ACH Fraud Rules Are Shifting: What Nacha 2026 Means for Banks and Credit Unions

Beginning March 2026, Nacha’s amended risk management rules introduced new compliance obligations for most ACH participants. By June 2026, these requirements extend across the ACH Network, bringing financial institutions of all sizes, including credit unions, into scope.

The question is: What is the core of these changes? And what do they require financial institutions to do differently?

Key Takeaways

• Nacha 2026 introduces explicit requirements to detect fraud conducted under “false pretenses”
• Both sending and receiving financial institutions must implement risk-based fraud monitoring across ACH flows
• Authorized fraud (BEC, APP scams) is now clearly within scope
• Static, transaction-only controls are no longer sufficient on their own

Why Nacha Changed the Rules

In recent years, fraud has grown in both volume and sophistication, with business email compromise (BEC), account takeover (ATO), and social engineering attacks increasingly targeting the ACH payment rail.

Broadly, fraud on ACH falls into two categories:

• Fraudulent ACH debits, where fraudsters withdraw funds directly from a victim’s account without consent, or obtain authorization under false pretenses.
• Fraudulent ACH credits, where victims are typically manipulated into sending payments under false pretenses, representing a growing category of authorized, but deceptive transactions.

Industry data highlights both the scale and the shift. According to the 2026 AFP Payments Fraud and Control Survey, ACH debits remained one of the most impacted payment methods, with 30% of organizations reporting fraud attacks via this rail.

ACH credits rank among the top four payment methods used in imposter scams, including BEC, fraud via telephone call, and fraud via text on an official mobile device. Notably, in 2024, 50% of organizations reported experiencing BEC attacks involving ACH credits.

This points to a clear trend: the fastest-growing category of ACH fraud no longer relies on unauthorized access, but on manipulating legitimate account holders into authorizing fraudulent payments.

Against this backdrop, Nacha’s existing “commercially reasonable” standard proved insufficient. It was inherently subjective, often reactive, and in practice allowed institutions to meet compliance with minimal controls while failing to address the evolving reality of manipulation-driven fraud.

The 2026 Nacha Rule Changes Explained

The 2026 rule changes move beyond the previous standard, introducing more concrete, mandatory obligations built around risk-based processes and procedures. Crucially, they recognize payments authorized under “false pretenses,” bringing social engineering fraud into clearer regulatory focus.

#	Rule Change	Compliance Obligation
1	Proactive Fraud Monitoring (ODFI)*	ODFIs must establish risk-based processes to identify ACH entries initiated due to fraud, including those initiated under false pretenses. Applies to all ODFIs from March 20, 2026.
2	Proactive Fraud Monitoring (RDFI)**	RDFIs must implement risk-based monitoring of incoming ACH credit entries for fraud. Phase 1 (March 2026) for RDFIs with >10M receipts. Phase 2 (June 2026) for all RDFIs.
3	False Pretenses Definition	New defined term: payments induced by misrepresenting (a) identity, (b) authority, or (c) account ownership are explicitly recognized as fraud and subject to risk-based detection.
4	WEB Debit Account Validation	Account Ownership must be validated for all first-time or new account WEB debit transactions. Risk-based authentication required.
5	Standardized Entry Descriptions	PAYROLL must be used for PPD wage credits. PURCHASE must be used for e-commerce WEB debits. Improves data consistency, supporting fraud detection.
6	Annual Review Requirement	All covered entities must review and update fraud monitoring procedures at least annually, with documented evidence.
7	Elimination of ‘Commercially Reasonable’	Evolution of “commercially reasonable”: the standard is reinforced with more specific requirements (“processes and procedures reasonably intended to identify” fraud), raising expectations for demonstrable controls.

*ODFI = Originating Depository Financial Institution

**RDFI = Receiving Depository Financial Institution

The False Pretenses Clause and What It Means

The most significant and technically challenging new requirement is the obligation to detect payments authorized under “false pretenses.”

Nacha defines “false pretenses” as the inducement of payment by a person by misrepresenting (a) that person’s identity, (b) that person’s association with or authority to act on behalf of another person, or (c) the ownership of an account to be credited.

In practice, this brings a new category of fraud into scope: payments that appear fully authorized, but are driven by deception.

Examples include:

• Business email compromise (BEC), where an employee is tricked into authorizing an ACH payment to an attacker-controlled account (this can involve both debits and credits).
• Vendor impersonation, payroll redirection, and other payee impersonation schemes.
• Authorized push payment (APP) fraud, where a customer is socially engineered into initiating an ACH credit transfer.

