ACH and check fraud protection

ACH fraud and check fraud refer to fraudulent transactions conducted without the knowledge or consent of the account holder whose funds are being used. In 2018, check fraud alone caused $1.3 billion in losses, and ACH fraud contributed to millions more.

Businesses are common targets for check and ACH fraud. These institutions typically conduct hundreds or even thousands of transactions in a relatively short period of time, making it easy for fraudulent transactions to go unnoticed until it's too late. Fraudsters may also hit businesses with hundreds of fraudulent transactions over several days or conduct multiple fraud attacks simultaneously, creating a mess that is equally difficult to undo.

With paper checks and ACH transactions remaining popular methods for business payments, businesses should understand their risks and how to mitigate them. It is important to understand how fraud occurs and how to help protect your organization.

ACH fraud

ACH fraud occurs when an organization's financial account information falls into the wrong hands, such as through a data breach. Scammers only need your account's banking and routing numbers to make electronic funds transfers. In other situations, scammers may attempt to pay for products or services with another entity's illegitimately obtained account information. To complicate things, businesses only have 2 days to report a fraudulent ACH transaction and recover the stolen money.

Check fraud

Check fraud may occur when a scammer attempts to pay you with a counterfeit check, fakes a signature on a real check (but one that does not belong to their account) or falsifies the numbers or payee names on an otherwise-legitimate check.

To detect ACH and check fraud, review your account transactions daily for suspicious activity or unauthorized transactions—prompt reporting is crucial to recovering lost funds. When possible, verify that the name on the check or account matches the name of the person or business paying you. For checks specifically, look for signs of tampering, such as erased or 'corrected' numbers or names. Checks that are shiny or have ink that smudges when damp may also be fake.

Unauthorized ACH withdrawals and fraudulent checks may be difficult or time-consuming to dispute and resolve, tying up your team's resources until the process is complete. Fraudulent transactions that take up a significant portion of your budget can cause interruptions in payroll, bill pay or company projects. If your business's information was used to originate a fraudulent payment, then you could also be at higher risk for future fraud attacks, meaning more time and funds will likely be spent protecting your accounts and avoiding future business fraud.

While it isn't always possible to prevent every instance of fraud, your business can—and should—take steps to improve its ACH and check fraud protection.

• Maintain cybersecurity protections, such as training all staff on safe computer, email and internet practices and updating malware and antivirus software across your network.
• Implement limits on who within your organization can approve or initiate ACH and wire transfers. You may also set dollar amount limits on how much can be withdrawn from your accounts through ACH payments.
• Limit the number of checks your company issues and who can order or have access to them.
• Use Positive Pay if offered by your financial institution, which verifies new check or ACH requests against records and parameters submitted by your company. If an unreported check or an ACH payment from an unauthorized vendor tries to go through, the bank will alert you and confirm whether you would like the transaction to go through.
• Alternatively, you can set up check or ACH blocks on your accounts to prevent these transaction types entirely.
• Confirm changes to vendor accounts directly with the vendor in writing, not through email or text.
• Enroll in your financial institution's fraud alert programs, if available, and designate one or two individuals at your company to respond to all notifications of suspicious activity. This helps the bank verify the company, not a fraudster, is truly approving suspicious transactions.
• Reconcile your accounts daily to detect fraud early on. Scammers will often continue making fraudulent transactions until their attempts are blocked, so detecting fraud immediately typically helps prevent future fraudulent transactions.
• Opt for payment methods that could help you improve your security, such as Capital One's Virtual Card Relay, which allows you to track vendor payments in real time and use single-use, exact-pay accounts for added fraud security.

No business can become perfectly fraud-proof, but taking steps to enhance your fraud protection is the next best thing. Limiting account and check access, implementing technology that safeguards your accounts (like Positive Pay or check blocks), maintaining appropriate cybersecurity protocols, instituting procedures for early fraud detection and using secure payment methods like virtual cards can help keep your organization better protected from ACH and check fraud.