Loading story…
The National Automated Clearing House Association (Nacha) has announced revised fraud monitoring rules for financial institutions, aiming to strengthen the detection and prevention of fraudulent transactions within the ACH network. Under the proposed 2026 rules, banks and other financial institutions must now demonstrate that their fraud monitoring practices are 'reasonably intended' to identify fraud, moving beyond the previous standard of merely being 'commercially reasonable.' This shift emphasizes the effectiveness of fraud detection outcomes rather than adherence to industry benchmarks, requiring institutions to take proactive measures against suspicious activity.
Devon Marsh, Nacha's managing director for ACH network rules and risk management, clarified that simply maintaining routine or low-value monitoring is insufficient, and inaction on fraudulent transactions will not be tolerated. Institutions must be able to justify their monitoring processes to auditors and compliance officers, ensuring that their efforts are outcome-focused and responsive to evolving fraud tactics. The new rules are designed to raise the bar for fraud risk management across the ACH ecosystem and hold financial institutions more accountable for preventing financial crime.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Nacha revised its fraud monitoring rules for financial institutions, according to the referenced reports. No additional details or a more specific event date are provided in the source content.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using **generative AI** to industrialize crypto-enabled fraud, turning scams into high-volume, rapidly iterated campaigns that leverage automation, personalization, and synthetic identities. TRM Labs reported illicit crypto transaction volume of **$158B in 2025** (up ~145% YoY) and estimated **~$30B** in scam-related activity, noting an observed **~500% increase** in AI-enabled scam activity over the past year; cited tactics include AI-assisted phishing/impersonation and automation that can accelerate laundering workflows. Despite the speed and scale gains for criminals, TRM emphasized that blockchain transparency still provides defenders an advantage because on-chain activity remains observable for clustering, anomaly detection, and forensic investigation when paired with defensive analytics. Financial institutions are also adjusting fraud detection strategies to better address cross-entity, fast-moving fraud—especially in **instant payments**, where decision windows can be seconds. BankInfoSecurity described a shift from single-institution anomaly detection toward **shared network intelligence** that correlates relationships among accounts, devices, and identities across organizations to identify mule networks and risky counterparties that may appear “new” at one bank but are already flagged elsewhere. The approach is positioned as a new detection surface that complements machine learning by focusing on *connections* and ecosystem visibility, reducing attackers’ ability to exploit intelligence gaps between institutions.
Jun 29, 2026
Cybersecurity and fraud-risk leaders are urging stronger, enforceable security controls as the U.S. **Department of the Treasury** develops AI cybersecurity and risk-management guidance for the financial sector. Reported expectations for the forthcoming materials include coverage of **governance**, **data practices**, **fraud**, **transparency**, and **digital identity**, but analysts warned that non-mandatory “principles” risk being ineffective as **AI-enabled attacks** increase. Recommended guardrails include mandatory **adversarial testing**, maintaining an **AI inventory**, **model monitoring**, and **real-time identity validation**, with specific concern for threats such as **data poisoning** of training pipelines. In parallel, financial institutions deploying **agentic AI** (systems that can initiate payments, approve transactions, or freeze accounts) are being warned that traditional authentication models assume a human user and do not adequately address autonomous or semi-autonomous agents. Fraud and AML specialists are calling for **managed, revocable digital identities** for AI agents—ideally with **cryptographic proof**—and **continuous trust** approaches that validate not just identity but **delegated authority**, detect “scope creep,” and preserve traceability to both the authorizing human and the executing agent.
Jun 29, 2026
Banks and payment providers are warning that **deepfakes** and agentic AI are increasing fraud pressure on digital payments, particularly where identity verification, authorization, and anti-money-laundering controls depend on signals that can be spoofed. Deloitte highlighted rising concern that AI-generated voice and video can be used to impersonate customers and defeat banking verification workflows, while other industry reporting noted warnings that deepfakes could bypass AML and identity checks and expose institutions to higher account takeover and payment fraud risk. At the same time, firms are adapting payment infrastructure for AI-driven commerce rather than allowing autonomous models to move money without guardrails. Industry analysis said payments remain difficult for AI agents because settlement requires licensed intermediaries, deterministic execution, regulatory compliance, and clear liability for fraud and errors. Providers are responding with agent-focused controls such as wallet-based authorization, token protections, and abuse detection, reflecting a broader shift toward **constrained, supervised AI payments** instead of fully autonomous transaction execution.
Aug 4, 2026