Skip to main content

Outbound ACH & Supplier Payment Fraud

Last updated . Copy page as text

TL;DR
  • Inbound ACH is customers paying you. Outbound ACH is you paying suppliers. Different risk, different controls, different liability
  • Outbound means your money already left. Contact your bank immediately to request a recall; recovery isn't guaranteed
  • The top vector is a BEC-driven vendor banking change. Someone talks your AP team into swapping a vendor's bank details
  • Prevention is procedural, not technical. Dual authorization, out-of-band verification, segregation of duties, vendor file audits

Outbound ACH fraud is money you sent, landing in the wrong account. Usually because someone changed a vendor's bank details.

Most ACH writing is about inbound. Customers paying you. Our ACH operations and ACH fraud pages do the same, and that's the right place to start. But you also send money out. Suppliers, contractors, landlords, payroll. That's a different risk entirely. The money flows away from you and the recovery window is brutally short.

Inbound vs. Outbound ACH Risk​

On paper they're the same rail. The risk profiles aren't close.

FactorInbound ACH (Customer Pays You)Outbound ACH (You Pay Suppliers)
DirectionMoney flows inMoney flows out
Who initiatesYou (or your processor) as ODFIYou as originator via your ODFI
Primary fraud typeUnauthorized debits, return abusePayment redirection, insider theft
Your role when fraud hitsVictim (you lose the goods/service)Liable party (your money is gone)
Recovery windowDebit return timing varies by account and reasonContact the bank immediately; a fraud recall isn't guaranteed
Legal frameworkReg E (consumer), UCC (business)Nacha rules, UCC Article 4A
DetectionR10/R29 return codes alert youYou discover it when vendor calls asking where payment is
Typical loss per incidentTransaction amount$10K-$125K+ (often larger payments)

The difference that matters: inbound fraud announces itself. A return code lands in your file. Outbound fraud tells you nothing. The money leaves, the fraudster moves it, and weeks later your real vendor asks where the payment went.

Attack Vectors​

Vendor Banking Change Fraud​

This is the top vector, and it's a flavor of Business Email Compromise. The BEC & Phishing page covers BEC in depth. There's no point repeating it here.

Short version: a fraudster impersonates one of your vendors. Compromised email, or a spoofed domain. They ask you to update the banking details. AP updates the vendor master file. The next payment run pays the fraudster.

Why it works so well:

  • Vendor banking changes are routine. They happen legitimately
  • AP processes dozens of invoices and nobody trained them to be suspicious
  • One successful change captures the next payment
  • IC3 recorded about $3.05 billion in BEC losses in 2025, across all payment methods

For the full prevention set, see BEC & Phishing.

Payee Account Number Manipulation​

Someone changes the account or routing number in your AP system. Or edits the payment file on its way to the bank.

How it happens:

  • External access: They get into QuickBooks or NetSuite and edit vendor records
  • Batch file tampering: They alter your Nacha file between creation and upload
  • Man-in-the-middle: They sit between you and the bank's ACH portal

Detection signals:

  • Vendor record changes with no verified change request behind them
  • Routing numbers that don't match the vendor's known bank
  • Several vendors suddenly moving to the same receiving bank

ACH Origination Abuse​

You send payment instructions through your ODFI. That makes you an originator. Abuse of that access is its own risk.

Scenarios:

  • Someone uses your origination credentials to pull money from third parties
  • Fake entries added to a legitimate payment run
  • Credential theft on your bank's ACH origination portal

Your liability: you own every transaction you send. Someone else uses your access? Nacha still puts the returns and the damages on you.

Insider Threats​

Your AP clerk, bookkeeper or controller can already move money. That's the whole problem.

Common schemes:

  • Ghost vendors: Fake vendor records, payments routed to a personal account
  • Payment splitting: A real vendor payment, plus a small second one to themselves
  • Check-to-ACH conversion: They convert a check to ACH and redirect it
  • Overbilling collusion: Employee and vendor inflate invoices and split the excess

Why it goes undetected: the thief usually reconciles the accounts too. No segregation of duties, no second set of eyes.

Prevention Controls​

It's procedural work, nearly all of it. No fraud score catches a clean-looking payment to a fraudster's account.

