Topic starter
22/07/2026 4:33 pm
TL;DR: ACH internet payments reached 11.41 billion transactions totaling $6.98 trillion in 2025, while Nacha’s new rules now require fraud monitoring across the ACH ecosystem for originators and service providers, according to Riskified and Nacha. Settlement lag, return-code tracking, and differentiated fulfillment are becoming the practical controls that determine whether merchants can absorb fraud without damaging customer experience.
Editorial analysis by NHI Mgmt Group, based on content published by Riskified: “What Nacha’s amended rules mean for your ACH fraud monitoring”.
By the numbers:
- The FTC reported $15.9 billion in fraud losses in 2025.
Key questions
Q: What breaks when ACH monitoring is not tied to settlement timing?
A: Merchants can release goods or funds before a transfer is final, which means fraud and insufficient-funds losses surface after fulfilment.
Q: Why do ACH return codes matter for fraud governance?
A: Return codes are the clearest feedback signal merchants get on whether their payment controls are working.
Q: What are the signs that ACH fraud controls are too blunt?
A: Common signs include delayed fulfilment applied to every customer, rising exception rates without segment-level analysis, and no clear distinction between low-risk and high-risk payment flows.
Practitioner guidance
- Implement settlement-aware fulfilment rules Hold delivery, release, or payout for higher-risk ACH transactions until settlement clears, and document the thresholds that justify instant release.
- Track return codes across all ACH entry types Build a monitoring view that groups R01, R07, R10, and R29 by merchant, channel, and customer segment so you can see where controls fail.
- Separate low-risk and high-risk ACH flows Use risk scoring to apply delayed fulfilment only where the loss exposure justifies it, rather than imposing a blanket delay on every customer.
Bottom line: ACH fraud is increasingly a timing problem because the money movement and the merchant’s fulfilment decision no longer happen on the same clock.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:55 pm
Settlement lag is the real control boundary in ACH fraud. The merchant’s risk decision happens before financial finality, which means validation alone cannot prove the transaction is safe. Fraud prevention has to shift from single-point approval to time-aware governance that connects payment acceptance, fulfilment timing, and loss recovery. Practitioners should treat settlement lag as a first-class control variable, not an operational afterthought.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: Should merchants use delayed fulfilment or instant payout for ACH?
A: Use delayed fulfilment for transactions that carry enough settlement or fraud risk to justify it, and reserve instant payout for low-risk flows with strong validation and monitoring. The right answer is usually a segmented model, not an all-or-nothing policy. That lets merchants protect losses without degrading the experience for good customers.
👉 Read our full editorial: ACH fraud monitoring rules reshape merchant risk and payout timing