Fraud in payments hasn’t just increased—it has migrated.
For years, banks built defenses around the institution: tighter internal controls, better transaction monitoring, stronger back-office processes, and more sophisticated tools at the ODFI and RDFI. Those investments still matter. But Nacha is making something unavoidably clear in its new Fraud Monitoring Rules:
The primary target of fraud isn’t the bank anymore. It’s the bank’s customer.
That’s why these rules—while written as bank obligations—are effectively a mandate to recruit and equip customers as active participants in fraud prevention. This is the shift. And it’s the reason “doing the same thing, but harder” won’t be sufficient.
In this post, we’ll break down:
- What Nacha is signaling about the fraud landscape
- The specific Rule elements that move the center of gravity from bank-only controls to customer controls
- Why regulators “route” customer requirements through banks
- What banks must operationalize now—especially on the origination side
- How to do it without burying teams in manual paperwork or follow-ups
The New Fraud Reality: From Unauthorized Debits to Unauthorized and Fraudulently Induced Credits
Historically, the primary ACH fraud threat to account holders was unauthorized debits—someone gained access to account information and pulled funds without the account holder’s approval. Banks built robust controls around this threat, and the rules framework reflected it.
Nacha’s 2026 Rules make clear that the threat landscape has fundamentally shifted. The dominant fraud pattern is no longer unauthorized debits—it’s unauthorized or fraudulently induced credits. This shift takes two forms:
- Account takeover, where bad actors breach and gain unauthorized access to an Originator’s ACH credentials and systems, then initiate credit transactions the Originator never authorized.
- Transactions authorized under False Pretenses, where the customer did approve the transaction, but only because they were deceived—think vendor impersonation, payroll impersonation, or business email compromise. This happens when a payer is tricked into making a payment by somebody who misrepresented who they are, who they work for, or ownership of an account.
This explains the “why” behind the Rule changes. Fraud has shifted from unauthorized debits to unauthorized or false-pretense credits. In both cases, the victim has been impersonated or duped into originating a transaction that, to the bank, looks entirely legitimate. The bank cannot solve it alone.
Why not? Because the bank does not sit inside:
- the customer’s AP workflow,
- their vendor onboarding,
- their invoice approval chain,
- their payroll file creation process,
- their email security posture,
- their credential and system access controls,
- or the moment they change bank account details after an “urgent” email.
The customer does.
So the Rules don’t just ask banks to detect fraud. They ask banks to ensure fraud prevention exists where the fraud is actually happening.
What Exactly Is Shifting in the Rules?
Nacha’s fraud monitoring framework lands on two sides of the house:
1) The Sending Side: Originators, Third-Party Senders, and ODFIs (All ACH Entries)
Nacha states that each covered party must establish and implement risk-based processes and procedures intended to identify entries suspected of being:
- Unauthorized—meaning not actually authorized by the Originator. This is a fundamental shift from the traditional framework, which focused on authorization by the Receiver. Now, the Rules also address situations where bad actors gain access to an Originator’s systems and credentials to initiate transactions the Originator never approved.
- Authorized under False Pretenses—where the Originator did authorize the transaction, but only because they were deceived.
…and to assess and keep those processes up to date as risks evolve (“at least annually”).
So why does this shift focus to the customer?
Because on the origination side—the side of the Network where fraud is increasingly initiated—the critical gaps live outside the bank’s walls.
2) The Receiving Side: RDFIs (Credit Monitoring)
RDFIs have parallel requirements focused on ACH credit monitoring, centered on recognizing mismatches or suspicious activity in incoming credits—not on assessing whether False Pretenses occurred upstream. Their responsibility is to identify red flags such as unusual patterns, velocity anomalies, and account-level signals that suggest something is wrong: there’s a mismatch between the incoming credit and the receiving account.
Where You Sit in the Payment Chain Determines What You’re Responsible For
One of the clearest signals in the Rules: where the Party sits in the transaction chain dictates what they must do.
Originators sit at the critical juncture for both types of fraud:
- For False Pretenses fraud: Because Originators are the Parties taking in payment information and initiating changes—like adding or changing account numbers—they are now the ones deciding the procedures and careful controls under which these changes can be made.
- For unauthorized fraud: Because Originators control access to their credentials and systems—the security of their operations—they control the critical point of access that bad actors exploit.
Which means: because bad actors are mimicking authorized and normal transactions, it’s not enough under the Rules to simply monitor for abnormal transaction behavior. Banks must monitor and oversee customer operational behavior—especially for higher-risk Originators and Third-Party Senders.
This is the heart of the shift:
Nacha’s Rules reframe bank fraud monitoring as customer operations oversight.
Not “are we a safe bank?”
But “are our customers’ payment operations safe, and do we have records that validate that?”
Why Regulators Place Customer Fraud Responsibilities on Banks
A common question banks are asking: Why is Nacha placing all this responsibility on us? Why not require it directly of Originators?
The answer is structural. Regulators and Network rule frameworks can mandate obligations for participating financial institutions, but they don’t have the same direct authority over every SMB, corporate, nonprofit, school district, or other organization that originates ACH.
So the model becomes:
- Rules place obligations on banks (ODFIs/RDFIs and other participants)
- Banks, in turn, must:
- contract for expectations (origination agreements, third-party sender agreements),
- oversee performance (records), and
- build feedback loops that validate controls exist and evolve.
Can banks hire vendors to do this for them? Regulators have been clear when discussing vendor reliance: you can use vendors, but you can’t “contract away your responsibility.” If a responsibility is assigned to you in the Rules, you must ensure it’s being done—even if a third party performs it.