ControlWhat It PreventsImplementation
Dual authorization for new payeesGhost vendors, BECTwo people must approve any new vendor in the master file
Dual authorization for banking changesBEC, account manipulationTwo people must approve any change to vendor bank details
Out-of-band verificationBECCall vendor at a known phone number (not from the email) to confirm banking changes
Micro-deposit or API verificationWrong account, manipulationVerify new bank details with test deposits or bank API before sending real payments
ACH Positive PayUnauthorized originationBank-side control that matches outbound ACH against your authorized payee list
Segregation of dutiesInsider fraudPerson who enters payments is not the person who approves them
Vendor master file auditsGhost vendors, stale recordsQuarterly review of all vendor records - flag dormant vendors, duplicate tax IDs, PO box-only addresses
Payment threshold alertsLarge-dollar fraudAutomatic alerts for payments above a set threshold

The Non-Negotiable Three​

If you do nothing else, do these:

  1. Dual authorization on banking changes. No single person gets to change where payments go. Period.
  2. Out-of-band verification for new bank details. Call the vendor at a number you already had on file. Never use contact info from the email asking for the change.
  3. Segregation of duties. Whoever enters the payment doesn't approve it.

ACH Origination Compliance​

Originate ACH and the Nacha rules bind you. Whether you know it or not.

Originator Responsibilities​

  • Authorization: Every transaction needs one, on file
  • Return liability: Every return is yours, unauthorized ones included
  • Data accuracy: Account numbers, routing numbers and amounts must be right
  • ODFI agreement: Your bank's contract spells out your duties. Read it

Entry Class Codes That Matter​

SEC CodeNameUse Case
CCDCorporate Credit or DebitBusiness-to-business payments (vendor, supplier)
PPDPrearranged Payment and DepositPayroll, employee reimbursements
CTXCorporate Trade ExchangeB2B with addenda records (remittance data)

Why it matters: use the right SEC code and account type. Unauthorized business debits and consumer debits have different bank return deadlines. These debit rules don't describe a vendor credit you sent.

Unauthorized Return Exposure​

A transaction comes back unauthorized. R29 corporate, R10 consumer. You're on the hook:

  • You have to accept the return
  • Your ODFI may charge you a fee
  • Repeat offenders lose origination privileges

If Outbound ACH Goes Wrong​

Act Immediately​

Ask your bank's fraud team for a recall and its indemnity process. Returning the funds is voluntary even within the first 24 hours. The receiving bank must advise your bank of its decision or status within ten banking days of receiving the request. Recovery isn't guaranteed.

Response Checklist​

For an ordinary merchant, report the fraud to your bank and law enforcement. Let the bank handle its SAR obligations.

Immediate (first hour):
[ ] Call your bank's fraud team - phone, not email
[ ] Request an ACH recall with transaction details
[ ] Ask about the bank's Hold Harmless or letter-of-indemnity process, if applicable
[ ] Freeze any pending payments to the same account
[ ] Preserve all evidence (emails, change requests, approvals)
[ ] Promptly file a detailed FBI IC3 report at ic3.gov, including the banking details
[ ] Contact local law enforcement directly for this time-sensitive fraud

Within 24 hours:
[ ] Notify your cyber insurance carrier (if applicable)
[ ] Begin internal investigation - who approved, what process was followed

Within 1 week:
[ ] Complete internal investigation
[ ] Identify control failures
[ ] Implement corrective controls

Recovery Is Uncertain​

Report the fraud immediately, even if you find it late. Ask the bank about stopping an unsettled payment or recovering settled funds. A sender-error reversal isn't a general fraud recall.

Next Steps​

Setting up outbound ACH controls?

  1. Put dual authorization on vendor banking changes. Highest-ROI control you have
  2. Write the out-of-band verification procedure. See the BEC prevention framework
  3. Ask your bank about ACH Positive Pay. It matches payments to your approved payee list

Already sending outbound ACH and worried about gaps?

  1. Audit the vendor master file. Dormant vendors, duplicate tax IDs, PO box addresses
  2. Check who can change vendor bank details. Segregation of duties matters
  3. Read your ACH origination agreement. Know what you signed

Dealing with a suspected outbound fraud incident?

  1. Call your bank and request a recall. Every hour counts
  2. File with FBI IC3 at ic3.gov, even if recovery looks hopeless
  3. Work the BEC response playbook

Something wrong on this page? Email matt at paymentsandrisk.com and say what needs fixing.