A Cautionary, Real-Life Tale of Why Nacha’s New Fraud Rules are Crucial

Posted on

Share post

There are multiple reasons why Nacha's new fraud monitoring rules are important, but perhaps nothing brings the point home better than a story William Mills told at Smarter Faster Payments Remote Connect 2025.

Mills-Vice President, Deposit and ACH Operations, at Premier Banks-was in his office recently when a branch manager called to say someone from another bank was on the phone with an ACH question.

"It turns out this is an ODFI who's called about a transaction one of their Originators has made that they now have heartburn about, and they don't think that it's gone to the right place, so they asked if we could look at it," said Mills. "In the process of researching this transaction, we discovered it's going to a personal account, it's a 40-something-thousand-dollar transaction to an account that only has debit card transactions in and out through Venmo and PayPal. And as I reviewed it, they're very small transactions but it has classic kiting indicators: $150 in, $142 out; $160 in, $159 out; over and over and over again."

As the RDFI, Mills was able to stop the transaction and return the money to the ODFI and ultimately to the Originator. But that's only part of the good news.

"It also alerted me to the fact that I have somebody who is probably a money mule who is working on maintaining an active, open account, but with such small transactions no one at the bank would ever notice it."

The moral of this story-that RDFIs have a role to play in stopping credit-push fraud-is just one of the lessons for banks and credit unions to take away. Tim Thorson, Senior Vice President, Digital Payments, Regions Financial Corporation, said it's also a tale about the importance of timely communication, because the new Rule will be "ramping up the contacts between banks."

"You want responsiveness. You also want something of a sense of urgency," Thorson told the session "RDFI Monitoring: What's Working?"

It's all the more reason to make sure your financial institution's information is up to date in Nacha's ACH Contact Registry, because as Mills pointed out, you can't leave callers in "phone tree hell" where they're passed from one person to the next, unable to speak to the right person, leading to an end result where "nothing happens."

Both Mills and Lawrence Lau, independent consultant, emphasized making sure staff knows how to handle incoming calls.

"I definitely try to communicate it via bulletins, via meetings, we have operational meetings when I visit the branches," said Lau. "It's constant communication training," which Lau said also focuses on "reiterating where the resources are" should a bank need to reach out.

While the Nacha Rules take effect in 2026, Jordan Bennett, Nacha Senior Director, Network Risk Management, said there's no need to wait to act. In fact, he said no FI should be on the sidelines.

"We as an industry have got to stop this fraud, because it affects not only our consumers and our businesses," said Bennett "but sometimes the banks are left holding the bag as well."

Learn more about the new Rules on Nacha.org.

William Mills, Tim Thorson and Jordan Bennett also discussed the new rules during the in-person version of Smarter Faster Payments and you can read more about that session on Nacha.org.