Fraud attempts continue to plague organizations across the U.S. – in fact, the 2026 AFP Payments Fraud and Control Survey Report‡ reports that 76% of organizations experienced attempted or actual fraud in 2025. That staggering number demonstrates the pressure companies and institutions are under to stay aware, and ahead of, emerging threats.

In institutional banking, our clients often operate with large sums of money across several payment types, which creates inherent risk within money movement requests. Because of this, fraud prevention planning is critically important for our clients. And fraud risks remain even in cases where all documented protocols are followed. So how can your organization build a fraud management strategy that works?

Could fraud happen to your organization?

Scammers and their schemes become more sophisticated by the day, and these criminals target companies of all sizes. According to AFP’s data, wire transfers, ACH transactions and checks were some of the most reported payment fraud types last year. Overwhelmingly, the top method bad actors used to manipulate and access these payments is through business email compromise (BEC).

Fraud scenario to consider:

  • A malicious actor has hacked your email and sent a request to your finance team asking them to wire funds to an existing vendor, noting that the timetable on the project has been moved up and the vendor needs to be paid the next day. The amount requested for transfer is in line with other payments to this vendor. This request may also include a note about changing payment instructions for a plausible reason.
  • The fraudulent email also informs your finance team that you received a new payment request with new bank account details for the vendor.

If this scenario were to play out in real life, how certain are you that you or your employees would catch that the email was a fake before the wire transfer request was fulfilled? When emails look like they are from a known account, include no suspicious links and ask your team to pay an existing vendor, the red flags become harder to spot.

Training your team should go beyond vigilance. It’s recommended that you implement well-established workflows that require independent, multi-user verification before any high-risk transaction is processed. These same strategies can help prevent fraud carried out by insiders, such as billing and procurement schemes, expense abuse and corporate card misuse.

Building your fraud-management strategy

A practical fraud-management strategy layers controls across governance, people, payment processes and technology. No request should rely on one person’s judgment alone. The following measures can help companies reduce payment and invoice fraud while strengthening their wider fraud-control framework.

  • Separate duties. No person should be able to add or change a vendor, initiate a payment, approve it and reconcile the account without additional oversight and approval flows. Limit system access and payment authority to the responsibilities of each role.
  • Treat a bank verification call as a reason to pause. Do not release the transaction until all additional authentications are complete.
  • Establish predefined payment instructions; never vary from those instructions unless changes are thoroughly verified through multiple channels.
  • Strictly limit the number of employees in your organization who have the authority to approve and/or conduct wire transfers.
  • Establish an internal protocol by which wire transfer requests sent by email are always validated through another communication channel or through a multi-factor authentication.
  • Always verbally confirm changes in payment instructions for a vendor using contact data on record, not the contact information that included in the email requesting the change. Maintain a list of vendor contacts who you know are authorized to approve wire instruction change requests.
  • If you’re contacted by a bank to verify a wire transfer, delay the transaction until additional verifications can be performed.
  • In your internal processes, require dual approval for any wire transfer request involving the below example parameters:
    • A dollar amount over a specific threshold
    • Trading partners who have not been previously added to a list of approved trading partners to receive wire payments
    • Any new trading partners
    • New bank and/or account numbers for current trading partners
    • Wire transfers to countries outside of the normal trading patterns
  • Train employees regularly with realistic examples of BEC, invoice manipulation, account takeover, expense abuse and insider fraud.
  • Implement clear reporting and escalation processes to ensure employees know a clear path for flagging and delaying payments until completely verified.
  • Protect email and payment systems with multifactor authentication and other access controls enabled for your internal systems and processes.

Nacha fraud monitoring rules for 2026

For institutions that originate ACH entries, fraud monitoring is now also a rules requirement. The 2026 Nacha Operating Rules‡ expanded requirements across ACH participants in 2026:

  • All non-consumer originators, third-party senders, and third-party service providers that perform ACH processing functions must establish risk-based processes reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses.
  • Covered parties must review their processes at least annually and update them for evolving risks.

The rules do not prescribe one technology or require every entry to be screened before processing. They do require a risk assessment and procedures suited to the party’s role in the authorization or transmission of entries. For an ACH originator, that may include controls over vendor and payroll changes and monitoring for unusual volume, velocity, dollar amounts or transaction types.

The annual review is a useful discipline beyond ACH. Fraud controls should change as payment patterns, staff responsibilities and fraud techniques change.

This content is provided for general informational and educational purposes only. It is intended to help raise awareness of common fraud risks and prevention practices. It does not constitute legal, financial, or other professional advice, and should not be relied upon as a substitute for advice tailored to your specific circumstances. Fraud techniques evolve continually, and no set of precautions can eliminate the risk of fraud entirely. Following the guidance in this article does not guarantee that fraud will be prevented or detected, and UMB does not warrant any particular outcome.

When you click links marked with the “‡” symbol, you will leave UMB’s website and go to websites that are not controlled by or affiliated with UMB. We have provided these links for your convenience. However, we do not endorse or guarantee any products or services you may view on other sites. Other websites may not follow the same privacy policies and security procedures that UMB does, so please review their policies and procedures carefully.