ACH Recommended Practices

Posted on October 14, 2026 at 9:36 AM

Protecting Your Business from Fraud

10 Ways to Help Keep Your ACH Transactions Secure

Protecting your business from fraud starts with having the right safeguards in place. If your business sends payments through ACH Services, taking a few proactive steps can help protect your accounts, reduce the risk of unauthorized transactions, and keep payments running smoothly.

Here are 10 ways to strengthen your business's ACH security.

1. Require More Than One Person to Approve Payments

Having more than one employee involved in the ACH payment process adds an important layer of protection. Assign different people to create, review, and approve transactions so no single person manages the entire process.

For example: One employee prepares an ACH payment file, while another reviews and approves it before it's submitted.

2. Verify Account Information

Before adding a new payment recipient or updating existing account information, take time to confirm the details are correct.

Use available account validation tools or prenotifications when appropriate, and independently verify changes to payment instructions.

Remember: Even requests from vendors you've worked with for years should be verified before making changes to their banking information.

3. Use Multi-Factor Authentication

Multi-factor authentication (MFA) adds another layer of security when accessing Business Digital Banking.

SBT requires MFA at login using a physical security token or a token generated through an app on your phone. Keep your authentication devices and codes secure, and never share them with anyone.

4. Confirm Payment Changes Directly

Scammers may impersonate vendors, employees, or business partners to request changes to payment instructions.

Before updating ACH payment details, contact the person or business using a phone number you already know and trust. Don't rely solely on the contact information included in an email requesting the change.

For example: If a vendor emails new banking instructions, call your established contact to confirm the request before updating their account information.

5. Review ACH Activity Daily

Make it a habit to review your business's ACH transactions and account activity each day.

Look for unfamiliar payments, unexpected account changes, or transactions that don't match your records. Regular account reconciliation can help you identify potential issues sooner.

6. Establish Payment Limits

Setting appropriate ACH transaction limits can help reduce your business's exposure to unauthorized payments.

Review daily and individual transaction limits periodically to make sure they continue to reflect your business's payment needs.

7. Review Employee Access

Not every employee needs the same level of access to your business accounts.

Assign permissions based on each employee's responsibilities, review access regularly, and promptly remove access when someone leaves your organization or changes roles.

Never share usernames, passwords, or security credentials.

8. Keep Your Technology Secure

The devices and systems your business uses to manage payments are an important part of fraud prevention.

Keep security software, firewalls, and operating systems updated. Avoid accessing Business Digital Banking from public or shared computers, and use trusted, secure networks whenever possible.

9. Protect ACH Templates and Payment Information

ACH templates and saved payment details make routine transactions more convenient, but they should also be carefully managed.

Limit access to employees who need it, review stored payment information regularly, and remove outdated or unnecessary records.

10. Help Employees Recognize Fraud

Your employees play an important role in protecting your business.

Provide regular training on common fraud tactics, including phishing emails, suspicious payment requests, and attempts to change vendor banking information.

Make sure employees know how to report concerns and verify unusual requests before taking action.

Your Role in Protecting Your Accounts

Keeping your business accounts secure is a shared effort. As an ACH originator, your business is responsible for reviewing transaction activity promptly and notifying State Bank & Trust Co. immediately if you identify unauthorized or suspicious transactions.

Strong internal controls, regular account monitoring, and a team that knows what to watch for can make a meaningful difference in preventing fraud.