A customer who tells their bank that a legitimate ACH debit was unauthorized can get that debit sent back, and the business that collected it has almost no way to argue. Nacha, the organization that writes the rules for the U.S. Automated Clearing House (ACH) network, now wants to know how often that happens and whether billers should get a chance to prove the customer agreed to the charge. Responses to its Request for Information and Request for Comment on first-party fraud, issued October 8, are due Friday, December 11, 2026.
The request also carries one concrete rule proposal, which would give a customer’s bank more room to look into a claim before it has to put the money back.
Where the questions came from
Nacha formed a work group in late 2025 with members of its Rules and Operations Committee, Risk Management Advisory Group and Lawyers Committee, plus experts from financial institutions. The group met through mid-2026, and its RFI presentation says many financial institutions and other organizations report anecdotally that first-party fraud is rising. Nacha frames the core difficulty plainly. The fraud turns the network’s consumer protections against the other participants.
The work group sorted the claims into three patterns. In each, a person falsely tells their bank, the Receiving Depository Financial Institution (RDFI), that an authorized debit was not authorized, and the bank returns it, generally with return reason code R10.
- Account opening fraud covers debits used to fund a newly opened account at another financial institution.
- False claim fraud covers debits for a bill payment, subscription, donation or purchase.
- Digital wallet funding fraud covers debits that load a digital wallet or another third-party account.
The second pattern is the one online sellers and subscription businesses live with. Nacha’s presentation also notes what does not count as unauthorized under its rules, including a customer who is unhappy with the goods or services. The authorization warranty that the business’s bank gives does not extend to the goods or services themselves.
Why a merchant cannot fight back today
Under the current rules, the Originating Depository Financial Institution (ODFI), which is the bank that sends debits on a business’s behalf, can dishonor a return coded unauthorized only for administrative reasons, such as a return that came back late or went to the wrong place. The business, called the Originator in Nacha’s terms, also cannot send the debit again. The one exception is an R11 return, used when a debit did not match the authorization’s terms, which can be resubmitted once the error is fixed.
The work group did not support letting banks dishonor unauthorized returns for other reasons. It did acknowledge that many Originators and ODFIs want an opportunity to present proof that a debit was authorized, and the RFI lays out two ways that could happen.
Two routes for proof of authorization
In the first, a customer’s bank that is reviewing a Written Statement of Unauthorized Debit (WSUD) could ask the business’s bank for proof of authorization before deciding whether to return the debit. Nacha floats limiting that to higher-dollar claims and notes the proof would have to arrive in time to be considered.
The second is a new kind of arbitration. Nacha says its existing arbitration process is not well suited to first-party fraud cases. A new version would weigh the authorization evidence and could be tiered or capped by dollar amount. The RFI asks whether either approach would be practical.
New labels inside the payment record
Nacha is also asking whether more standardized data in each debit would help a customer’s bank judge a claim. Three ideas are on the table:
- Standard Company Entry Descriptions for account opening transfers, subscriptions, and digital wallet loads and payouts, similar to the existing PAYROLL label. The rules already require ecommerce debits to carry the description PURCHASE.
- An authorization indicator showing whether the customer gave a single, recurring or standing authorization.
- An indicator showing how the business got the customer’s account details, whether directly, through a third-party service provider, or through a “Pay by Bank” flow such as an open banking connection or screen scraping.
Both indicators could sit in the Discretionary Data or Payment Type Code field, positions 77 and 78, of PPD, TEL and WEB debits, the three main consumer debit types. A separate Pay by Bank Project Team at Nacha’s Payments Innovation Alliance flagged many of the same scenarios, and the RFI asks whether Pay by Bank purchases carry their own first-party fraud risks.
The recredit proposal and its June 2027 date
The only rule text in the package is a change to Section 3.11 of the Nacha Operating Rules, published in the proposed modifications. It would say that a bank’s duty to “promptly” recredit a customer does not require recrediting a consumer before the bank owes provisional credit under Regulation E, or a business account holder before a comparable period needed to investigate. The proposal does not change when the return must be sent or the requirement to recredit before returning.
Read alongside an earlier rule that lets a bank send an Extended Return Entry up to six banking days after it finishes reviewing a signed WSUD, the change would let a bank take the time Regulation E allows before deciding. Nacha says some returns “potentially could be prevented” that way. The proposed effective date is June 18, 2027, and Nacha says banks would not have to make any operational changes.
The timing questions cut both ways for a business. Nacha points out that a customer who files a claim on day 59 after settlement leaves the bank one day to meet the return deadline, and it asks whether that deadline should be extended to allow investigations. EC4IM covered the card side of a similar evidence problem in holiday chargeback preparation.
Who can answer, and what Nacha asks
Nacha is collecting responses through an online survey and encourages all ACH participants to respond. Businesses that send or receive ACH payments can choose the “Non-FI end user” role and will see only the questions that apply to them. One question asks Originators and ODFIs what share of debits returned as unauthorized they think are first-party fraud. A high-risk merchant that collects by ACH and keeps return data by reason code would have a concrete number to offer.
What Nacha has put on the table
Nacha’s request does not change any rule for businesses yet. It asks how common false unauthorized claims are, whether banks should request proof of authorization or use a new arbitration process, and whether new descriptions and indicators in the payment record would help. The one firm proposal would clarify that banks can take the Regulation E window before recrediting, starting June 18, 2027. Billers that lose money to R10 returns have until December 11 to tell Nacha what that costs them and which remedy would work.