Not long ago, creating a fake vendor convincing enough to fool a seasoned finance team would have required significant effort and expertise. Today, a few prompts can generate identities, documents, emails, and even video needed to make a fictional business look remarkably real.
Artificial intelligence has fundamentally changed the fraud landscape. Bad actors can now impersonate customers, employees, vendors, and executives—and scale those attacks with unprecedented speed. The result is a growing wave of fraud targeting both organizations and individuals, with business email compromise and phishing among the most prominent examples.
That evolution has also exposed a critical gap in traditional fraud protections. When a user is manipulated into authorizing a payment, the transaction may appear legitimate from the institution’s perspective—the customer authenticated, the payment was authorized, and the funds moved through legitimate channels. By the time the fraud is discovered, there may be little recourse. Addressing this gap was one of the main catalysts behind Nacha’s recent fraud rules update.
But Nacha’s rules go beyond closing that specific gap. They effectively rewrite the playbook for fraud teams by pushing institutions toward a more comprehensive, risk-based approach. A bare-minimum compliance strategy is no longer enough.
Financial institutions must now build robust, customized fraud prevention systems that account for the risks unique to their businesses and customers. And that’s a daunting challenge—not just because threats are becoming more sophisticated, but also because faster payments are steadily narrowing the window for fraud detection and response.
Walking a Precarious Tightrope
There is a common theme among many of the payment types that have emerged in recent years, including stablecoins, real-time payments, and even Same Day ACH. They all dramatically accelerate the speed of payments.
Innovations like embedded payments and digital wallets have also reduced friction across a spectrum of use cases, consequently increasing expectations for faster solutions.
Financial services firms want to meet changing customer expectations by adopting these new solutions, but faster payments also compress the window for fraud detection. Organizations have less time to flag suspicious transactions, investigate them, and take action before funds move beyond their reach.
Many faster payments are also effectively irrevocable, as is the case with numerous real-time payment and stablecoin transactions. That can leave consumers vulnerable when fraud occurs, particularly when they have grown accustomed to the protections associated with credit and debit transactions.
Many institutions have considered introducing friction into faster payment processes to expand the fraud prevention window, but this can defeat the purpose of faster payments. Additionally, excessive friction can begin to diminish the customer experience.
The result is that organizations have found themselves walking a precarious tightrope. They must make payments faster and easier without making them easier for criminals to exploit.
“Fraud teams are under a variety of pressures to not just prevent fraud and meet the expectations of regulators, but they must also be attuned to the customer experience as well as help optimize revenues for the business,” said Lucas Olson, Fraud Management Analyst at Javelin Strategy & Research.
“Those institutions that can effectively balance these competing pressures are able to create a structural differentiation in the market and move ahead of their competitors,” he said. “When institutions build and maintain trust with customers, they can grow the business sustainably.”
The Importance of Being Nimble
This challenge is deepening because fraud is accelerating by nearly every metric. The U.S. Federal Trade Commission reported that total fraud losses reached an all-time high of $15.9 billion in 2025, roughly a 27% year-over-year increase.
Criminals continue to target organizations with malware and ransomware attacks, but fraud is increasingly aimed at individuals, both consumers and professionals. Oftentimes, it only takes one employee to click on the wrong link to create a breach that can impact an entire organization.
Even worse, bad actors have been able to rapidly scale these attacks into campaigns. This is partly attributable to technology, but also to the rise of organized criminal syndicates. Many of these organizations engage in a host of illicit activities behind a shield of money-mule networks.
Across these operations, cybercriminals have been able to move quickly in adopting AI, largely because they are not constrained by the same ethical and compliance considerations as legitimate businesses and financial institutions. This allows bad actors to freely experiment with emerging AI technologies and deploy them rapidly.
This convergence of trends has left institutions overwhelmed by a deluge of AI-driven fraud, creating an extremely pernicious environment for fraud detection and prevention. To top it off, faster payments mean that the lion’s share of fraud prevention must occur before a transaction is ever executed.
All these factors are driving financial institutions to ratchet up their investments in technology and expertise.
“It’s become a trope of the AI arms race that advanced algorithms are needed to fight back against AI-fueled fraud,” Olson said. “Increasingly, it’s a battle of algorithms, and agentic AI is only accelerating these trends.”
“Fraudsters are actively mapping company algorithms for weaknesses to exploit at scale,” he said. “Companies also must navigate increasingly complex marketplaces defined by a patchwork of evolving regulatory environments for both AI technology and financial liability around issues like scams and agentic commerce. Being nimble is more important than ever.”
The Benefits of a Risk-Based Approach
The escalating fraud threats helped spur Nacha’s expansion of its fraud rules, which is a major catalyst for a shift in the compliance landscape. Instead of simply checking off compliance obligations, organizations must strategize, document, and continually refine how they are addressing fraud risks.
While Nacha’s fraud rules will doubtlessly drive change, there are broader benefits to adopting this approach. Namely, it provides organizations with defenses geared to their specific business and industry. Each sector faces unique threats arising from geographies, customers, products, and operating models, all of which must be addressed.
The flexibility built into Nacha’s rules is especially important here. The rules don’t prescribe a single technology or fraud-detection methodology. Instead, they allow organizations to tailor their processes to their specific risks and roles within the ACH ecosystem.
Optimizing fraud prevention systems can also reduce false positives and cut customer friction. These factors, along with more effective fraud defenses, can have lasting, beneficial impacts on customer relationships.
This approach also allows institutions to be more agile, enabling them to rapidly adapt their systems to combat emerging fraud vectors. That adaptability can be supercharged when technologies like AI and machine learning are appropriately injected into the infrastructure appropriately.
Streamlined fraud systems can also cut down on the manual reviews and reports that have bogged down many institutions’ operations for decades. This can not only free up staff to focus on other aspects of the business, but also reduce the cost of fraud prevention.
“Risk-based approaches to fraud prevention can result in a significantly better customer experience, allowing the fraud team to better align with the business’s overall objectives rather than simply focusing on box checking,” Olson said. “This alignment can help fraud teams grow their budgets and increase their overall impact. It also allows fraud teams to focus on the highest risk cases with the largest potential losses.”
Compliance Is Not the Finish Line
The challenges of faster payments, sophisticated fraud, and compliance requirements mean there is no longer a one-size-fits-all solution for fraud prevention.
Fraud operations must be both customized and continuous. Prevention should be integrated into everyday processes like onboarding, account validation, payment initiation, and vendor management. These processes must also be constantly reevaluated as payment types, fraud typologies, and customer expectations evolve.
That continuous improvement is also consistent with Nacha’s approach: covered entities are required to review their fraud-monitoring processes and procedures at least annually and make appropriate updates to address evolving risks.
Most notably, the changes brought by Nacha’s rules and the broader fraud environment mean that compliance can no longer be the finish line. The prevailing strategy for organizations should be to build better payment processes—not just to meet compliance requirements.
Once these strategies are adopted, it can unlock significantly many opportunities for organizations. However, it all begins with payment processes that are resilient, adaptive, and trusted.
“Financial institutions are increasingly developing fraud resiliency in response to the constant deluge of attacks,” Olson said. “Continuous monitoring, adaption, and evolution is necessary in this dynamic environment. Fraud teams must collaboration with a broad array of institutional stakeholders, including AML, cyber, and business operations. The more synergies that can be found, the better.”
In a recent webinar, LSEG explored this very topic, looking at how organizations can move beyond compliance and build trust in payment processes as fraud continues to become more sophisticated. Register to view the on-demand webinar here.
