Don't become a victim of ACH fraud — here's how

If you have a bank account, you've almost certainly received money from the Automated Clearing House (ACH) network—even if you don't realize it. Although the ACH network has many safeguards in place, it's not completely immune to fraud.

Read this guide to find out what ACH is, how scammers use it for fraudulent purposes, and what you can do to protect yourself.

ACH definition

Okay, so what is the ACH? It's a computer network used to move money from one bank account to another. This network forms the basis for many financial transactions:

• Making an online payment using your checking account

• Receiving a direct deposit from your employer

• Using your bank's online bill pay feature

• Transferring money from a PayPal account to a checking account

• Paying a gas bill on your utility company's website

Basically, unless you just opened your first bank account or pay for everything in cash, you've used the ACH network at some point in your life.

How ACH payments work

Believe it or not, ACH payments are based on simple data files. Each file contains information about the payment, such as where it's going and how much it's worth. Three organizations are involved in this process:

• Originating bank

• Clearing house

• Recipient bank

To make it easier to understand how this works, imagine you need to send a rent payment to your landlord. Your bank is the originating bank, and your landlord's bank is the recipient bank. The clearing house acts as a go-between, ensuring the transaction goes through successfully.

To process an ACH payment, the originating bank needs the following info:

• The name of the recipient bank

• The type of account (e.g. checking)

• The recipient's account number

• The recipient bank's routing number

• The amount of the transfer

A bank routing number is a unique 9-digit number used to identify a financial institution. You can find your bank's routing number at the bottom of each of your checks.

What is ACH fraud?

ACH fraud occurs when someone uses an account to make unauthorized ACH withdrawals or payments. This type of fraud is a major problem for banks and their customers. It's especially damaging if a fraudulent transaction eats up most of the funds in your account.

Fraudsters are extremely resourceful. With just a few pieces of information, they can get away with a large amount of money before anyone notices something is wrong. This makes them extremely devious (but also very efficient) individuals. These are a few of the most common forms of ACH fraud.

Debit card fraud

Debit card fraud occurs when someone uses your debit card without your permission. There are a few ways this can happen.

• You lose your physical card and don't realize it until a scammer has already made unauthorized transactions.

• Someone copies down your debit card number, CVC code, and expiration date. This sometimes happens at restaurants and other brick-and-mortar businesses.

• A data breach exposes your debit card information.

• Someone installs a skimmer at an ATM or PIN entry device. A PIN entry device is a number pad used to enter PINs and confirm transaction amounts. The skimmer collects debit card numbers, PINs, and other information needed to make fraudulent transactions.

No matter how it happens, debit card fraud can really ruin your day. Everything is going fine, and then all of a sudden you log in to your bank account and find out someone has been spending your money without permission.

Phishing

No, this has nothing to do with the alternative rock band Phish or Ben & Jerry's Phish Food ice cream. In cybersecurity lingo, phishing is an attempt to get people to reveal personal information, such as bank account info or credit card numbers.

Phishing involves getting people to click on a link to a website that has been loaded with malware. The infected site installs keylogger software on your computer, giving scammers access to the user name and password for every site you visit—including your online banking portal.

Once they have your login details, a scammer can log in to your bank account and attempt to initiate fraudulent payments. You may not notice until several payments have already gone through and made a real mess of your bank account.

Insider threat

Unless you live in a cave and survive on wild berries, you need to pay for things from time to time. That means giving your debit card number to medical offices, insurance companies, grocery stores, and other businesses.

When an untrustworthy employee from one of these companies steals your debit card information, that's an insider threat. Companies have security policies in place to prevent this type of ACH fraud, but these policies aren't perfect. A scammer who's smart and motivated can still access your information.

Major data breaches

Data breaches are extremely common, and they affect all types of companies. If a breach occurs, it's possible for the online thieves to share your debit card info with their scammer friends.

ACH fraud: Who is liable?

ACH fraud can wreak a lot of havoc for banks and consumers. The good news is that you're almost never liable for ACH fraud involving one of your accounts. Consumers have $0 in fraud liability under the following circumstances:

• Debit items:

  You're not liable as long as you report the fraud within 60 days of receiving your account statement.

• Counterfeit checks:

  If you didn't authorize the check, you're not liable for it.

• Forged checks:

  You're not liable unless the bank can show that you were negligent or didn't report the fraud in a timely manner. In this case, negligence means that you didn't do enough to prevent the thief from forging your signature.

• Fraudulent alteration of checks:

  You're not liable unless your negligence contributed to the fraud.

If you have a Visa®- or MasterCard®-branded debit card, you're not liable for ACH fraud as long as you took reasonable measures to protect your card. That means not leaving it in the hands of others. You also need to report the fraud in a timely manner.

