What's Good Enough? ACH Fraud Monitoring, WEB Entries, and Risk Management
Wrestling Payments Podcast: Season 4 - Episode 12
Episode Summary
In this episode of Wrestling Payments, host Joe Casali welcomes NEACH and NEACH Payments Group experts Sean Carter, Caitlyn Mullins-Smith, and Averee Jimenez for a candid discussion about what financial institutions are actually experiencing in the field when it comes to ACH fraud monitoring, WEB entries, unauthorized returns, and risk management. Drawing from audits, consulting engagements, and operational reviews, the group explores the growing gap between what institutions believe they are doing and what the Nacha Rules actually require.
The conversation begins with the industry's ongoing adjustment to ACH fraud monitoring requirements. The panel discusses how fraud monitoring is no longer solely the responsibility of fraud or BSA teams and explains why operations staff, treasury management teams, and compliance officers must all work together to effectively manage risk. They highlight common misconceptions around fraud monitoring tools, vendor solutions, and the assumption that simply purchasing a product automatically satisfies regulatory expectations.
The discussion then shifts to WEB entries, where institutions continue to struggle with account-to-account transfers, consumer-to-consumer payments, account validation requirements, and statement disclosures. Caitlyn, Sean, and Averee explain why many findings stem from misunderstanding the rules rather than intentionally ignoring them, and why regular testing of vendor configurations is critical.
The episode also tackles one of the most frequently misunderstood areas of ACH operations: Written Statements of Unauthorized Debit (WSUDs). The group shares real-world examples of common mistakes, including unsigned statements, improper use of return reason codes, and failure to investigate disputes before processing returns. They examine why first-party fraud has become a growing concern and discuss the role RDFIs may increasingly play in preventing fraud across the network.
Finally, the panel dives into ACH risk management, exposure limits, originator reviews, and the importance of evaluating risk across all payment channels. Rather than focusing narrowly on credit risk, institutions are encouraged to consider the full risk profile of their customers, including operational controls, fraud exposure, treasury services, and payment activities across multiple channels. Throughout the discussion, one recurring question remains at the center: What is truly "good enough" when it comes to managing ACH risk?
Guests at a Glance
💡 Name: Sean Carter, AAP, APRP, AFPP
💡 What he does: President & CEO
💡 Company: NEACH and NEACH Payments Group (NPG)
💡 Where to find him: Sean Carter on LinkedIn
💡 Name: Caitlyn Mullins-Smith, AAP, APRP, NCP
💡 What she does: Vice President & Director
💡 Company: NEACH Payments Group (NPG)
💡 Where to find her: Caitlyn Mullins-Smith on LinkedIn
💡 Name: Averee Jimenez, AAP, APRP, NCP, CAMS
💡 What she does: Affiliate Payments Risk & Compliance Advisor
💡 Company: NEACH Payments Group (NPG)
💡 Where to find her: Averee Jimenez on LinkedIn
Key Insights
ACH Fraud Monitoring Requires More Than Technology
Many institutions assume that having a fraud detection solution means they are compliant with Nacha's fraud monitoring requirements. The reality is more complicated. Fraud monitoring requires institutions to understand exactly what their tools are doing, ensure monitoring covers originated activity as well as received items, and coordinate efforts across operations, fraud, BSA, and compliance departments. Effective fraud monitoring is not a vendor product. It is a documented, institution-wide process.
WEB Entry Compliance Depends on Understanding the Rules
WEB entry findings continue to appear because institutions misunderstand how consumer-to-consumer payments should be handled. The panel explains that account-to-account transfers and person-to-person transfers fall under the same ACH rule requirements. Financial institutions must properly validate accounts, ensure required information appears on statements, and confirm vendor configurations remain accurate even after system upgrades and changes.
Return Codes Communicate Risk Intelligence
Unauthorized returns, administrative returns, and stop payment returns are not simply processing mechanics. They communicate valuable information to ODFIs about originator behavior and potential compliance issues. Using the wrong return reason code can distort risk monitoring, limit meaningful due diligence, and create unnecessary exposure for institutions throughout the ACH network.
Risk Management Must Extend Beyond Credit Risk
ACH risk management is frequently reduced to exposure limits and prefunding. The panel argues that this view is too narrow. Institutions should evaluate the complete exposure an originator presents, including fraud controls, operational processes, cybersecurity hygiene, treasury management services, RDC activity, and payment behavior across channels. Managing ACH risk requires a holistic view of the customer relationship, not just available balances.
Episode Highlights
Fraud Monitoring Rules Reveal Operational Blind Spots
Timestamp: ~00:01:00 - 00:09:30
The panel discusses how institutions are adapting to newer ACH fraud monitoring requirements and why communication breakdowns between operations, fraud, and BSA teams remain one of the biggest challenges. Having monitoring tools is not enough if nobody understands what is being monitored or who is responsible for reviewing the results. The discussion emphasizes the need for practical, cross-department collaboration.
"A lot of the left hand not talking to the right hand going, 'Well, I thought you were doing this' or 'I thought you were doing this' and nobody really communicating who's doing what." – Averee Jimenez
WEB Entries Continue to Create Compliance Challenges
Timestamp: ~00:16:15 - 00:30:45
The conversation explores recurring misunderstandings around WEB credits, account-to-account transfers, statement requirements, and account validation. The panel explains why many institutions incorrectly assume disclosures alone satisfy the rules and why reliance on micro-entries or prenotes can leave significant gaps in risk management.
"Consumer to consumer has to be WEB credit. So now you have to throw out everything that you originally maybe hardwired in your brain." – Caitlyn Mullins-Smith
WSUDs, Return Codes, and First-Party Fraud
Timestamp: ~00:33:15 - 00:43:30
The group examines Written Statements of Unauthorized Debit and discusses why improper documentation, missing signatures, and incorrect return reason codes remain common findings. The discussion highlights growing industry attention on first-party fraud and the expectation that financial institutions perform meaningful investigations before processing unauthorized returns.
"You really need to make sure you're using those. And like Averee said, with being caught through monitoring, that's where R17, that's why Nacha came out and made all of those specifications and clarifications around that." – Caitlyn Mullins-Smith
What Actually Works in ACH Risk Management?
Timestamp: ~00:46:00 - 00:56:30
The episode closes with a deep dive into ACH risk assessments, exposure limits, annual reviews, and cross-channel risk management. Sean challenges institutions that focus exclusively on credit risk and argues that effective ACH risk management requires evaluating every aspect of the customer relationship.
"The rules do not mention credit risk anywhere. It talks about total exposure that a customer represents, that the originator represents to the ODFI." – Sean Carter
To hear this episode and many more like it, subscribe to Wrestling Payments on Apple Podcasts, Spotify, or wherever you listen to podcasts. And stay tuned for Part 2, where the team takes an even deeper dive into ACH risk management, fraud prevention, and what financial institutions should be doing right now to prepare for what's next.