Nacha wants credit unions to be able to look at a disputed ACH debit before the money goes back out the door. That helps, but only if the investigation can keep up with the fraud.

Some ACH fraud looks nothing like an attack. A member signs a form, and the money goes back to them.

Credit Union Times reported on Oct. 13 that Nacha has proposed an ACH rule change aimed at first-party fraud. The change would give credit unions and other financial institutions clearer room to investigate disputed ACH transactions before they refund the consumer.

The proposal arrived with a request for information. In “First-Party Fraud: Nacha Wants Your Input”, published Oct. 8, Nacha described the pattern its work group keeps finding: a person falsely tells their financial institution that a debit they authorized was unauthorized, and the institution returns it, generally under Return Reason Code R10. Comments are due Dec. 11.

What “promptly” has meant

Under Section 3.11 of the Nacha Operating Rules, the receiving institution has to “promptly” recredit a member who submits a Written Statement of Unauthorized Debit. Read literally, “promptly” can mean right away. Nacha’s request for comment notes that reading it as immediate “may preclude” a receiving institution from reviewing the claim or starting an investigation first.

The proposed language would clarify that the obligation does not require recrediting a consumer account before the institution owes a provisional recredit under Regulation E. For non-consumer accounts, the institution would not have to recredit before a comparable period “reasonably necessary to investigate the Receiver’s claim” has passed. The proposed effective date is June 18, 2027. No operational changes would be required on that date. The proposal does not change return timing, and the institution still has to recredit the member before it returns the entry.

In practice, the investigation could happen before the money moves, not after.

Small rate, real exposure

At the network level the numbers look calm. Nacha’s Jordan Bennett wrote in January that the average unauthorized debit return rate for the ACH Network is 0.05%. He suggested institutions calculate their own rate and investigate anything well above that, for example 0.1%, double the industry average. He also suggested looking for receiver accounts with high volumes of R10 returns that don’t fit typical patterns.

But a low network average says little about any single institution. The Federal Reserve Financial Services 2026 Risk Officer Survey found that unauthorized debit fraud was widespread, with 97% of financial institutions reporting that they experienced it in the past year.

Nacha is also asking the industry how big the problem is. The RFI asks what share of “unauthorized” returns may actually have been authorized, and whether institutions track first-party fraud losses at all. It also asks whether receiving institutions should flag high volumes of unauthorized returns tied to an account and monitor “erratic” account behavior linked to money mules or first-party fraud.

The catch: an investigation is only as good as its evidence

Permission to investigate is not the same as the ability to investigate. A Regulation E review needs evidence. What did this member’s account look like before the dispute? Was the debit part of a pattern the member had paid for months? Did the account change behavior in the days around the claim? Has this member, or this cluster of accounts, filed this kind of claim before?

Bennett also stressed that fraud-detection efforts should not discourage members with legitimate claims. Most disputes are real. The aim isn’t to treat every member as a suspect. It’s to have the context ready, so honest claims move fast and suspicious ones get a closer look.

Real-time detection isn’t the same as real-time protection

Even with more time on the refund, first-party fraud rarely stops at one disputed debit. The same accounts that file false claims are often moving money in other ways: a remote deposit that won’t clear, a card run up before a dispute, a quick transfer out after a recredit lands.

Flagging that pattern after the fact is useful for the case file. It doesn’t stop the next withdrawal.

The old model: Detect → Alert → Wait for a human.

The model this moment demands: Detect → Assess → Act.

Where RembrandtAi® fits

RembrandtAi® ingests events across every channel: card, ACH, remote deposit, online banking and ATM. It scores each one in real time with multi-stage AI, including neural networks, statistical analysis and machine learning scoring, and measures that risk against thresholds your team sets.

That cross-channel view is what a dispute investigation needs. A member’s ACH claim doesn’t sit on its own. It sits next to their deposits, card activity and logins, and RembrandtAi® sees them together as they happen.

When risk crosses a threshold, RembrandtAi® acts directly in your banking core: member alerts, card restrictions, transaction blocks, account freezes and access suspension, 24/7/365, with no human in the loop required. Your team still owns the investigation, sets the thresholds and works the exceptions. RembrandtAi® makes sure the money is still there when they do.

The approach has a track record. Launch Credit Union adopted RembrandtAi® at the end of 2020 and saw a 97% reduction in fraudulent transactions, saving $1.8 million in 2021, American Banker reported. As CFO Kevin LeBeau put it: “If you’re uploading three hours later, that money is already gone.”

The takeaway

Nacha is working to give credit unions time to investigate before the refund. That time only helps if the investigation has evidence and the account is protected while the review runs.

The dispute is one moment. The fraud is usually a pattern.

Identity is a moment. Risk is continuous.

See how RembrandtAi® acts in real time, in your core. Request a demo.

Sources

1. Michael Ogden, “Nacha Proposes ACH Rule Change to Address First-Party Fraud,” Credit Union Times, Oct. 13, 2026. https://www.cutimes.com/2026/10/13/nacha-proposes-ach-rule-change-to-address-first-party-fraud/
2. Nacha, “First-Party Fraud: Nacha Wants Your Input,” Nacha, Oct. 8, 2026. https://www.nacha.org/news/first-party-fraud-nacha-wants-your-input
3. Nacha, “Request for Information/Request for Comment: First-Party Fraud Topics,” Nacha, Oct. 2026. https://www.nacha.org/rules/request-informationrequest-comment-first-party-fraud-topics
4. America’s Credit Unions, “Nacha seeks feedback on first-party fraud,” America’s Credit Unions, Oct. 13, 2026. https://www.americascreditunions.org/news-media/news/nacha-seeks-feedback-first-party-fraud
5. Jordan Bennett, “Should RDFIs Have a Role in Identifying First-Party Fraud?,” Nacha, Jan. 20, 2026. https://www.nacha.org/news/should-rdfis-have-role-identifying-first-party-fraud
6. Federal Reserve Financial Services, “2026 Risk Officer Survey,” Federal Reserve Financial Services, 2026. https://www.frbservices.org/binaries/content/assets/crsocms/news/research/2026-risk-officer-survey.pdf
7. “Florida credit union overhauls its fraud prevention with big assist from AI,” American Banker, May 6, 2022. https://www.americanbanker.com/news/ai-revolutionized-how-this-credit-union-prevents-fraud