# Outbound ACH & Supplier Payment Fraud
Source: https://paymentsandrisk.com/docs/fraud/types/outbound-ach-fraud

Last updated 27 October 2026.

TL;DR

-   **Inbound ACH** is customers paying you. **Outbound ACH** is you paying suppliers. Different risk, different controls, different liability
-   Outbound means your money already left. Contact your bank immediately to request a recall; recovery isn't guaranteed
-   The top vector is a [BEC-driven vendor banking change](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/). Someone talks your AP team into swapping a vendor's bank details
-   Prevention is procedural, not technical. Dual authorization, out-of-band verification, segregation of duties, vendor file audits

Outbound ACH fraud is money you sent, landing in the wrong account. Usually because someone changed a vendor's bank details.

Most ACH writing is about inbound. Customers paying you. Our [ACH operations](https://paymentsandrisk.com/docs/operations/ach-operations/) and [ACH fraud](https://paymentsandrisk.com/docs/fraud/types/ach-fraud/) pages do the same, and that's the right place to start. But you also send money out. Suppliers, contractors, landlords, payroll. That's a different risk entirely. The money flows away from you and the recovery window is brutally short.

## Inbound vs. Outbound ACH Risk

On paper they're the same rail. The risk profiles aren't close.

| Factor | Inbound ACH (Customer Pays You) | Outbound ACH (You Pay Suppliers) |
| --- | --- | --- |
| **Direction** | Money flows in | Money flows out |
| **Who initiates** | You (or your processor) as ODFI | You as originator via your ODFI |
| **Primary fraud type** | Unauthorized debits, return abuse | Payment redirection, insider theft |
| **Your role when fraud hits** | Victim (you lose the goods/service) | Liable party (your money is gone) |
| **Recovery window** | [Debit return timing varies by account and reason](https://paymentsandrisk.com/docs/payments/payment-methods/bank-transfers/#return-timeframes) | Contact the bank immediately; a fraud recall isn't guaranteed |
| **Legal framework** | Reg E (consumer), UCC (business) | Nacha rules, UCC Article 4A |
| **Detection** | R10/R29 return codes alert you | You discover it when vendor calls asking where payment is |
| **Typical loss per incident** | Transaction amount | $10K-$125K+ (often larger payments) |

The difference that matters: inbound fraud announces itself. A return code lands in your file. Outbound fraud tells you nothing. The money leaves, the fraudster moves it, and weeks later your real vendor asks where the payment went.

* * *

## Attack Vectors

### Vendor Banking Change Fraud

This is the top vector, and it's a flavor of Business Email Compromise. The [BEC & Phishing](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/) page covers BEC in depth. There's no point repeating it here.

Short version: a fraudster impersonates one of your vendors. Compromised email, or a spoofed domain. They ask you to update the banking details. AP updates the vendor master file. The next payment run pays the fraudster.

**Why it works so well:**

-   Vendor banking changes are routine. They happen legitimately
-   AP processes dozens of invoices and nobody trained them to be suspicious
-   One successful change captures the next payment
-   IC3 recorded about $3.05 billion in BEC losses in 2025, across all payment methods

For the full prevention set, see [BEC & Phishing](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/#prevention-framework).

### Payee Account Number Manipulation

Someone changes the account or routing number in your AP system. Or edits the payment file on its way to the bank.

**How it happens:**

-   **External access:** They get into QuickBooks or NetSuite and edit vendor records
-   **Batch file tampering:** They alter your Nacha file between creation and upload
-   **Man-in-the-middle:** They sit between you and the bank's ACH portal

**Detection signals:**

-   Vendor record changes with no verified change request behind them
-   Routing numbers that don't match the vendor's known bank
-   Several vendors suddenly moving to the same receiving bank

### ACH Origination Abuse

You send payment instructions through your ODFI. That makes you an originator. Abuse of that access is its own risk.

**Scenarios:**

-   Someone uses your origination credentials to pull money from third parties
-   Fake entries added to a legitimate payment run
-   Credential theft on your bank's ACH origination portal

**Your liability:** you own every transaction you send. Someone else uses your access? Nacha still puts the returns and the damages on you.

### Insider Threats

Your AP clerk, bookkeeper or controller can already move money. That's the whole problem.

**Common schemes:**

-   **Ghost vendors:** Fake vendor records, payments routed to a personal account
-   **Payment splitting:** A real vendor payment, plus a small second one to themselves
-   **Check-to-ACH conversion:** They convert a check to ACH and redirect it
-   **Overbilling collusion:** Employee and vendor inflate invoices and split the excess

**Why it goes undetected:** the thief usually reconciles the accounts too. No segregation of duties, no second set of eyes.

* * *

## Prevention Controls

It's procedural work, nearly all of it. No fraud score catches a clean-looking payment to a fraudster's account.

| Control | What It Prevents | Implementation |
| --- | --- | --- |
| **Dual authorization for new payees** | Ghost vendors, BEC | Two people must approve any new vendor in the master file |
| **Dual authorization for banking changes** | BEC, account manipulation | Two people must approve any change to vendor bank details |
| **Out-of-band verification** | BEC | Call vendor at a known phone number (not from the email) to confirm banking changes |
| **Micro-deposit or API verification** | Wrong account, manipulation | Verify new bank details with test deposits or bank API before sending real payments |
| **ACH Positive Pay** | Unauthorized origination | Bank-side control that matches outbound ACH against your authorized payee list |
| **Segregation of duties** | Insider fraud | Person who enters payments is not the person who approves them |
| **Vendor master file audits** | Ghost vendors, stale records | Quarterly review of all vendor records - flag dormant vendors, duplicate tax IDs, PO box-only addresses |
| **Payment threshold alerts** | Large-dollar fraud | Automatic alerts for payments above a set threshold |

### The Non-Negotiable Three

If you do nothing else, do these:

1.  **Dual authorization on banking changes.** No single person gets to change where payments go. Period.
2.  **Out-of-band verification for new bank details.** Call the vendor at a number you already had on file. Never use contact info from the email asking for the change.
3.  **Segregation of duties.** Whoever enters the payment doesn't approve it.

