Most Asked Question
Q. What do we do if we notice suspicious unemployment benefits (ACH credits) posting to our account holders' accounts and the names on the transactions don't match the names on the accounts? In some cases there are multiple deposits to one account. Are we liable as an RDFI?
A. If the entry posts automatically to a valid account, the RDFI is not liable (except for payments that are subject to reclamation). If an entry is deemed suspicious or fraudulent, your next steps should be to notify your BSA Compliance Officer and follow your BSA/AML procedures. Financial institutions don’t have to make the funds immediately available. Regulation CC allows for the funds to be held while an investigation is being conducted. If you, as the RDFI (or together with the account holder), decide the entry is to be returned, you should use the ACH return reason code that best fits the situation. If the account holder claims it’s not theirs, return it R23 (no return timeframe). In some instances, the R17 return code sends the best message but keep in mind that “QUESTIONABLE” must be listed in the addenda of the return (2-day return timeframe). R03 is another option when the name on the account doesn’t match (2 day timeframe). We have spoken to Nacha and timely returns are encouraged. In this particular wave of fraud, the ODFIs are likely not requesting R06 returns as RDFIs would want a Letter of Indemnification. Focus on the best return reason codes - R23, R17 and R03 will be your best line of defense.
We will continue to communicate with our payments industry partners and provide additional details, when available, via the Payments Pulse newsletter and TCHPA home page.