Common tactics contributing to rising ACH fraud threats include:
- Account takeover through phishing or malware: Fraudsters gain unauthorized access to online banking credentials through phishing emails, spoofed websites, or malicious software. Once inside, they can initiate unauthorized ACH transfers from compromised accounts. These takeovers are particularly dangerous because they often involve the legitimate account holder's information, making detection more difficult.
- Ransomware: While often associated with data breaches, ransomware attacks are increasingly being used as a gateway to financial fraud. Once a system is compromised, fraudsters may divert ACH payroll files, modify payment instructions, or lock down critical banking applications, halting legitimate operations and demanding payment via ACH or wire.
- Social engineering scams like romance scams: Criminals build fake online relationships to manipulate victims emotionally, often elderly or vulnerable individuals, into sending funds via ACH. These scams rely on trust and typically involve repeated transfers over time, making them harder to identify as fraud from a transaction pattern standpoint.
- Business email compromise (BEC): Fraudsters infiltrate or spoof a company's email system to pose as executives, vendors, or employees. They then submit fraudulent ACH payment requests to finance teams or account managers, often under the guise of urgent matters. BEC attacks continue to be among the costliest forms of fraud, particularly for small and mid-sized businesses.
- Synthetic identity fraud: In this scheme, fraudsters combine real and fictitious information to create entirely new identities, often opening accounts and building credit histories over time. These fake identities can then be used to initiate fraudulent ACH transactions, which are especially difficult to detect because the identities often appear legitimate in credit and identity verification systems.
- Authorized push payment (APP) fraud: In APP schemes, victims are tricked into sending ACH payments to fraudsters under pretenses, such as paying an impersonated vendor, making a down payment on a fake real estate transaction, or responding to a fake invoice. Because payments are often authorized, recovering funds can be difficult, making real-time monitoring and intervention essential.
What makes ACH fraud especially challenging is that it often stems from valid credentials or seemingly authorized activity, allowing it to bypass traditional red flags that might catch fraud.
