Print
(From Nacha) –Nacha seeks industry information and feedback on the topic of first-party fraud and potential mitigants. Industry respondents are asked to provide information and perspectives on the scope and significance of first-party fraud, the roles and potential responsibilities of parties related to identifying first-party fraud, as well as possible ways to mitigate the risk.
Some potential mitigants such as new standard entry descriptions also may satisfy needs in Pay by Bank scenarios as further described in this RFI. Respondents are requested to provide input in this area.
Nacha also seeks comment on a specific proposal to amend the Nacha Operating Rules that would provide additional context regarding a Receiving Depository Financial Institution’s (RDFI) obligation to “promptly” recredit a consumer Receiver’s account upon receiving the Receiver’s Written Statement of Unauthorized Debit (WSUD). A Request for Comment on this proposal is included as part of the overall request so that it can be considered alongside the full scope of the RFI topics.
All ACH Network participants are encouraged to provide their comments on these topics, the proposed rule change, and the questions posed. Responses on this Request for Information (RFI) and Request for Comment (RFC) are due by Friday, December 11, 2026.
Please review the survey questions prior to beginning your response so that you can gather information and comments from all impacted areas of your organization before responding to the questions.
Non-FI end user (senders and receivers of ACH transactions) respondents, based on role selection, will be presented online with pertinent questions only. Please note that this results in some gaps in the question numbers for these respondents. Respondents that fulfill any other participant role should refrain from selecting Non-FI end user, in order to be presented with the survey in its entirety.
You can download the materials and respond online (surveymonkey link).
Download materials: Presentation, Proposed Modification to the Rules, ACH Participant survey
Details
FIRST-PARTY FRAUD TOPICS
Anecdotally, many financial institutions and other organizations report to Nacha that first-party fraud is increasing in frequency. This RFI aims to better identify the scope and significance of first-party fraud in the ACH Network.
In each first-party fraud scenario illustrated in the RFI, a person falsely claims to their financial institution (the RDFI) that an authorized debit is unauthorized, and the RDFI returns the debit (generally using Return Reason Code R10). Consumer account-holding institutions can be both RDFIs that handle consumer claims and also ODFIs of ACH debits to fund newly opened accounts and to collect credit card and mortgage or other loan payments. In addition to asking if there are other categories of first-party fraud, the RFI also explores any potential roles of the RDFI in the mitigation.
RDFIs may be in a position to identify instances of first-party fraud, in a similar way that RDFIs can be in a position to identify instances of credit-push fraud. Just as with credit-push fraud, instances of first-party fraud are committed by an account holder at the RDFI.
Standardized Transaction Identification and Data
If an RDFI is investigating a consumer’s claim and conducting an account review, then additional and/or standardized information in ACH transactions could help RDFIs conduct the review and make better determinations about the validity of the claim. The RFI explores the following ideas:
- Standard Company Entry Descriptions
- Authorization-related indicators
- Account information provisioning-related indicators
Challenging an Unauthorized Return
The Nacha Rules permit an ODFI to dishonor a return bearing an unauthorized return code only for certain administrative reasons, such as the return is untimely or misrouted. Further, an Originator cannot reinitiate a debit that was returned as unauthorized (except in the case of a debit returned as not in conformance with the authorization (R11) for which the Originator corrects the error).
This RFI explores multiple options that could provide an opportunity for originating parties to present proof that a debit was authorized, such as whether or not the proof of authorization should be part of a RDFI’s obligation when reviewing a WSUD and asks for thoughts on other ways authorization information could be presented, such as a new arbitration process.
First-Party Fraud and Pay by Bank
- The Pay by Bank Project Team identified significant Pay by Bank use cases that include many of the same scenarios as first-party fraud.
- The Project Team highlighted that standardized transaction identification and other transaction-level data and tags, very similar to those identified for first-party fraud scenarios, could help ACH participants understand the nature of Pay by Bank transactions and manage risk.
RDFI OBLIGATION TO RECREDIT CONSUMER
In May, Nacha explored the requirement for prompt recredit related to a consumer claim of an unauthorized ACH debit in a blog article, What Does ‘Prompt’ Recredit Actually Require? | Nacha
Some RDFIs interpret “promptly” as immediately or on the same day as receiving the customer’s WSUD.
- This may preclude an RDFI from otherwise reviewing the WSUD or even initiating a Regulation E investigation.
- Providing additional context on the meaning of “promptly” in the Rules could remove this perceived barrier for some RDFIs.
Based on the work of the First-Party Fraud Work Group, Nacha seeks comment on a proposal to amend the prompt consumer recredit requirements in the Nacha Operating Rules.
Technical
RDFI OBLIGATION TO RECREDIT CONSUMER
The proposal would modify the recredit obligation in Section 3.11 to provide additional context on the meaning of “promptly.”
The obligation of an RDFI to promptly recredit a Receiver does not require the RDFI to:
- Recredit a consumer prior to the time it incurs an obligation to provisionally recredit the consumer under Regulation E; or
- Recredit a non-consumer prior to the expiration of a comparable period reasonably necessary to investigate the Receiver’s claim.
This proposal is intended to clarify the timeframe in which an RDFI must recredit its customers during the dispute process. For RDFIs that would take additional time to review claims, some returns potentially could be prevented if an RDFI were to identify a case of first-party fraud.
The proposed language does not change the requirement related to the timing of the return, nor the need to recredit the customer prior to returning the entry.
Proposed effective date: June 18, 2027.
This effective date is for the Rules language, but does not require any operational changes to be implemented as of the effective date. Therefore, a relatively brief implementation period is being proposed with sufficient time for industry communication and education. An RDFI that decides to implement any changes can do so on its own timeline.
Impact
RDFI OBLIGATION TO RECREDIT CONSUMER
Anticipated Benefits:
- Provides greater context regarding RDFI’s prompt recredit requirement.
- Better aligns Nacha Rules requirements with the timing requirements of Regulation E obligations.
- Removes a barrier for some RDFIs in conducting reviews of claims of unauthorized and potentially preventing returns.
Potential Impacts:
- RDFIs are not required to make any operational changes.
- RDFIs that want to incorporate the provisions of the new rule may have to revise internal processes, procedures, and/or documentation.
- Any such changes by an RDFI can be implemented subsequent to the Rule effective date.
Proposed effective date: June 18, 2027.