That same logic applies to customer relationships. The bank is the obligated party. So the bank must operationalize customer operations oversight—at scale.
You Can Flag Abnormal Transactions—But You Can’t See Broken Customer Workflows
Nacha repeatedly returns to one theme: understanding normal behavior vs. abnormal behavior.
They cite monitoring dimensions like:
- Volume and value (is this amount/volume expected?)
- Velocity (how often a routing/account number appears in a file; repeated names/accounts across multiple Originators)
- Returns patterns (use returns as a learning loop to stop the next event)
- Potential use of account validation and ownership validation as a best practice (encouraged, even if not explicitly mandated)
But here’s the catch: while banks can see network-facing behavior, fraud is happening “upstream.” If a customer’s internal process is weak, “abnormal” becomes their new “normal.”
That’s why the Rules implicitly require banks to do more than watch transactions. Banks must understand:
- how a customer obtains authorization and verification for payment instructions
- how a customer protects access to ACH credentials and systems
- whether and how a customer verifies a Receiver’s identity, account ownership and account validation
- who can change account details
- how vendor changes are verified
- how payroll changes are approved
- what internal alerts exist
- what training and controls are in place
- and whether those controls evolve as threats evolve
This is not a one-time onboarding questionnaire. It’s ongoing operational risk management.
The Compliance Trap: “Risk-Based” Does Not Mean “Minimal”
Another important signal in the Rules: Nacha says there is no risk-based approach that results in doing nothing.
Even low-volume Originators must have risk-based processes. And Nacha adds a practical truth: pre-processing is the only chance to stop something.
That’s a direct challenge to banks that plan to rely only on after-the-fact investigation.
If your customer’s process allows a false-pretense payment to be released, and the first time you learn about it is after settlement, you are now operating in a recovery world—not a prevention world.
To Banks: Your Customer Enablement Plan Is Your Fraud Prevention Plan
If your institution is preparing for the Fraud Monitoring Rules this year, the most important operational decision isn’t “which monitoring system do we use?”
It’s:
How do we operationalize customer oversight at scale—without creating an army of manual follow-ups?
Because the Rules are effectively asking banks to:
- Identify which customers present higher fraud risk
- Require risk-appropriate controls, validation, and security measures in customer payment operations (not just in the bank)—including stronger access protections to guard against unauthorized transactions
- Validate those controls exist (and stay current)
- Monitor behavior and signals over time
- Escalate and intervene when patterns indicate abnormal behavior or likely false pretenses
That’s a strategic shift, not a project.
And it’s why many banks are rethinking the traditional “annual questionnaire and scattered documents” approach. That approach struggles with consistency (different analysts interpret answers differently), defensibility (hard to show auditors a clear chain of evidence), and scalability (manual chasing doesn’t improve as your Originator base grows).
How LexAlign Fits This Shift: Turning Customer Operations Oversight into Measurable, Defensible Compliance
LexAlign was built for this exact reality: banks needing reliable visibility into customer operational risk—at scale—without adding more manual work.
When the Rules require “risk-based processes and procedures” and the ability to keep them current, banks need three things:
- Structured, role-appropriate data collection from customers (not freeform narratives)
- Evidence and audit-ready artifacts that map back to Rule expectations
- Ongoing monitoring signals that help distinguish normal vs. abnormal behavior over time
LexAlign helps banks operationalize the customer side of fraud prevention by standardizing customer diagnostics around required control areas, collecting and organizing supporting documentation, creating consistent outputs that can be reviewed, escalated, and audited, and supporting ongoing oversight as risks evolve (rather than a once-a-year scramble).
Most importantly, it aligns with the Rules’ central reality: you can’t prevent false-pretense fraud without involving the customer.
A Simple Way to Explain the Shift
Need a one-paragraph internal explanation (for leadership, audit, or the board)? Here it is:
Nacha’s Fraud Monitoring Rules reflect a fundamental change in fraud: bad actors are increasingly breaching and gaining unauthorized access to Originators’ ACH credentials and systems, or tricking bank customers into initiating legitimate-looking payments (“authorized under false pretenses”). Because those decisions and vulnerabilities exist inside customer operations—not inside the bank—the Rules effectively require banks to recruit customers into fraud prevention. The bank remains the obligated party, so we must oversee customer controls, validate they exist, and monitor behavior over time. Our fraud monitoring program is therefore also a customer enablement and customer operations oversight program.
What to Do Next: 3 Smart Moves Banks Should Make Now
1) Understand what the Rules are really saying. The Fraud Monitoring Rules are not just about transaction alerts. They require risk-based processes that identify unauthorized activity and false-pretense fraud—including visibility into customer payment operations, not just bank systems.
2) Take inventory of your current tools and processes. Assess where you truly have oversight—and where you only have after-the-fact monitoring. Identify gaps in consistency, documentation, scalability, and your ability to demonstrate compliance.
3) Build a scalable oversight engine—not a heavier burden. Avoid layering on more manual reviews. Instead, implement structured, repeatable processes that standardize customer oversight, produce audit-ready evidence, and evolve as fraud threats evolve.
Bottom Line
The new Fraud Monitoring Rules don’t just raise the bar for banks. They move the playing field.
Fraud is targeting customers because customers are now the easiest path to the money. Nacha’s Rules respond by requiring banks to oversee and strengthen customer payment operations—because that’s where the fraud is initiated and where prevention must start.
If you’re preparing for enforcement this year, the question isn’t whether you will involve customers.
It’s whether you will do it in a way that’s scalable, consistent, and defensible.