Whether it's a member's auto loan payment that's automaticallydeducted each month or a small business processing payroll online,automated clearing house risks are in the spotlight more thesedays. The risks can be confusing and can vary with each type oftransaction, according to CUNA Mutual Group.

To help clear though the fog, more than 1,000 people registeredfor a Feb. 19 webinar hosted by the company on such topics asemerging problems with online account takeover fraud andunauthorized origination of outgoing funds. The session alsocovered the risks of originating debits as deposits or loanpayments and operational issues for the receiver of fraudulentcredit and debit transactions.

On the ACH credit receiving end, with money mule scams where aperson transfers money acquired illegally in person orelectronically on behalf of someone else, credit unions werereminded that they do have some protections. RogerNettie, senior consultant, risk management at CUNA Mutual, toldattendees that credit unions should only return funds that stillexist and only if they get a letter of indemnification from theissuing institution. The same process applies for wire transfers.Another scenario on the ACH credit receiving end, involves issuesTreasury reclamations after a joint owner removes funds, Nettiesaid. For instance, a member is deceased but their Social Securitychecks are still coming with the joint account holder taking thefunds. This type of situation is preventable for credit unions if areclamation notice is sent saying the funds need to be returned anda response is needed on a timely basis. This action also applies toissues with IRS tax refunds of which the recipient's name is not onthe account, Nettie said.

“With ACH, you generally don't have the responsibility to matchthe names. However, if you become aware of a mismatch, you areexpected to send (the refund) back or contact the IRS and notifythem of the mismatch,” Nettie explained.

Unlike the ACH credit receiving end, Nettie said fortunately,there are not a lot of loss problems on the ACH debit receiving endbecause the system is designed with “generous return rights” thatallow 60 days for consumes to make returns. “The problem area isunderstanding member liability under Regulation E. If a memberreports unauthorized transactions that have hit their account, thecredit union is liable for anything within 60 days – it doesn'tmatter when you got the notification,” Nettie said.

Even though members can work the issue out with the vendorfirst, Nettie said there could potentially be a little danger ifthe credit union does not conduct their own investigation, which isrequired under Regulation E. One area where CUNA Mutual has seenproblems is with businessaccounts, Nettie said.“Credit unions are giving Reg Edisclosures; they're giving a lot of extra protection to businessesthat you don't need to. We recommend traditional accountdisclosures for checks with 30 days to report.”

When credit unions are originators of ACH credit transactions,online fraud losses are likely to occur, Nettie said. Accounts canbe taken over online or a business member's account come intounauthorized payroll processing, he explained. If a credit union isusing a corporate credit union or corresponding bank, wire lossescan easily drift into the several million-dollar range. The bigproblem is the malware that infects credit union computers and thesecurity option of answering a challenge question just isn't enoughanymore, he said.

If a credit union is doing originations for business accounts,Nettie emphasized that it's critical to have a written agreement inplace. Along those lines, understanding credit risk is important.Once a credit union accepts a payroll file and it goes into thesystem on a Wednesday for settlement on Friday, it is obligated tomake that payment.

“The risk comes into play when you don't know whenthe businessmember will process the funds,” Nettie said. “I actuallyworked with a larger credit union years ago that was doing payrollfor a large medical group. Well, the credit union never got paidand as a result of this, decided to exit the ACH payroll business.You have to know that the company's financials are in good shapeand you can require pre funds.”

When credit unions are the originators of ACH debits, there isthe risk of a booster payment, Nettie said. That's when a memberhas a credit card with a $5,000 limit, for instance, that has beenmaxed so the user wants to use a check or ACH payment, submit it tothe financial institution and immediately run up that limit.Meanwhile, the booster payment is going through an account with nofunds, Nettie said. He advised not releasing all of the availablefunds immediately.