What are the regulations, timelines, and limitations when someone contests an ACH payment, after the payer's bank rejects an initially successful transaction?

1) Normal ACH Payment Returns: 

Most ACH payment returns are automatic, not buyer-initiated (for example, the return reasons are typically "invalid account number" or "insufficient funds"). These returns will usually post back to the ProPay account within 7 days of the initial payment, and funds are immediately returned. If these funds have been withdrawn from the ProPay account prior to the return, the ACH payment return will create a negative debit against the account and will impact the balance accordingly.

2) Disputed or "Unauthorized" ACH payment returns: 

ACH returns for "unauthorized" reason codes (R05, R07, R10, R29, and R51) are the rough equivalent of disputes, and the bank account holder usually initiates them. These types of returns have a 60-day time frame to be issued, and the payer's bank can issue them even later, if they reach out to ProPay and request proof of authorization before doing so. Merchants should work directly with the the payer to arrange an alternate method of payment for a payer-initiated ACH dispute (a.k.a, reversal, reject, or refusal).

Per section 50 of the ProPay merchant payment services agreement:

"All disputes between you and any of your customers relating to any ACH transaction must be resolved between you and that customer. If ProPay receives any notice of an ACH dispute or NACHA inquiry, we will forward such notice directly to you. ProPay bears no financial responsibility for any disputed transaction. You must maintain an unauthorized return rate, as described in the NACHA Regulations, below 0.5% of originating debits."

ProPay tracks the rate for ACH returns for these "unauthorized" reasons in order to notify merchants at risk of violating the 0.5% NACHA threshold.

ProPay is bound to follow NACHA rules regarding ACH payments. The account holder of the account from which payment is drawn can claim a payment was not unauthorized (under the "unauthorized" reason codes) and their bank decides whether to accept that claim and process a return. If the bank elects to honor he request and process the return, ProPay has no means of contesting an ACH return (with the exception of procedural errors), and the system immediately return the transaction funds from the ProPay account to the payer's bank account.

3) Proof of Authorization Requests

In some cases (most commonly, when a payment is disputed as "unauthorized" and is older than 60 days) the payer's bank will first send a formal "proof of authorization request" before actually issuing a return, asking ProPay to provide corroborating documentation from the merchant for the payment in question. All merchants are obligated to obtain, and keep on file, proof of the ACH account holder's authorization for the payment for 2 years. This document could be a signed invoice or contract for ongoing payments, a copy of a check (this is the safest option), or a web-based "click-to-agree" capture.

When ProPay receives a proof of authorization request, we have a short time frame (7-10 days, typically) to obtain these documents from you and respond to the requesting bank. Failure to respond or have proof documentation on file is considered a violation of NACHA rules and can eventually result in fines, for which the merchant is responsible.

What sort of ACH fraud should I we wary of, and what are the risks of processing ACH payments? 

ACH payment processing carries unique risks:

  • There is no up-front decline of an ACH payment. Even a payment processed to a non-existent account number (or one with sufficient funds) may not come back as "returned" for as long as 7 days. This delay before rejection sometimes allows customers/tenants to perpetually keep making new ACH payments and abuse this time-frame.
  • There is no account holder name validation. We see fraud trends where customers/tenants will use stolen ACH bank account numbers under their own name or a bogus name to pay our merchants. Because no validation of the account holder name happens when processing an ACH payment, these result in losses, as the bank account holder is a different name from the customer named in the proof documents.
  • There is no avenue for proving the validity of a payment or contesting a return. ACH Payment returns are decided by the account holder's bank, and there is no means of contesting them (other than for procedural errors) per NACHA rules. Requests for proof of authorization are initiated by the payer's bank, and we will respond to them with whatever documentation we can obtain from the merchant/partner. These are typically only done where a return is later than 60 days from the time of payment, and the payer's bank account makes the final decision on whether to allow the return based on the proof we provide.

Merchants and Partners should take all of these factors into account when determining risk-mitigation practices for verifying and screening payers and the type of payments accepted.