* * *

## ACH Origination Compliance

Originate ACH and the Nacha rules bind you. Whether you know it or not.

### Originator Responsibilities

-   **Authorization:** Every transaction needs one, on file
-   **Return liability:** Every return is yours, unauthorized ones included
-   **Data accuracy:** Account numbers, routing numbers and amounts must be right
-   **ODFI agreement:** Your bank's contract spells out your duties. Read it

### Entry Class Codes That Matter

| SEC Code | Name | Use Case |
| --- | --- | --- |
| **CCD** | Corporate Credit or Debit | Business-to-business payments (vendor, supplier) |
| **PPD** | Prearranged Payment and Deposit | Payroll, employee reimbursements |
| **CTX** | Corporate Trade Exchange | B2B with addenda records (remittance data) |

**Why it matters:** use the right SEC code and account type. Unauthorized business debits and consumer debits have different [bank return deadlines](https://paymentsandrisk.com/docs/payments/payment-methods/bank-transfers/#return-timeframes). These debit rules don't describe a vendor credit you sent.

### Unauthorized Return Exposure

A transaction comes back unauthorized. R29 corporate, R10 consumer. You're on the hook:

-   You have to accept the return
-   Your ODFI may charge you a fee
-   Repeat offenders lose origination privileges

* * *

## If Outbound ACH Goes Wrong

### Act Immediately

Ask your bank's fraud team for a recall and its indemnity process. Returning the funds is voluntary even within the first 24 hours. The receiving bank must advise your bank of its decision or status within ten banking days of receiving the request. Recovery isn't guaranteed.

### Response Checklist

For an ordinary merchant, report the fraud to your bank and law enforcement. Let the bank handle its SAR obligations.

```text
Immediate (first hour):
[ ] Call your bank's fraud team - phone, not email
[ ] Request an ACH recall with transaction details
[ ] Ask about the bank's Hold Harmless or letter-of-indemnity process, if applicable
[ ] Freeze any pending payments to the same account
[ ] Preserve all evidence (emails, change requests, approvals)
[ ] Promptly file a detailed FBI IC3 report at ic3.gov, including the banking details
[ ] Contact local law enforcement directly for this time-sensitive fraud

Within 24 hours:
[ ] Notify your cyber insurance carrier (if applicable)
[ ] Begin internal investigation - who approved, what process was followed

Within 1 week:
[ ] Complete internal investigation
[ ] Identify control failures
[ ] Implement corrective controls
```

### Recovery Is Uncertain

Report the fraud immediately, even if you find it late. Ask the bank about stopping an unsettled payment or recovering settled funds. A sender-error reversal isn't a general fraud recall.

* * *

## Next Steps

**Setting up outbound ACH controls?**

1.  Put dual authorization on vendor banking changes. Highest-ROI control you have
2.  Write the out-of-band verification procedure. See the [BEC prevention framework](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/#prevention-framework)
3.  Ask your bank about ACH Positive Pay. It matches payments to your approved payee list

**Already sending outbound ACH and worried about gaps?**

1.  Audit the vendor master file. Dormant vendors, duplicate tax IDs, PO box addresses
2.  Check who can change vendor bank details. [Segregation of duties matters](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/#layer-1-process-controls)
3.  Read your ACH origination agreement. Know what you signed

**Dealing with a suspected outbound fraud incident?**

1.  Call your bank and request a recall. Every hour counts
2.  File with FBI IC3 at ic3.gov, even if recovery looks hopeless
3.  Work the [BEC response playbook](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/#response-playbook)

* * *

## Related Pages

-   [ACH Operations](https://paymentsandrisk.com/docs/operations/ach-operations/) - Inbound processing and return management
-   [ACH Fraud](https://paymentsandrisk.com/docs/fraud/types/ach-fraud/) - Inbound fraud, return codes, verification tools
-   [BEC & Phishing](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/) - The top vector for outbound payment fraud
-   [Bank Transfers](https://paymentsandrisk.com/docs/payments/payment-methods/bank-transfers/) - ACH, wire and RTP as payment methods
-   [ACH Return Codes](https://paymentsandrisk.com/docs/reference/return-codes/ach/) - The full code reference
-   [Business Banking ATO](https://paymentsandrisk.com/docs/fraud/types/business-banking-ato/) - When they take your banking logins
-   [Payout Strategy](https://paymentsandrisk.com/docs/operations/payout-strategy/) - Outbound payment timing and risk
-   [Vendor Management](https://paymentsandrisk.com/docs/operations/who-owns-what/) - Operational controls for vendor relationships
-   [Paying Affiliates and Contractors](https://paymentsandrisk.com/docs/operations/paying-affiliates-and-contractors/) - Tax forms, sanctions searches and bank-change checks before you pay people