First-Party Fraud: Nacha Wants Your Input

October 9, 2026 / Source: Nacha

First-party fraud isn’t new, but today it’s gaining increasing attention. In fact, a Nacha work group recently identified three main scenarios of first-party fraud, each of which has one underlying theme: a person falsely claiming to their financial institution (the RDFI) that an authorized debit is unauthorized, and the RDFI returns the debit (generally using Return Reason Code R10). 

That’s why Nacha is asking the payments community for your input, with both a Request for Information (RFI) and a Request for Comment (RFC).

In our RFI, we’re looking to identify the scope and significance of first-party fraud in the ACH Network. Among the issues we’d like to better understand is what percentage of entries RDFIs return as “unauthorized” may, in fact, have been authorized—and therefore could be cases of first-party fraud. As an ODFI, what percentage of incoming “unauthorized” returns do you believe were actually authorized? And for all FIs, do you track dollar losses related to first-party fraud, and what do you estimate the issue is costing ACH Network participants overall?

We’re also interested in your thoughts on a possible role for RDFIs, which are in a unique position to identify first-party fraud. Ideas include identifying high-volume unauthorized returns associated with accounts/consumers; understanding “erratic” account behaviors that correlate with money mule or first-party fraud activity; and calculating an “RDFI return rate” to benchmark against the industry average.

In the RFC, we ask you to consider a possible Nacha Rules change regarding an RDFI’s obligation to promptly recredit a Receiver. The proposal is aimed at providing clarity around when an RDFI must recredit its customers during the dispute process. The proposed Rule stipulates “the obligation of an RDFI to promptly recredit a Receiver under this Section 3.11 does not require the RDFI to recredit a Receiver’s Consumer Account before the RDFI incurs an obligation to provisionally recredit that Consumer Account under Regulation E, or to recredit a Receiver’s Non-Consumer Account before the expiration of a comparable period reasonably necessary to investigate the Receiver’s claim.”

You’ll find more information about the RFI and RFC here. All responses are due by Dec. 11.