At the same time, this definition complements existing rules on unauthorized transactions (such as account takeover), rather than replacing them. “False pretenses” does not cover disputes involving legitimate payments for fake, non-existent, or poor-quality goods or services.

For banks and credit unions, this means implementing controls capable of identifying modern social engineering fraud, not just unauthorized transactions.

Implementation Timeline

Nacha has structured the 2026 changes in two phases, with earlier deadlines for higher-volume participants:

• Phase 1 (March 20, 2026): All ODFIs; Originators, Third-Party Senders, and Third-Party Service Providers with 2023 ACH origination volume above 6 million entries; RDFIs with 2023 ACH receipt volume above 10 million entries.
• Phase 2 (June 19, 2026): All remaining non-consumer Originators, Third-Party Senders, and Third-Party Service Providers regardless of volume; all remaining RDFIs regardless of volume.

GDPR & PSD2: A Regulatory Shift Nacha Now Reflects

When the EU implemented PSD2 and strengthened GDPR enforcement between 2018 and 2020, European banks faced a challenge similar to what US financial institutions face today: new regulatory expectations demanding demonstrable, risk-based fraud prevention and clear accountability.

PSD2’s Strong Customer Authentication (SCA) introduced multi-factor authentication for electronic payments, with behavioral biometrics recognized as a valid “inherence” factor. In parallel, GDPR established strict requirements for processing behavioral data, including transparency, purpose limitation, and auditability.

EU (PSD2 / GDPR)	US (Nacha 2026)
Mandatory Strong Customer Authentication (SCA)	Mandatory proactive fraud monitoring for ACH initiation
Behavioral biometrics as ‘inherence’ factor under PSD2	Behavioral biometrics (continuous, session-level) for detecting “false pretenses”
Transaction Risk Analysis (TRA) exemption thresholds	Risk-based monitoring approach with documented processes
GDPR-compliant audit trails and documented review	Annual documented review of fraud monitoring procedures
Compliance deadline drove rapid technology adoption	June 2026 deadline creates same urgency for US credit unions

 

Together, these frameworks pushed European financial institutions toward more advanced, behavior-based risk assessment—something Nacha is now beginning to formalize within the ACH ecosystem.

How Creditas turned compliance into a fraud advantage

What This Means for Banks and Credit Unions

The new rules require institutions to define their fraud risks, implement procedures that address them, and document those controls. These controls must be reasonably designed to identify fraud.

Crucially, the “false pretenses” definition brings new fraud types into scope. If your current fraud program focuses primarily on account takeover and unauthorized debits, it leaves a gap that the 2026 rules explicitly target.

Behavioral intelligence addresses this gap by focusing on how users interact during the session, rather than just what they do. By analyzing navigation patterns, interaction signals, and deviations from established behavior, it becomes possible to identify signs of manipulation (“false pretenses”) even when a transaction appears valid.

Nacha does not prescribe specific technologies, but its requirements make clear that static transaction analysis alone is no longer sufficient. At scale, this creates the need for continuous, context-aware monitoring that can adapt to evolving fraud tactics.

Behavioral intelligence is not the only component of this shift, but it is one of the few approaches capable of meeting these requirements consistently.

From Compliance to ROI

For many institutions, compliance is still treated as a cost center. The 2026 Nacha changes create an opportunity to build fraud controls that are not only compliant, but also operationally effective and scalable.

A risk-based approach allows institutions to align controls with actual exposure, focusing resources where they matter most, reducing false positives, and improving detection of high-impact fraud such as BEC and APP scams. This translates directly into lower fraud losses, fewer customer disputes, and reduced operational overhead.

This is where ThreatMark’s Behavioral Intelligence Platform brings value beyond compliance, enabling:

• Detection of modern fraud patterns across both unauthorized and authorized fraud, based on continuous, session-level behavioral insight
• Protection without friction, maintaining a smooth customer experience
• Rapid deployment via versatile integration options, with API integration into digital banking platforms (Q2, Alkami, Digital Insight, or custom environments)
• Seamless integration with existing core systems—no replacement required
• Real-time risk signals within ACH workflows
• Fast time-to-value with minimal operational disruption and cost-effective implementation

In practice, this means meeting Nacha requirements while building a fraud prevention capability that scales with evolving threats— and extends beyond a single payment rail.

Learn more about behavioral intelligence