MADISON, Wis.—With Phase 1 of Same Day ACH now in effect, credit unions are asking whether the payments process for originating depository financial institutions (ODFI) increases fraud risk.
That has been a common question CUNA Mutual Group has fielded in the last month, said Ken Otsuka, senior consultant, risk management, business protection with the company. Otsuka noted Same Day ACH brings with it additional fraud concerns, and during a Discovery 2016 session he outlined those additional risks and shared steps to mitigate them.
Same Day ACH is a new, faster payments option that reaches all financial accounts and enables businesses and consumers to send and receive payments and payment-related information on the same day through the ACH Network. It went into effect on Sept. 23.
Otsuka first emphasized that credit unions should not overreact to risk issues being shared by companies that offer fraud prevention solutions. “Much of the noise around Same Day ACH is being made by vendors that want to sell their fraud products,” he said.
Credit Transfers
The initial phase of Same Day ACH applies to originating ACH credit transfers.
“There might be some additional risk to credit unions as the ODFI of Same Day ACH. But one big question is, how many credit unions will offer Same Day ACH as it adds additional costs,” said Otsuka, who estimated that Same Day ACH for ODFIs adds about 5.2 cents per transaction.
The extra risk, explained Otsuka, comes from the ODFI having less time to catch a fraudulent transaction.
“However, credit unions electing to participate in Same Day ACH should already be complying with the FFIEC’s updated authentication guidance,” said Otsuka. “For example, credit unions should already have a fraud monitoring system in place to detect and stop fraud in real time. Also, credit unions should also be offering strong muti-factor authentication for online banking as well as possibly an out-of-band authentication method as well.”
Ken Otsuka, CUNA Mutual
Otsuka said credit unions have also been asking about the “biggest risk” with offering ACH origination services.
“Simply put, that is ACH debit,” said Otsuka.
Otsuka said the risk stems from the fact that the RDFI has up to two days to return an unauthorized ACH debit.
“We have seen a number of losses where members have originated (an unauthorized) ACH debit from an account outside the credit union for deposit in their CU account, and then the account holder withdraws those funds before the (unauthorized) ACH debit is returned by the RDFI,” he said.
Large Losses
Otsuka said CUNA Mutual has seen some large losses related to ACH debits applied to CU credit card balances as a payment.
“We call these ‘booster payments,’” said Otsuka. “For example, a member maxes out their credit card and then uses an (unauthorized) ACH debit to make a large payment toward that balance. As soon as the payment gets posted the member goes out and maxes out the credit card again. This can generally go on until the first unauthorized ACH debit is returned.”
Otsuka advised that credit unions allowing members to make credit card payments via ACH debit should first carefully qualify the member who would use the service.