Nacha’s Risk Management Advisory Group (RMAG), Rules and Operations Committee, and the First-Party Fraud Workgroup are looking at ways to better identify and mitigate first-party fraud. The first steps are education and raising awareness of the problem. We have issued a series of articles describing first-party fraud and addressing actions for both ODFIs and RDFIs. 

Nacha’s workgroups are evaluating ways to send a minimum set of standardized information from the ODFI to the RDFI to provide more information for investigating a claim of unauthorized debit by their Receiver.  The groups are also discussing guidance for RDFIs to research claims of unauthorized debits which will standardize the experience and expectations for consumers making claims of unauthorized debits. Communication between parties and greater consistency in RDFI review processes for claims of unauthorized are areas where our industry can make improvements. While we work through future solutions, there are steps all parties can take now. 

The Challenge.

The greatest challenge posed by first-party fraud is that it takes advantage of the consumer protections that are built into the ACH Network.  Finding solutions requires a careful balance between new information, tools and processes for identifying fraudulent claims, while not restricting or deterring consumers from making legitimate reports to their financial institutions regarding unauthorized debits.

What can we do now?

RMAG provided ODFI and Originator tips in Balancing the Need for New Deposits Against Fraud Risk. Options described in that article include:   

• Use available tools to validate bank account information. 
• Provide accurate information and complete details in the ACH records to provide as much information as possible to the RDFI. 
• Respond promptly to an RDFI’s request for proof of authorization.
• For online account openings, consider appropriate deposit holds and limits on availability of funds until the consumer establishes an account history. 

In addition to these tips, ACH Originators should ensure that ACH debits are described accurately and clearly in accordance with the Nacha Rules.  Consumers who cannot accurately identify a transaction based on information presented on their account statement, or cannot easily revoke authorization with the Originator, often wind up reporting these transactions to their financial institutions as unauthorized.

RDFIs have a crucial role to play in identifying and mitigating first-party fraud. RMAG made the case for the RDFI’s role in Should RDFIs Have a Role in Identifying First-Party Fraud? To summarize that article, RDFIs are in a unique position to identify first-party fraud and should make a reasonable effort to identify fraudulent claims. For example, RDFIs can identify accounts at their financial institutions that generate a high volume of claims of unauthorized debit. These account holders are either victims who need education on how to protect their account, or customers who may be committing first-party fraud.  From investigating such accounts, RDFIs can learn about account characteristics and customer behaviors that correspond to first-party fraud.

RDFIs can also calculate the rate of Unauthorized Returns sent compared to the number of forward debits received. If this rate changes, are the RDFIs or their customers being targeted by fraudsters? 

We can rise to the challenge.

In the early 2000s, debit fraud was an issue. New risk strategies, Nacha Rules, tools and education were designed to meet that challenge. More recently, Nacha’s “Risk Management Framework for the Era of Credit-Push Fraud” was released in 2022, and Rule changes addressing credit-push fraud are becoming effective this year. Through education, collaboration, and Rule changes, the payments industry is more aware of credit-push schemes, is implementing policies and procedures to identify these schemes, and has tools to aid in the recovery of funds. A similar approach can be undertaken to reduce the incidence of first-party fraud.

One of the strengths of the ACH Network is its ability to evolve and to change with the times. The ACH Network put in protections for debit fraud schemes, is meeting the challenge of credit-push fraud, and will evolve to address the challenges of first-party fraud.