ACH fraud prevention for a business account rests on three bank-side tools — debit blocks, debit filters, and positive pay — layered against internal controls like dual approval and out-of-band verification of payment changes. Which combination fits depends on how each account is used, but skipping the controls altogether is the one option that carries real legal risk, because commercial accounts do not get the consumer-style refund rights that protect personal checking.
Why the Stakes Are Higher for Business Accounts
Individual consumers who report an unauthorized electronic transfer within two business days face a maximum loss of $50 under Regulation E, and the ceiling only rises to $500 for slower reporting.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Business-to-business transfers do not fall under that rule. They fall under Article 4A of the Uniform Commercial Code, which lets a bank push the loss back onto the customer if the bank offered a commercially reasonable security procedure and the customer declined it or failed to follow it.
In plain terms: a business that never turns on ACH fraud controls, then gets hit with an unauthorized debit, may have no legal claim against its bank. The tools below exist because that risk allocation puts prevention on you.
ACH Debit Blocks
A debit block is the bluntest option. It tells your bank to reject every incoming ACH debit against a specified account. When someone tries to pull funds, the bank returns the transaction automatically with a code indicating the debit was not authorized. Nothing reaches a human for review because there is nothing to review.
This fits accounts that only receive money: concentration accounts, payroll funding accounts, or reserve accounts that never need to send funds outward through ACH. There is no allow list to keep current, no daily exception queue, and no chance that a new employee mistakenly approves a fraudulent debit. If an account should never have money pulled from it, a full block is the right setting.
ACH Debit Filters
Filters replace the blanket rejection with an allow list. You give your bank a list of approved originators permitted to debit the account, identified by the ten-character Company Identification field carried in every ACH transaction.2Nacha. ACH File Details Any debit that doesn’t match an approved Company ID gets returned automatically.
Most banks let you stack dollar limits on top of the Company ID match, capping how much any given originator can pull per transaction or per day.3Federal Deposit Insurance Corporation. Automated Clearing House You might authorize an insurance carrier to debit up to $3,000 monthly and cap a utility provider at $800. Anything above the threshold either routes to an exception queue or gets returned outright, depending on how your bank handles overages.
Where Filters Fall Short
The Company ID field is self-reported by the originator’s bank. Filters block outsiders trying to pull money from your account, but they do not catch situations where your own staff has been tricked into sending money outward to the wrong place. Business email compromise works exactly that way: a spoofed message purporting to come from a trusted vendor asks the accounts payable team to update payment details, the template gets changed, and the next legitimate-looking payment lands with a fraudster. That is a credit push problem, not a debit problem, and filters do not touch it.
ACH Positive Pay
Positive pay layers a human checkpoint over your filter rules. When an incoming debit fails to match your approved list or exceeds a dollar threshold, the bank does not return it automatically. It parks in an exception queue and alerts you to make a pay-or-return decision.
Two things about that queue can trip businesses up. First, cutoff times vary. Some banks close decisioning as early as mid-morning; others hold it into the evening. Second, the default action when you miss the cutoff varies too. Some banks return unapproved items automatically, others release them as submitted. Confirm both settings when you enroll, because the wrong assumption costs you either a missed legitimate payment or an approved fraudulent one.
Positive pay fits accounts with mixed activity, where a full block is impractical and filters alone would either miss items or reject too many. The tradeoff is operational. Someone has to work the queue every business day. If alerts get treated like low-priority email, the protection stops working.
Credit Push Fraud and Payment Change Verification
The three tools above all guard money on its way in. None of them stop your own organization from pushing money to the wrong place. Credit push fraud, where the business itself is tricked into initiating a payment, now accounts for a growing share of ACH losses.
The pattern is consistent. Someone impersonating a vendor, executive, or partner sends instructions to change payment routing details. Because the payment originates from inside your company, no bank-side debit control triggers. By the time the mistake surfaces, the funds have cleared.
