Understanding ACH and Digital Payment Fraud

How fraud happens and what businesses can do to help prevent it

An Interview with Mark Laskoski, Director of Fraud Risk Management

As businesses rely more on digital banking and ACH payments for day-to-day operations, fraudsters are finding new ways to target those transactions. ACH fraud happens when an unauthorized person initiates or attempts to manipulate an electronic payment, while digital fraud can include stolen login credentials, payment scams, and other tactics designed to trick employees into sending money.

Because electronic payments can be processed quickly, businesses may have a limited window to identify and respond to unauthorized activity before funds are transferred. Knowing how these schemes work is one of the best ways to reduce risk and help protect company funds.

To break down what businesses should watch for, we spoke with Mark Laskoski, Director of Fraud Risk Management at Five Star Bank, about common fraud threats and practical steps companies can take to better protect themselves.

Q: How do ACH and digital payment fraud typically happen?
Mark: A lot of fraud starts with someone getting access to information they should not have, which often occurs through a phishing email, weak password, or other tactic designed to steal login credentials. Once fraudsters obtain access to sensitive information, they may attempt to initiate ACH payments, submit unauthorized ACH debits, redirect vendor payments, move funds, or change account information. Businesses also need to watch for unauthorized ACH debits, where money is withdrawn without proper approval. These transactions can be easy to miss if accounts are not reviewed regularly. Tools like ACH Positive Pay can help organizations review and control ACH activity, while strong access controls can limit who is able to initiate transactions.

Many organizations are also targeted through Business Email Compromise (BEC), where criminals impersonate executives, vendors, or trusted business partners to convince employees to send payments or change account information. 

Q: Why are social engineering scams so effective?
Mark: Social engineering works because it leverages normal human behavior, taking advantage of our natural tendencies to trust, be curious or want to help. It also requires only one employee to make a mistake. Instead of breaking into a system, a fraudster will try to pressure someone into acting quickly before a request can be verified. An employee might get an email that looks like it came from a trusted vendor asking to update payment instructions, or a phone call that creates urgency around a wire transfer. These requests can seem very convincing, so businesses should confirm payment changes or money movement through a separate, trusted channel. This is why we always tell our customers that at Five Star Bank we will never call, text, or email asking for login credentials or security codes.

Q: What are the most important steps businesses can take to prevent fraud?
Mark: A strong fraud prevention plan starts with good internal controls. That means limiting account access to employees who truly need it, separating payment responsibilities when possible, and reviewing account activity often. Multi-factor authentication, transaction controls, approval limits, and account alerts can also help businesses spot unusual activity and review payments before they go out. Depending on the organization’s needs, services such as ACH Positive Pay and debit blocks can add another layer of protection by helping detect or stop unauthorized transactions.

ACH and digital payment fraud will continue to change, but businesses can lower their risk by understanding common scams, reviewing activity regularly, and building simple safeguards into everyday processes.

To learn more about fraud prevention tools and ways to help protect your business accounts, visit the Five Star Bank Security Center.