ACH (Automated Clearing House) is an electronic network for financial transactions in the United States.

ACH is used by financial institutions to handle direct deposits, checks, bill payments and cash transfers between businesses and individuals. According to several sources online, to pull off an attack. All you need is an account number and a bank routing number.

What protections are in place to protect banks and consumers during ACH transactions?

What type of exploits are currently being leveraged against ACH transactions?

  • This is pretty broad. Try narrowing the threat surface down. Apr 1 '15 at 12:17

Currently, the only way to protect against ACH are detective controls which should be in place at the business and the bank. Most fraud gets detected after accounts get reconciled or after a customer complains that his account was used without authorization. In case of a bank, if a company only uses it for payroll payments and those payments occur once a month, transactions occuring outside the normal period should be looked into.

Consumers need to alert their institution within 60 days in order to recover funds. Businesses, however, only have as little as one business day. Therefore, monitoring becomes critical. Daily review of the credits and debits of the business is essential in detecting fraudulent activity.

Companies using ACH set up accounts that would either only accept ACH credits or issue them. As ACH expanded past the payroll, social security payment or repetitive bill-pay solution, moving into mainstream transactions, the direct relations were lost between the two parties and this opened a gate for fraud.

Common fraud schemes against the banks include setting up fake companies, getting on the ACH network, issuing lots of transactions to a single account and then emptying that account, leaving the bank behind with the losses. This is called ACH kiting.

Then there's also typical fraud where an attacker gets access to a company's network and just adds transactions in the transaction file or just executes transactions on behalf of the company.

Note that ACH was never designed to fullfil the task it's currently used for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.