ACH

Security Methods

ODFI verifies the individual during enrollment before opening an account.

Know Your Customer (KYC), Customer Identification Program (CIP) background checks, etc.; ID verification of a ‘carbon-based lifeform’.

ODFI employee training

Comply with the requirements of regulator(s) in developing a risk based compliance program.

Risks

Financial institution legacy accounts may lack Know Your Knowledge (KYC).

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Synthetic Identity: Use of stolen identity information combined with fraudulent information to create a new ‘synthetic’ identity which is used to open fraudulent accounts and make fraudulent purchases. Strong enrollment processes may help mitigate synthetic identity risk throughout the transaction process.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Sensitive Data used to enroll or open an account:
Name
Date of Birth Address
Social Security Number
Demand Deposit Account Number (DDA)
Savings Account Number (SAV)
Loan Account Number

Risks Associated with the Sensitive Payment Data

If compromised, this data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes.

Security Methods

Per the National ACH Association (NACHA) Operating Rules, establish commercially reasonable methods of authentication to verify the receiver.

Risks

Fraudulent use of account.

Synthetic Identity: Use of stolen identity information combined with fraudulent information to create a new ‘synthetic’ identity which is used to open fraudulent accounts and make fraudulent purchases. Strong enrollment processes may help mitigate synthetic identity risk throughout the transaction process.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Security Methods

ODFI authenticating the originator – Federal Financial Institutions Examination Council (FFIEC) Guidance “Authentication in an Internet Banking Environment” applies. Authentication techniques include: shared secrets, tokens, Smart Card, password-generating tokens, biometrics out-of-band authentication, and one-time passwords.

Section 1.6 Security Requirements applies; for internet-initiated debits (WEB), Subsection 2.5.17.4 applies. Additional ODFI Warranties for Debit WEB Entries, including use of fraudulent transaction detection system and commercially reasonable methods to authenticate the identity of the receiver

Section 1.7 Secure Transmission of ACH Information via Unsecured Electronic Network applies

Participants in the payment transaction may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Employee training

Consumer and corporate customer education

Device log-on (if used)

Encryption

Debit Block and ACH Positive Pay for Corporate Customers

ODFIs have Know Your Customer (KYC) responsibilities for third-party payments they originate.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover

Social Engineering, which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Destination account compromise (e.g. payment redirect due to third-party compromise)

Billers typically work through their financial institutions for origination; independent origination is suspect in account takeover era.

Unauthorized authentication; no end-to-end encryption to protect the access keys in all the pieces of the ACH network.

Third-party sender risks when the ODFI does not have a direct business relationship with clients of a third-party sender.

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Account Holder Data (must be protected wherever it is processed, stored or transmitted):
Company ID (often times a Tax ID originator)
Company Name (originator)
Beneficiary Account Number
Beneficiary RFI ABA
Beneficiary Name

Specific to ACH File:
Consider anything that could be used to pass an authentication method
XML Extended Data
Initiator
Total Dollar Amount

Sensitive Addenda Data (must be stored):
Data that may accompany or describe a financial transaction that is not required to process the transaction (e.g. airline or train ticket numbers, hotel confirmations, invoice numbers, insurance policy numbers)
Account numbers
Invoice numbers
Address information
Government tax information

Risks Associated with the Sensitive Payment Data

Compromised ACH data can be used by a criminal to create a fraudulent credit/debit ACH file. This requires a customer to be onboarded as an ACH origination customer.

Criminals can print fraudulent or counterfeit checks using the ABA and account number obtained through compromised ACH data.

Additional compromised data, including Health Insurance Portability and Accountability Act (HIPAA), account, invoice and address data could be used for fraudulent account setup and account takeover.

Risks

Auto-debits, where billers control financial institution account access, present additional data to be protected (at rest and in transit).