Threats and fraud can be perpetuated through cyberattacks, email compromise, account takeover, social engineering, and even vendor impersonation fraud. While these threats are not about a direct compromise of the ACH Network or other payment systems, they exploit vulnerabilities or gaps in processes or procedures. Nacha is committed to helping financial institutions, businesses, other organizations, and consumers protect themselves and prevent fraudulent activity.

Ransomware

CISA: Stop Ransomware

OFAC: Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments

FinCEN: Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments

Coronavirus Scams 

FinCEN: Advisory on Financial Crimes Targeting COVID-19 Economic Impact Payments

FinCEN: Consolidated COVID-19 SAR Key Terms and Filing Instructions

FinCEN: FinCEN Advisory on Imposter Scams and Money Mule Schemes Related to Coronavirus Disease 2019 (COVID-19)

Cybersecurity & Infrastructure Security Agency (CISA): Avoid Scams Related to Economic Payments, COVID-19

CFPB: Beware of Scams Related to the Coronavirus

DOJ: Justice Department Warns About Fake Unemployment Benefit Websites

FBI: FBI Urges Vigilance During COVID-19 Pandemic

FTC: Coronavirus Advice for Consumers

FTC: Want to get your Coronavirus relief check? Scammers do too. 

FTC: Coronavirus Scams: The FTC in Action

FTC: Spot the scams with #FTCScamBingo

IRS: IRS Issues Warning About Coronavirus-Related Scams

NCL: Beware the Coming Coronavirus Scam Tsunami

DHS: Cybersecurity and Critical Infrastructure (as related to COVID-19)

Money Mule Scams

USDOJ: Law Enforcement Takes Action Against Approximately 2,300 Money Mules In Global Crackdown On Money Laundering (December 2020)

USDOJ: Money Mule Education Initiative

FBI: Don’t Be a Mule: Awareness Can Prevent Crime

FTC: What is a Money Mule Scam?

Email Compromise and Impersonation Schemes

Nacha: Business Email Compromise at the Heart of Fraud Against Businesses, AFP Report Finds

Nacha: UPDATED Booklet: Protecting Against Fraud: How to Spot and Prevent Fraud Schemes

FBI: Internet Crime Complaint Center (IC3)

Nacha: Nacha Creates Voluntary Formatting Standard to Help ID Questionable Payroll Credits

Nacha: Report Finds Sharp Rise in Business Email Compromise

Nacha: Business Email Compromise,Vendor Impersonation Fraud, and Payments: What Organizations and Financial Institutions Need to Know

Nacha: Social Engineering Attacks Against Public Sector and Other Entities

FDIC: Beware, It's a Scam (October 2020)

FDIC: Protect Yourself Against Imposters (March 2020)

EPCOR: Did You Know? Business Email Compromise (video)

NCUA: Business Email Compromise Fraud Alert (August 2019)

FinCEN Advisory: Updated Advisory on Email Compromise Fraud Schemes Targeting Vulnerable Business Processes (July 2019)

CFPB: Mortgage Closing Scams: How to Protect Yourself and Your Closing Funds (June 2019)

SEC: Warning - Potential Accounting Control Violations with Business Email Compromise (October 2018)

FBI PSA: Business Email Compromise and Email Account Compromise (Emphasis on Real Estate Vector Compromises)

FBI PSA: Business Email Compromise Contributes to Large Scale Business Losses Nationwide

FBI PSA: Cybercriminals Utilize Social Engineering Techniques To Obtain Employee Credentials To Conduct Payroll Diversion

FTC: Data Breach Guide for Businesses (October 2018)

Account Takeover

FDIC: Cybersecurity Preparedness Resource (FIL-63-2018)

Nacha: Account Takeover: What You Need to Know

Nacha: Sound Business Practices for Third-Party Service Providers to Mitigate Account Takeover

Nacha: Sound Business Practices for Businesses to Mitigate Account Takeover

Nacha: Sound Business Practices for Financial Institutions to Mitigate Account Takeover

Nacha: Policy Statement on the Importance of Sound Business Practices to Mitigate Account Takeover

Nacha: Corporate Account Takeover Can Lead to Fraudulent Transactions

Nacha: Fraud Advisory for Businesses: Corporate Account Takeover

Nacha: Recommendations for ACH Network Participants Lessons Learned for Proactive Risk Management Following Attacks on the SWIFT Network

FS-ISAC: Security of Payment Network Access Points: Risk Mitigation Recommendations Related to Recent Payment Account Takeover Attacks Against Banks Leveraging the SWIFT Network

Common Fraud Schemes Encountered by the FBI

FBI: Common Fraud Schemes

FBI: Major White Collar Crime Threats and Schemes

FBI: Cyber Crime Schemes

WEB eResources

WEB transactions, or Internet-Initiated/Mobile Entries, are one of the fastest growing areas of Direct Payment via ACH. As more organizations look for sound business practices and solutions to offer WEB payment options, Nacha developed eResources to support businesses and financial institutions in implementing and using the WEB code.

These eResources will help organizations broaden payment options for customers of all types, realize efficiencies of electronic payments, and have necessary guidance to fully understand ways to address compliance, security and risk factors. They seek to expand knowledge and understanding among all stakeholders in the industry, supporting effective implementation of WEB transactions.

Encryption is a core technology that underpins the security of the ACH Network. The eResource, based on information gathered from industry professionals, underscores its value and generates greater awareness about the need for methods for all ACH Network participants to combat data threats and attack scenarios. ​

Authentication in the ACH Network is a common challenge among all ACH Network participants, particularly for WEB transactions. The eResource covers relevant risk management requirements for WEB in an effort to help participants better understand authentication technologies that are available on the market.

Authorization involves determining what information should be collected and retained so that there is adequate proof in the event that a transaction is challenged--a common challenge among ACH Network participants that originate or process WEB ACH consumer debit transactions. The ability to prove that a transaction was properly authorized is highly dependent on the attributes of the authorization process and any underlying processes used to validate identity, all of which may vary among institutions, transaction types and operating models.