Nacha Activates Phase 2 Fraud Monitoring: Volume Thresholds Eliminated

What Phase 2 changes for ACH originators

The most consequential shift is the removal of the volume threshold itself. Phase 1 captured high-volume originators and processors first, giving smaller players a grace window. That window is gone. Whether a firm pushes ten ACH transactions a month or ten million, the same risk-based monitoring obligation now applies, and Nacha expects documented procedures rather than a checkbox attestation.

This is a move from simple account validation to holistic user identity tracking. Validating that a routing and account number resolve to an open account does nothing to catch a credential that has been hijacked or a vendor record that was quietly edited. Phase 2 asks originators to understand who is actually behind each origination instruction, not just whether the destination account exists.

For most teams, the operational reality is that legacy account-verification tooling will not satisfy an examiner. Nacha wants evidence that you can spot anomalies against an established baseline, which means you need a behavioral and identity signal layer feeding your decisioning before funds move.

Why false-pretenses fraud is the real target

The rule is aimed squarely at false-pretenses fraud — schemes where a legitimate party is tricked into authorizing a payment that goes to a criminal. That category covers business email compromise (BEC), corporate vendor impersonation, and payroll diversion. In each case the ACH transaction is technically valid: the account exists, the credentials check out, and the originator believes the instruction is genuine. The fraud lives in the identity and intent behind the request, not in the mechanics of the transfer.

That is precisely why account validation alone fails here. A diverted payroll deposit or a redirected vendor invoice will pass every structural check while draining real money. Catching it requires baseline user patterns and the ability to flag deviation — a sudden change in a vendor's banking details, an off-hours origination from an unfamiliar device, or a payroll batch that breaks an established rhythm.

Meeting the standard before funds leave the network

The hard part of Phase 2 is timing. Nacha wants firms to establish baseline user patterns and identify anomalies *before* a transaction leaves the network, not reconstruct what happened after a recall request lands. Post-settlement review is too late; ACH recalls are slow and frequently unsuccessful once funds have been withdrawn downstream.

This is where real-time signal validation does the work that batch account checks cannot. deepidv runs automated forensic layers across the identity and device signals tied to each origination, scoring deviation from an established baseline as the instruction is processed rather than after the fact. That gives originators, TPSPs, and TPSs a defensible, documented basis for the risk-based monitoring the rule now requires.

Two capabilities make the standard practical to hold. Continuous transaction monitoring keeps a live behavioral profile for every originating party, and ongoing continuous monitoring of the underlying identities surfaces drift — a re-used credential, an impersonated vendor, a tampered profile — before it converts into a settled loss. Together they turn Phase 2 from a paperwork exercise into an enforceable control.