By the BrightPurse Team | Personal Finance
If your bank has called you lately to ask about a deposit, or a transfer that used to land overnight sat in “pending” a little longer than usual, there’s a decent chance you ran into a set of rules most people have never heard of. They come from Nacha, the organization that writes the operating rules for the ACH network. That’s the system behind direct deposit, autopay, payroll, and most of the bank-to-bank transfers you make without thinking about it.
In 2026, Nacha rolled out new fraud monitoring requirements in two phases. The first kicked in on March 20 for the largest banks and payment companies. The second, on June 22, pulled in everyone else. For the first time, the bank receiving a payment has a formal job to watch for fraud, not only the bank sending it.
You don’t have to follow payments industry news to feel the effects in your checking account.
A Quick Refresher on Who Does What in an ACH Payment
Every ACH payment has two banks. The one that sends the payment instruction is the originating bank, which Nacha calls the ODFI (originating depository financial institution). The one that receives it and posts it to an account is the RDFI (receiving depository financial institution).
When your employer pays you, the employer’s bank is the originator and your bank is the receiver. When you push $2,000 from your checking account to “pay a contractor,” your bank is the originator and the contractor’s bank is the receiver.
For a long time, fraud controls in this system focused mostly on the sending side and on unauthorized debits, meaning someone pulling money from your account without permission. You already have strong rights there. The new rules go after a different and growing problem.
The Problem Nacha Is Trying to Fix: Payments You Approved Because You Were Tricked
Picture a call from someone claiming to be your bank’s fraud department. They say your account is compromised and walk you through moving your savings to a “safe” account. You log in yourself. You approve the transfer yourself. Technically, it’s authorized.
Nacha has a name for this: payments made under “false pretenses.” The term covers getting someone to pay by misrepresenting identity, authority or association, or who owns the account being credited. Impersonation scams, fake invoices, and business email compromise all fit.
These schemes are expensive. The Federal Trade Commission told Congress in March 2026 that consumers filed 3 million fraud reports in 2025 and reported $15.9 billion in losses, up from more than $12 billion the year before. Imposter scams were the most reported category again, with more than 1 million reports and over $3.5 billion lost. In the FTC’s 2024 Consumer Sentinel data, bank transfers and payments carried the highest losses of any payment method, about $2.09 billion.
Most of that money ends up in an account somebody controls, often a money mule’s account at a perfectly ordinary bank. That receiving bank used to have little formal responsibility for noticing. Now it does.
What the New Rules Actually Require
According to Nacha’s own breakdown, originating banks must set up risk-based processes “reasonably intended to identify ACH Entries initiated due to fraud,” which now explicitly includes false pretenses. Receiving banks must do the same for incoming credits.
Phase one, on March 20, 2026, applied to originating banks with 6 million or more ACH originations in 2023 and to receiving banks that handled 10 million or more ACH receipts that year. Phase two, on June 22, 2026, extended the policy requirement to every participant regardless of size. That means your local credit union is covered too.
The rules are looser than people sometimes assume. Banks don’t have to screen every payment before it posts, and Nacha doesn’t require them to match the name on a payment to the name on the receiving account. Instead, each institution builds monitoring that fits its own risk. Nacha’s guidance points to signals like unusually large amounts, an abnormal number of deposits, a payment type that doesn’t fit how the account is normally used, and money that gets withdrawn the moment it arrives.
How This Can Show Up in Your Own Account
For most people, most of the time, nothing changes. Your paycheck lands. Your mortgage autopay goes out. The monitoring runs in the background.
But a few things get more likely.
Your bank may contact you before releasing a large or unusual outgoing transfer, especially to a new payee. If you get that call, it’s worth slowing down and actually thinking about it. A bank asking “did someone tell you to move this money?” is doing exactly what these rules ask of it. Scammers coach victims to brush those questions off, so answering honestly is one of the best protections you have.
An incoming deposit may also be held for review. Nacha notes that a receiving bank can suspend normal ACH funds availability and fall back to the timelines in Regulation CC, the federal rule on deposit holds, when a payment needs more research. If someone you don’t know well sends you money, especially more than expected, a hold is a signal to be careful, not just an inconvenience.
Your statement may also look a little cleaner. The rules created standard company entry descriptions: “PAYROLL” for wage and salary credits, and “PURCHASE” for e-commerce debits. If your direct deposit description changed to “PAYROLL” this year, that’s why. The labels help banks spot when something calling itself a paycheck doesn’t behave like one.
Why the Receiving Bank Matters So Much
The biggest shift here is about recovering money. Once funds leave a scammer’s account, they’re usually gone. Nacha has said the goal on the receiving side is to raise the odds of recovery, so catching a suspicious deposit before it gets pulled out is the whole point.
It also changes the incentives for people recruited as money mules. If you’ve been offered easy money to “receive payments” for a stranger or a so-called employer, your bank is now expected to notice patterns like that. Letting your account be used this way can get it frozen or closed, and can follow you into future banking decisions.
What This Doesn’t Change
These are network operating rules, not a new consumer protection law. They don’t promise that you’ll be reimbursed if you’re tricked into sending money. Your strongest legal rights still apply to transfers you didn’t authorize at all, under the Electronic Fund Transfer Act and Regulation E.
So the best defense is the same as always. Hang up and call your bank using the number on the back of your card. Treat any request to move money “to keep it safe” as a red flag. Don’t send money back to someone who overpaid you. And keep a cushion in a separate savings account, so a temporary hold on one deposit doesn’t turn into a missed bill.
The new rules put more eyes on the ACH network, and that’s a good thing. They work best when you don’t treat your bank’s questions as an obstacle.