low-value purchases support cash-out fraud

Fraudsters can minimise attention by splitting activity into many small purchases that stay below merchant thresholds while still draining value across the ACH settlement window. This creates a pattern where individual orders look low risk, but the sequence is exploitative. In practice, the behaviour resembles cash-out orchestration rather than ordinary checkout behaviour. The merchant problem is that single-transaction scoring misses the cumulative pattern across time, account reuse, and amount distribution.

Practical implication: Score ACH activity as a sequence, not as isolated orders, and watch for repeated small-value purchases from the same account cluster.

NHI Mgmt Group analysis

ACH fraud is now an account-access problem as much as a payments problem. The article shows that a legitimate bank account can still be the fraud vehicle when the underlying access has already been compromised. That shifts the control question from payment acceptance alone to whether identity-linked transaction signals are strong enough to detect abusive account control. Merchants should treat ACH as part of the identity risk surface, not just the payments stack.

Recent bank-detail changes are the clearest operational marker of ACH fraud exposure. A payment rail becomes riskier when a customer changes the funding account shortly before checkout, because the change can indicate takeover or monetisation. This is a governance gap in lifecycle monitoring, where account profile changes are not evaluated with the same scrutiny as login events or password resets. Practitioners should connect payment-risk decisions to account-change events.

Low-value, high-velocity ACH activity is a classic cash-out pattern that many controls still underweight. Fraudsters use transaction pacing to stay under thresholds and exploit settlement lag, which means one-off order review is structurally insufficient. The named concept here is settlement-gap monetisation: attacker exploitation of the time between authorisation, fulfilment, and return. Practitioners should build controls around that gap, not after it closes.

Fraud teams should stop assuming ACH is safer because it is slower. Slower settlement can increase attacker opportunity when merchants fulfil before return windows close. That means fraud governance has to combine bank-account trust, behavioural scoring, and sequence analysis. The practical conclusion is simple: ACH policy should be designed around abuse patterns, not rail reputation.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Settlement-gap monetisation: merchants should treat the gap between ACH initiation and return processing as an attacker opportunity window, not an operational delay. That means fraud rules have to evaluate the account, the change history, and the order sequence before fulfilment, not after the payment clears in batch.

ACH risk governance now sits at the boundary between payments, fraud, and identity security. The practical implication is that platforms need behaviour-based controls that can distinguish legitimate account use from compromised bank access, even when the visible transaction looks normal.

For practitioners

• Score ACH as a lifecycle event, not a standalone payment Include bank-detail change history, recent login context, and fulfilment timing in the fraud score before shipping goods or top-ups.
• Escalate recently changed bank details Treat any ACH payment from an established account with a bank update inside the prior week as a high-risk case requiring step-up review.
• Detect low-value velocity clusters Group small ACH purchases by account, device, and destination so repeated sub-threshold orders trigger review as a sequence.
• Separate ACH fulfilment from card logic Do not reuse card-not-present thresholds or authorisation assumptions for ACH, because return windows and settlement timing change the risk window.

Key takeaways

• ACH fraud exposure rises when merchants rely on delayed settlement as a proxy for lower risk.
• Risk signals include recent bank-detail updates, repeated low-value purchases, and account activity that looks ordinary only in isolation.
• The control shift is from post-payment review to lifecycle-aware scoring that joins identity, transaction, and fulfilment data.

Key terms

• ACH Fraud: ACH fraud is the misuse of automated clearing house payments to move money from a compromised or deceptive account relationship. It often relies on delayed settlement, account takeover, and weak behavioural verification so the payment appears legitimate long enough for the attacker to cash out.
• Bank Log: A bank log is an access artifact that can include account credentials, routing numbers, and session access to online banking. In fraud markets, it is valuable because it can enable repeated account actions, not just a single payment attempt.
• Settlement Window: A settlement window is the time between payment initiation and final confirmation or reversal. For ACH, this gap can be long enough for fraudsters to exploit fulfilment before the transaction is returned, which makes timing and hold policies central to loss prevention.
• Velocity Pattern: A velocity pattern is a burst of repeated purchases or attempts over a short period that may indicate automation, account abuse, or fraud monetization. In gift card environments, velocity must be judged in context because legitimate buyers can also make rapid purchases, especially during holidays or bulk gifting events.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.