ACH Fraud Statistics and Trends in 2025

Payments fraud continues to present a significant risk for organisations of all sizes. While overall fraud rates have shown signs of stabilising in recent years, cybercriminals are constantly adapting their tactics, targeting a broad range of payment channels — from ACH credits to wire transfers. For finance leaders, understanding these evolving threats is essential to strengthening financial controls and building organisational resilience.

This page explores key statistics, trends and insights on ACH fraud, helping finance teams stay informed and better protect their payment processes.

Author’s Top Picks

  • 79% of organisations fell victim to fraud attempts or actual fraud in 2024, representing a slight decrease compared to the previous year.
  • Payments fraud remains persistently high
  • 50% of organisations reported that ACH credits were targeted in business email compromise (BEC) attacks.
  • 76% of BEC attacks involved the use of spoofed emails to deceive targets.

AFP Payments Fraud and Control Survey Report: key findings

1. 79% of organisations fell victim to fraud attempts or actual fraud in 2024, representing a slight decrease compared to the previous year.

Payments fraud remains a widespread issue, affecting nearly four out of five organisations surveyed.

2. Payments fraud remains persistently high

Payments fraud remains persistently high, though slightly lower than previous peaks, with 79% of organisations impacted.

3. 31% of financial professionals observed an increase in fraud activity over the past year.

The upward trend in fraud reports highlights the need for continued vigilance across financial operations.

4. 50% of organisations reported that ACH credits were targeted in business email compromise (BEC) attacks.

ACH credits have become the most commonly targeted payment method in BEC fraud attempts.

5. 63% of BEC incidents involved targeting wire transfers, marking a significant rise.

Wire transfers are increasingly at risk, overtaking previous years’ fraud targeting rates for this payment method.

6. 63% of organisations experienced check fraud, and 34% experienced ACH debit fraud in 2024.

Despite a gradual shift to digital payments, paper checks and ACH debits remain highly vulnerable to fraud.

7. 34% of organisations experienced ACH debit fraud incidents in 2024.

ACH debit fraud incidents slightly increased, maintaining pressure on businesses to strengthen payment controls.

8. 19% of organisations experienced ACH credit fraud incidents in 2024.

After a sharp drop in the prior year, ACH credit fraud rates stabilised at lower levels.

9. 63% of organisations experienced business email compromise (BEC) attacks in 2024.

Business email compromise continues to be the leading method of executing payments fraud across industries.

10. 79% of organisations with annual revenues over $1 billion experienced payments fraud in 2024.

Larger organisations continue to face a higher likelihood of being targeted by fraudsters than smaller counterparts.

11. 33% of large organisations experienced wire transfer fraud attempts.

Wire transfers remain a significant payment channel targeted during BEC incidents among large businesses.

12. 25% of large organisations experienced ACH debit fraud attempts.

ACH debit fraud continues to affect a considerable portion of large businesses, underscoring the need for enhanced controls.

13. 63% of organisations reported attempted or actual check fraud, the highest among all payment methods.

Paper checks remain the most exploited payment method for fraud, despite broader digitalisation efforts.

Business email compromise (BEC): a persistent threat

14. 63% of organisations experienced business email compromise (BEC) attacks in 2024.

Business email compromise continues to be the leading method of executing payments fraud across industries.

15. 76% of BEC attacks involved the use of spoofed emails to deceive targets.

Email spoofing remains the most common tactic employed in BEC scams to impersonate trusted individuals.

16. 47% of large organisations reported ACH credits as a fraud target in BEC scams.

ACH credit transactions are now a major point of vulnerability among large enterprises facing BEC attacks.

17. 33% of large organisations experienced wire transfer fraud attempts.

Wire transfers remain a significant payment channel targeted during BEC incidents among large businesses.

Sources

FAQs

One thing is clear: financial crime is always evolving. While some old-school fraud methods are declining, new vulnerabilities are popping up, especially in electronic payment systems. To stay safe, organisations need to stay on their toes, keep security measures up to date, train employees, and adapt their fraud prevention strategies.

As fraudsters get smarter, so do our defences. Many organisations are turning to cutting-edge tech like AI and machine learning to spot weird transaction patterns. Multi-factor authentication is becoming the norm, especially for big-ticket transactions. There’s also a growing trend towards real-time payment monitoring and fraud detection systems that can flag suspicious activities on the spot.

The fintech industry is stepping up with innovative solutions. They’re exploring blockchain for its potential to create tamper-proof transaction records. Biometric authentication methods, like fingerprint and facial recognition, are being built into payment systems. And tokenisation is gaining traction as a way to keep sensitive financial data safe during transactions.
In the B2B world, specialised fraud prevention platforms are emerging as powerful tools. For example, Eftsure offers real-time verification for vendor and supplier payments. These platforms add an extra layer of security to existing financial systems, helping organisations defend against sophisticated fraud attempts, including business email compromise (BEC) attacks and other social engineering tactics.

Governments and financial regulators are stepping up their game too. They’re introducing new rules to make financial institutions and payment service providers beef up their security. There’s also more focus on international teamwork to tackle cross-border fraud. Regulators are pushing for better reporting systems to track and respond to new fraud trends.

Here are some examples of how different countries are tackling fraud:

In the US, the Federal Reserve’s FedNow Service includes fraud detection for real-time payments.
Australia’s New Payments Platform (NPP) has built-in fraud prevention for real-time payments.
The EU’s Revised Payment Services Directive (PSD2) requires strong customer authentication for electronic payments.
In the UK, the Financial Conduct Authority (FCA) is pushing banks to step up their fraud prevention game.

With ACH fraud on the rise, organisations are tightening controls. Best practices for preventing ACH fraud include:

  • Use dual control for ACH initiation
  • Set up transaction limits
  • Use ACH positive pay services
  • Regularly reconcile accounts

With BEC still a major threat, employee training is crucial. Organisations are investing in regular training programs to teach staff how to spot phishing attempts, double-check payment requests, and stay skeptical of urgent or unusual demands. Some companies are even running simulated phishing exercises to keep their employees on their toes.

Some companies are also exploring dedicated fraud insurance policies to mitigate potential losses from ACH fraud.

Checks remain the most fraud-prone payment method, with 65% of organizations reporting they experienced fraud attempts targeting checks.

CFO guide
ACH fraud is evolving. Are your defenses?
A new generation of cyber-threats calls for a new approach to protecting your organization's finances. The latest edition of our guide shows you how.

Subscribe to our blog

Subscribe to the eftsure blog to receive updates when we post.

The new security standard for business payments

Eftsure provides continuous control monitoring to protect your eft payments. Our multi-factor verification approach protects your organisation from financial loss due to cybercrime, fraud and error.