With the June 22 deadline just one month away, this month's escalating fraud headlines aren't just news — unfortunately, they serve more as a premonition of what is to come for every corporate ACH originator still exposed without a documented, risk-based monitoring program.

The stories below cover a federal guilty plea from a multi-state bank fraud ring that beat two identity verification controls for over two years, $3 billion in business email compromise losses flowing predominantly over ACH and wire, a new FINRA intelligence hub built specifically for AI-driven financial attacks, fraudsters engineering disbursements to land just below institutional review thresholds, and AI voice calls reaching 1 in 4 Americans as the final step in the false-pretenses chain.

The stories vary in their mechanics, but each one ends with the same result: an authorized payment that should not have moved.

The bank insider problem is an identity verification problem

On May 2, a federal court in Massachusetts accepted guilty pleas from two members of a multi-state bank fraud ring that operated for more than two years across Massachusetts, Connecticut, and Rhode Island. Proof covered the case in detail on the blog.

The mechanics are worth understanding closely. A bank insider pulled real customer account data and passed it to co-conspirators, who then created fake IDs carrying the real customers' information but the impostors' photos. Those impostors walked into branches, presented the IDs, and moved money. The scheme netted more than $1.1 million before prosecutors caught up with it.

Two things let it run for over two years. The first was the bank insider who corrupted the verification process from within. The second was an identity check that confirmed the name and account number but never confirmed whether the person standing at the counter was actually the account holder.

That gap, a mismatch between claimed identity and verified identity, is precisely what NACHA's False Pretenses mandate is designed to close. Fraud rings do not need to break your authentication. They just need to know its limits.

BEC losses are predominantly moving over ACH

The FBI's 2025 Internet Crime Report documented $3,046,598,558 in verified business email compromise losses from 24,768 complaints, averaging more than $122,000 per incident. Critically, 86% of those losses moved via wire transfer or ACH.

The AFP's 2025 Payments Fraud and Control Survey put the operational picture in sharper focus: 79% of organizations experienced attempted or actual payments fraud in 2024, ACH credits are now targeted in BEC schemes at 50% of organizations surveyed (up from 47% the prior year), and vendor imposter fraud saw an 11-percentage-point jump, cited by 45% of respondents.

NACHA named these attack patterns explicitly when it defined "false pretenses" in its updated operating rules: business email compromise, vendor impersonation, and payroll diversion. The rule exists because these schemes produce authorized payments. The money moves because someone believed they were complying with a legitimate instruction. 

Catching that requires identity verification at the point of origination, not a review of the transaction after it has already cleared.

Regulators are moving to collective real-time fraud defense

Earlier this year, FINRA launched the Financial Intelligence Fusion Center, a secure portal for FINRA and its member firms to share timely intelligence about cybersecurity and fraud threats and coordinate responses. The FIFC collects, analyzes, and disseminates threat intelligence to bolster member firms' awareness and ability to respond quickly.

The launch is a meaningful shift. For years, financial institutions treated fraud as an internal operational problem. The FIFC formalizes a collective defense posture, built around the recognition that modern attacks rarely target a single institution in isolation. Fraud actors probe multiple firms using shared infrastructure, rotate tactics based on what works, and automate at a scale that makes firm-by-firm response inadequate.

For ACH originators, the implication runs alongside what NACHA is requiring: individual transaction controls are necessary but not sufficient. The threat intelligence now flowing through the FIFC reflects a fraud environment that operates across institutions and across time. Risk-based monitoring needs to reflect the same.

Fraudsters are targeting amounts just below manual review thresholds

One of the more operationally significant signals in Proof's new ATO Surge Report is the trajectory of average fraudulent disbursement requests: $182,000 in 2022, $118,000 in 2024, and a projected $88,500 in 2026. The decline is engineered, not coincidental.

Fraudsters have mapped the manual review thresholds at Tier 1 providers and are deliberately clustering requests just below the point where enhanced scrutiny kicks in. At many institutions, that ceiling sits around $80,000 to $90,000. By targeting below it, automated systems extract assets at high frequency without triggering the oversight required for larger distributions.

The Microsoft 2025 Digital Defense Report reinforces the underlying dynamic: 97% of identity attacks now target password-based vulnerabilities, including legacy MFA methods like SMS codes. Static controls are increasingly insufficient against adversaries who can probe indefinitely, rotate approaches, and operate at computational endurance that human review queues cannot match. 

The 217% growth in ATO volume over the past four years reflects what happens when the attacker's cost per attempt drops while the defender's cost per review stays fixed.

AI voice calls have automated the social engineering layer

Hiya's State of the Call 2026 Report found that AI deepfake voice calls now reach 1 in 4 Americans, with scammers outpacing mobile network operators' defenses by a 2-to-1 margin.

This matters for ACH fraud because the voice call is often the last step in the false-pretenses chain, not a standalone attack. The scheme typically begins with reconnaissance, moves through email or text-based impersonation, and ends with a phone call that confirms the fraudulent payment instruction or provides the account details to redirect a disbursement. 

By the time the call happens, the target has often already been primed to trust the interaction. The AI-generated voice simply removes the final friction.

For financial institutions processing disbursement requests or account changes that arrive with a verbal confirmation, this is the piece that collapses the traditional callback as a control. A human-sounding voice confirming a fraudulent instruction is no longer evidence of legitimacy. It is evidence that the attacker has fully automated the approach.

What these signals mean together

Each of these developments describes a different layer of the same problem. 

• The Massachusetts case shows what happens when identity verification cannot confirm who is actually present.
• The BEC data shows the scale at which social engineering is producing authorized ACH fraud. 
• FINRA's FIFC reflects a regulatory environment that is moving toward collective real-time threat response. 
• The ATO trajectory shows attackers actively reverse-engineering manual review limits. 
• And the deepfake voice data shows the social engineering layer completing its automation.

Taken together, the signals point to a fraud environment where the controls most organizations rely on were built for a threat that has materially evolved. Manual review queues, knowledge-based authentication, and callback confirmation were designed for a world where fraud was slower and less automated than the person checking it. 

That is no longer the world most financial institutions operate in.

The June 22 deadline was written for exactly this environment

On June 22, Phase 2 of NACHA's new fraud monitoring rule takes effect, extending to every corporate ACH originator beyond the large processors that faced the March deadline. The mandate requires risk-based processes and procedures to identify ACH entries initiated as a result of fraud, including payments induced by business email compromise, vendor impersonation, and payroll diversion.

The rule does not prescribe a specific technology. It prescribes a documented, auditable approach, and it holds your ODFI accountable for whether your controls hold up under scrutiny. An ODFI that finds your fraud procedures insufficient can exit the relationship. Loss of that relationship means loss of ACH access.

At Proof, we work with financial institutions and ACH originators to build the identity verification layer that satisfies the False Pretenses standard: IAL2-compliant, real-time, and generating the machine-readable audit evidence your ODFI will require. The implementation window is still open, but it is closing.

See how Proof supports NACHA Phase 2 compliance >