With a Varo Bank Visa® Debit Card, you can get reimbursed for unauthorized transactions with Visa® Zero Liability Protection¹.

For non-Visa® and non-MasterCard® debit products, federal law limits your liability to $50. This limit applies no matter how much money the thief spent. In most cases, the originating bank is liable for ACH fraud involving checks, direct deposits, and other non-debit card transactions.

ACH fraud detection strategies

The best way to detect ACH fraud is to pay close attention to your finances. Thieves aren't going to magically disappear, but there are some ways to spot fraud shortly after it occurs. Early detection makes it easier to put a stop to fraud—it also helps you report the fraud in a timely manner, which can help you qualify for $0 liability.

Sign up for credit monitoring

Credit monitoring services track your credit usage and send you alerts about recent activity. These alerts can help you catch ACH fraud quickly and stop the thieves in their tracks.

Imagine a thief opens a bank account in your name, overdraws the account, and disappears. The bank is likely to report the overdrawn account to ChexSystems, a consumer reporting industry that tracks banking activity.

The ChexSystems report may show up in one of your credit monitoring alerts, letting you know there's a problem. Think of these alerts like the Bat Signal. They let you know a crime is in progress and give you a chance to put a stop to it.

Check your online accounts often

Banks, credit unions, and credit card companies typically offer a wide variety of online account services. To spot fraud quickly, make sure you log in to each account as often as possible. If you're vigilant, you may be able to put a stop to a fraudulent transaction before it's finalized.

Here's how. When you sign in, you'll see a list of recent transactions, both pending and completed. If there's a transaction there you don't recognize, contact the bank right away.

In some cases, everything is fine—you forgot you made the transaction, or a merchant processed the transaction under its parent company's name instead of the name you're familiar with. If it's not a legitimate transaction, let the bank representative know.

Depending on how quickly you spot the fraud, the bank may be able to reverse a transaction before it goes through. If a bank representative can't reverse the transaction, at least they can investigate it right away.

How to avoid ACH fraud

ACH fraud is no laughing matter. Even if you're not liable for the fraudulent transactions, you still have to spend time contacting the bank and following up to make sure the problem has been resolved. Your bank has ACH fraud protection measures in place, but it's important to follow some basic financial safety practices.

Check fraud protection

Checks aren't as popular as they used to be, but some people still use them to pay rent, property taxes, and other expenses. If you use paper checks, keep them in a safe place, such as a safe or a locked desk drawer. Don't leave your checkbook lying around when you have guests or if you have contractors, cable installers, or other service providers coming in and out of the house.

In some cases, it's necessary to mail a check. When possible, take the check directly to the post office or put it in a locked mailbox to prevent someone from stealing it. Be sure to use a security envelope to hide your name, account number, and other personal information.

If you plan to use a check to pay for something, don't fill out the check and sign it ahead of time. It may save you a minute or two at the store, but it also makes it easier for thieves to commit ACH fraud.

Debit card fraud protection

When you use your debit card at an ATM, gas pump, or store, check the PIN entry device for a skimmer. If you see signs of tampering, alert the merchant immediately.

Always keep your debit card in a safe place. If you don't plan to use it while you're out, take it out of your wallet and put it in a locked drawer or small safe.

Try not to let your card out of your sight. If you let someone take your debit card to another room, you're giving them an opportunity to copy down your card number.

If you love to shop online, avoid saving your debit card number to your favorite shopping sites. Saving your info does make it easier to check out, but it also makes it easier for hackers to get the information.

Money transfer fraud protection

Personal checks and debit cards aren't the only sources of ACH fraud out there. You also need to be wary of fraudulent money transfers and direct deposits.

If you get an email from someone claiming to be a government official who needs help moving money overseas, run as fast as you can. Don't give the person your bank account number, Social Security number, or any other financial information. Otherwise, you'll find that the only money being moved is yours.

Another common scam involves remote jobs. It goes something like this: you apply for a remote job, you get hired, and then the person who hired you asks for your bank account info.

Supposedly, they're going to use the info to set up direct deposit. Instead, they'll use it to clean out your bank account faster than you can say, "Scammer!"

ACH fraud review

Now you know what the ACH definition is and how scammers use the ACH network to commit financial crimes. Here's what else you need to remember:

• ACH fraud is common.

• This type of fraud may involve checks, direct deposits, debit cards, credit cards, or wire transfers.

• In most cases, you're not liable for any of the fraudulent transactions.

It's possible to reduce your risk of ACH fraud by following common check fraud protection, debit card protection, and money transfer fraud protection tips.