Nacha rule changes effective March 20, 2026 require originators, third-party service providers, and both originating and receiving financial institutions to monitor for credit entries initiated because of fraud.4Nacha. Credit-Push Fraud Monitoring Resource Center The rule does not mandate specific technology; Nacha points to velocity checks, anomaly detection, and pattern recognition as examples.
The practical countermeasure costs nothing: whenever a vendor requests a change to payment routing or account details, verify through a separate channel. If the request came by email, call a number you already have on file. Out-of-band verification is one of the most effective defenses against business email compromise.5Nacha. The Basics of Authentication in the ACH Network
Dual Controls Inside the Organization
Bank-side controls only cover part of the problem. Internal process controls matter just as much. Dual control means two separate people authorize any ACH payment or change to payment instructions. One person creates or modifies the transaction; a different person reviews and releases it. A fraudster who compromises one set of credentials, or convinces one person to act on a spoofed email, still has to get past a second reviewer.6Nacha. Tips for Originators to Comply with the 2026 Risk Management Rules
Apply the same principle to your allow list. If one person can add an approved originator or raise a dollar threshold with no second review, that is a hole in the fence. Require a second approver for any change to the allow list, the dollar thresholds, or account-level security settings. Scale the controls to the size of the operation. A small business running a handful of recurring payments does not need the same infrastructure as one processing thousands of ACH entries a day, but every business needs at least two sets of hands on the settings.
Setting Up the Controls
Before contacting your bank’s treasury management team, pull together the following for every recurring ACH debit you want to authorize:
- The ten-character Company Identification for each originator. If the vendor doesn’t know it, ask for a copy of a previous ACH transaction detail or have your bank pull it from recent account activity.
- The maximum amount each originator should be allowed to debit per transaction and per billing cycle, with a small buffer above the expected amount so normal fluctuations don’t get rejected.
- The frequency of each authorized debit, whether weekly, monthly, quarterly, or ad hoc.
Most banks handle enrollment through a commercial online banking portal, though some still require signed treasury management agreements. Expect activation to take one to two business days after submission. Once live, set alerts to notify you the moment an exception hits the queue, and don’t rely on email alone. A compromised inbox is exactly the situation the alert is supposed to help you catch. Use mobile app notifications or SMS as a secondary channel.
Audit the allow list at least quarterly. Vendors change, contracts end, and amounts shift. An outdated list either blocks payments you need or permits debits from companies you no longer deal with. Assign a specific person to maintain it, and a second person to review changes before they take effect.
Deadlines When Fraud Gets Through
When an unauthorized debit clears despite your controls, the clock starts. Under Article 4A, your bank is generally required to refund an unauthorized payment order. If you fail to exercise ordinary care in reviewing your statements and don’t notify the bank within a reasonable time, you lose the right to interest on the refunded amount. The statute sets that outer boundary at 90 days from the date you received notice that the transaction posted.7Legal Information Institute. UCC 4A-204 – Refund of Payment and Duty of Customer to Report
There is also a hard stop. If you don’t object to an unauthorized transaction within one year of receiving notification that it posted, you are completely barred from challenging it. After that year closes, the bank keeps the money and you have no legal recourse.8Legal Information Institute. UCC 4A-505 – Preclusion of Objection to Debit of Customer Account
Reviewing statements promptly is not just good practice for a business. It is the step that preserves your legal right to get the money back.
Same-Day ACH Has Compressed the Response Window
Same-day ACH processing now handles transactions up to $1 million.9Nacha. Same Day ACH Older next-day settlement gave fraud tools and human reviewers more time to flag problems. Same-day settlement collapses that buffer to hours.
For positive pay users, the daily exception review becomes more time-sensitive. If your bank’s decisioning cutoff falls before the same-day settlement window closes, a delayed response means the default action applies, whether that is a return or a payment. Businesses running high-value transactions should confirm exactly how their bank handles same-day items in the positive pay queue, and whether cutoffs for same-day items differ from those for standard next-day transactions.