On October 8, Nacha issued a request for information (RFI) on first-party fraud in the ACH Network. It also requested comment on a proposed amendment to its operating rules that would clarify when a receiving depository financial institution (RDFI) must “promptly” recredit a consumer who claims an ACH debit was unauthorized. According to Nacha’s presentation, it identified three main variants of first-party fraud: (i) returns of debits used to fund newly opened accounts; (ii) false claims on bill payments, subscriptions, donations or purchases; and (iii) returns of debits used to fund digital wallets or other third-party accounts. In all variants, a person falsely claims to their financial institution that an authorized debit is unauthorized, and the financial institution returns the debit. The RFI seeks data on the scope of the problem and asks whether RDFIs should take on a defined role, whether standardized transaction data would help evaluate claims, and whether originating institutions should be able to present proof of authorization, including through a new arbitration process.

The proposed amendment to Section 3.11 of the Nacha operating rules is intended to clarify the timeframe in which an RDFI must recredit its customers during the dispute process. Nacha said some RDFIs read “promptly” as immediately or the same day, which may keep them from reviewing claims or starting a Regulation E investigation. Paired with a separate rule change on return timing, the proposal would let an RDFI review a claim up to the Regulation E provisional recredit deadline and then take up to six banking days to return the debit. The proposed effective date is June 18, 2027. Responses to both the RFI and the request for comment are due December 11.