In 2020 nearly $62 trillion moved through the ACH Network, which was record growth. With that growth came the opportunity for fraudsters to scam the system and steal money. Because of the industry’s move towards real-time payments and the increase in fraud, Nacha determined it was time to improve fraud detection on the ACH Network. So, what does the Nacha rule mean for your utility or municipality? First, you need to understand what Nacha and the WEB Debits Account Validation Rule are.
What Is Nacha?
Nacha (formerly known as the National Automated Clearing House Association) is the governing body of the ACH Network (Automated Clearing House Network). ACH is a system that electronically transfers funds to facilitate payments in the United States. Nacha is a self-regulating institution that manages, develops, administers, and rules the ACH network, and its purpose is to facilitate the size and scope of electronic payment growth within the network. Nacha was responsible for enacting the WEB Debits Account Validation Rule to prevent fraudulent use of the ACH Network.
What Is the WEB Debits Account Validation Rule?
As consumer demand grows for faster online payments and payments get closer to real-time, Nacha is taking steps to increase security measures by using account validation in WEB debits.
On March 19, 2021, the WEB Debit Account Validation Rule will take effect. This rule (Article Two, Subsection 2.5.17.4 of the Nacha Operating Rules), proposed in November 2018, was scheduled to take effect in January 2020, but Nacha delayed it because of COVID-19. When the rule goes into effect this March, ACH originators will be required to validate the debited account as part of the fraudulent transaction detection process they currently have in place.
How Does This Change the Current Requirement to Protect Against Fraud?
And, what do you need to do about it?
At this time, WEB debit originators must use a “commercially reasonable fraudulent transaction detection system”. After March 19, 2021, when your utility or municipality uses a new customer account for a WEB debit payment, it must be validated as a real account. If at any time your customer changes the account number after initial validation, then the account must be revalidated. This rule applies only to ACH payments and validating bank account numbers, not credit card numbers or credit card payments.
This rule is not retroactive and only applies to new customer accounts. If one of your customers has submitted a WEB debit transaction prior to March 19, 2021, then that account will not need validating, unless the customer gives you a new bank account number. If a customer has used an account number for a non-web debit and it was a successful payment, then that account is valid, and the account holder can use it for WEB debits. Because your customers have used their accounts before, then the account can be verified as a real account, so you don’t need to validate it, no matter if the customer is using it for WEB or non-web transactions. Validation only happens with new bank account numbers.
What Does It Mean to Validate an Account?
As a minimum requirement, the originator must take reasonable action to determine if the account is a legitimate, open account that the RDFI (Receiving Depository Financial Institution) can post ACH entries. However, at this time, account ownership proof is not required in the minimum standards. Nacha has left it to the originators to determine if they will validate ownership as well as the account’s legitimacy.
Does Nacha State How the Validation Must Occur?
Nacha does not state what technology or method can be used to validate the account, and they are neutral on how the validation occurs. Account Validation can be in the form of:
• Prenotification entry,
• ACH micro-transaction verification,
• ODFI or third part commercially available validation services, or
• API enabled account validation capabilities or services.
Originators will need to determine what “commercially reasonable” means they will use to validate an account. For more information about the above methods, visit the Nacha FAQ.
What Kind of Payments Are Affected?
The following kinds of WEB debit payments may need validating:
• Insurance premium payments,
• IRA, SEP, 401K contributions,
• POS purchases,
• Utility payments,
• Tax payments,
• Charitable donations,
• Installment loan payments (car loans, credit cards, mortgages, HELOCs), and/or
• Membership payments.
Why Was This Rule Enacted?
All ACH originators who accept WEB debit entries have been required to use a “commercially reasonable fraudulent transaction detection system”, and they are the first line of defense against fraudulent or incorrect/unauthorized payments. But, with a recent increase in fraud, Nacha determined that although originators were required to have a system in place, they were not using it effectively or at all.
Nacha enacted this rule at a time where ACH WEB payment processing is at an all-time high. In the fourth quarter of 2020 alone, there were 7 billion online payments made through the ACH payment network. That’s an 8.9% increase over the same period in 2019, and volume has increased more than 1 billion every year for the last 6 years.
With this growth has come an increase in fraud and chargebacks, which are costly for both businesses and consumers. Account validation is a major fraud deterrent and protects funds from being deposited in fraudulent accounts or incorrect accounts. Because verification is at the beginning of the payment process, it is the best place to stop fraudsters, and Nacha is taking steps to ensure that all accounts are true accounts.
So what does this new rule mean for your utility or municipality? Find out in our upcoming webinar with our partners Invoice Cloud and Paymentus. We’ll explain how to prepare for this new rule during the coming year. And, if you have any questions, just reach out to our customer support team or ask questions in the comments below.