Topic starter
14/09/2026 10:09 am
TL;DR: ACH transactions can carry 2.3 times the fraud risk of card-not-present payments, according to Riskified, and its analysis of dark web discussion plus transaction data shows criminals using bank logs, recent bank-detail changes, and low-value high-velocity purchases to cash out before detection. The real governance issue is not whether to accept ACH, but whether fraud controls are tuned to its delayed settlement and account-access abuse patterns.
Editorial analysis by NHI Mgmt Group, based on content published by Riskified: “Why every payments team should be watching for ACH fraud”.
Key questions
Q: What breaks when ACH is treated like a safer payment rail?
A: The main failure is assuming slower settlement means lower fraud risk.
Q: Why do recent bank-detail changes increase ACH fraud risk?
A: A recent bank-detail change can indicate that the funding account, or the access to it, has changed hands.
Practitioner guidance
- Score ACH as a lifecycle event, not a standalone payment Include bank-detail change history, recent login context, and fulfilment timing in the fraud score before shipping goods or top-ups.
- Escalate recently changed bank details Treat any ACH payment from an established account with a bank update inside the prior week as a high-risk case requiring step-up review.
- Detect low-value velocity clusters Group small ACH purchases by account, device, and destination so repeated sub-threshold orders trigger review as a sequence.
Bottom line: ACH fraud exposure rises when merchants rely on delayed settlement as a proxy for lower risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
ACH fraud is now an account-access problem as much as a payments problem. The article shows that a legitimate bank account can still be the fraud vehicle when the underlying access has already been compromised. That shifts the control question from payment acceptance alone to whether identity-linked transaction signals are strong enough to detect abusive account control. Merchants should treat ACH as part of the identity risk surface, not just the payments stack.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Why do recent bank-detail changes increase ACH fraud risk?
A: A recent bank-detail change can indicate that the funding account, or the access to it, has changed hands. That makes the transaction more likely to involve takeover or monetisation activity, especially when it appears shortly before checkout. Merchants should treat the change itself as a risk event, not just the transaction that follows it.
👉 Read our full editorial: ACH fraud risk is outpacing platform detection on payment rails