As New Nacha Rules Approach, the Risks of Credit-Push Fraud are Real

Posted on

Share post

As New Nacha Rules Approach, the Risks of Credit-Push Fraud are Real If you're wondering how vendor impersonation fraud grew to become the big problem it is today, consider all that an accounts payable department has to deal with.

"We have a statistic that if you have 10,000 vendors, that 50% of those are going to change their information during a 12-month period. So, these people are very, very busy," said Thayer Stewart, Co-founder and CEO of PaymentWorks, whose platform automates the entire vendor lifecycle for business-to-business payments.

And when it comes to verifying banking information, Stewart said it typically means calling the vendor. "If you're a person who's very busy, it's very time-consuming and difficult to do that. And that's why these frauds are so pernicious and difficult to defend against."

Vendor impersonation is just one form of credit-push fraud, which also includes business email compromise and online account takeovers, among others. That's why this year, new Nacha Rules aimed at fighting credit-push fraud take effect.

"The idea behind this is that you take a risk-based approach-it's not that you have to monitor every single transaction that you're involved in processing, but that you identify the high-risk transactions and figure out a way to stop any potential fraud scenarios that may have occurred," said Mark Dixon, Senior Consultant at Nacha Consulting. "It's left broad so that the industry has ways to adopt it."

Dixon noted that Receiving Depository Financial Institutions (RDFIs) will now have to take "an active role in the transactions that they're receiving," by taking a risk-based approach to the ACH credit entries they're receiving. The new Rules, Dixon said, mean that, "everybody in the industry really needs to be taking an active role in trying to identify these transactions that may have been originated fraudulently or under false pretenses, and have good ways to stop that and recover it if possible."

Dixon and Stewart appeared on Nacha's Payments SmartCast podcast, where Stewart said that organizations working to comply with the new Rules need to consider a key distinction. "There's a big difference between having a policy and having really solid documented procedure," said Stewart, noting that it needs to be the starting point, and then you can look to automate the process.

Stewart also said that "fraud has been industrialized," citing a U.S. Bank estimate of 1,200 scam compounds worldwide, with a growth rate of 30%. "We think of these as lone actors, hackers with hoodies. These are professional companies with hundreds or thousands of employees, with CFOs, COOs," said Stewart.

All the more reason why ACH Network participants, he said, need to take the new Rules seriously.

"Nacha is just trying to alert people that this is a big problem," said Stewart. "The risk is not that you're going to pay some kind of penalty or fine. The risk is you're going to be the victim of a pretty serious fraud."

Much more was discussed, and you can listen to the complete podcast below.