Skip to content
Who can move money, and howLesson 12 of 27

Academy/Banking, Cash & Internal Controls

ACH controls

A phone call to a number you already trust stops most ACH fraud before it starts.

ACH moves recurring payments and vendor payments electronically between bank accounts. The real risk isn't the network, it's a scammer posing as a vendor or officer to redirect where those payments go. Before honoring any change to payment instructions, call the vendor or officer using a phone number already on file, never one supplied in the request itself.

01

What ACH actually moves, and why it's a target

ACH (Automated Clearing House) is the electronic network banks use to move recurring payments, dues autopay debits, and vendor payments, without anyone visiting a branch. Most of the money leaving an association's bank account each month probably travels this way, not by paper check.

That volume is exactly why ACH gets targeted. The FBI describes business email compromise as a scam that uses a compromised or spoofed email account, often appearing to come from a company executive, to trick someone into moving money or changing payment details. For a board, the same mechanism shows up as an email that looks like it's from the treasurer or association president, asking someone to update a vendor's ACH details or approve an urgent payment.

02

Verify any change to payment instructions by phone

Before your bank moves money to a new account, someone at the association should confirm the change with a phone call, and the number to call is the one already on file, never a number included in the email or letter making the request.

"A fraudster who can email you fake bank details can just as easily supply a fake 'verification' phone number that rings their own desk."

Source: A vendor emailed new bank details, how do I verify a bank change request safely?, Stampli

Keep a short record of the callback: who made it, the on-file number used, who confirmed on the other side, and when. A separate approver, someone other than whoever made the call, should sign off before the change goes live.

03

What changed in 2026, and what to ask your bank

New Nacha operating rules phased in during 2026, pushing banks toward risk-based fraud monitoring on outgoing ACH payments, rather than screening only specific transaction types.

"implement risk-based processes to identify fraudulent outgoing ACH entries and monitor entries that are unauthorized or initiated under false pretenses."

Source: Prepare for the 2026 Nacha Rule Changes, JPMorgan Chase (Treasury Insights)

The first phase applied to the highest-volume originators starting March 20, 2026, and a second phase covering remaining participants took effect June 19, 2026. Most of this compliance work sits with the association's bank, not the board, but it's a reasonable question to ask directly: what fraud monitoring does the bank run on outgoing ACH payments, and what authentication does it require for anyone with access to send them? Federal banking regulators have pushed banks toward multifactor authentication, rather than a password alone, for exactly this kind of higher-risk online banking activity.

Check yourself

Answer before you read the explanation, recalling it is what makes it stick.

A vendor emails the association saying they've changed banks and asks you to update their ACH payment details. What should happen before anyone changes anything?

The board read that new Nacha rules phased in during 2026 for ACH fraud monitoring. What's the useful next step?

The treasurer wants to set up a new recurring ACH payment to a vendor without anyone else reviewing it first. Which control addresses that risk?

Sources

Banking, Cash & Internal Controls

Next up: the same callback discipline applies to wire transfers, where a payment can move even faster once it's sent.

Which fraud-monitoring tools and authentication options a bank offers for ACH payments varies by bank, and how a loss is handled if fraud occurs depends on the specific agreement between the association and its bank.