A U.S. subsidiary of a Polish company suffered a loss of nearly $100,000 arising from 10 unauthorized ACH (automated clearing house) debits over a single week. After an unknown theft of the subsidiary’s bank account number and bank name/routing number, cyber criminals impersonating another firm (buyer) used this information to ostensibly pay a third firm (seller) for commercial goods. The seller originated payment requests in the form of ACH debits (to pull money), submitted through its bank, an Originating Depositary Financial Institution (ODFI), which were processed by the buyer’s bank, a Receiving Depositary Financial Institution (RDFI), and applied to its account as Receiver. In other words, cyber criminals orchestrated a complex scheme involving three firms, fraudulently obtaining commercial goods through unauthorized ACH debits.
The subsidiary reported the unauthorized ACH debits to its bank, a major U.S. commercial bank, which declined reimbursement because the ODFI, another major U.S. commercial bank, declined the claim as its customer, the Originator, also declined responsibility.
Upon being retained, L&R quickly investigated and pursued the matter with the banks under Operating Rules and Guidelines of the National Automated Clearing House Association (NACHA). While corporate ACH debits are not subject to the substantial protections afforded consumer ACH debits under Regulation E and NACHA’s rules, numerous other provisions of NACHA’s rules and guidelines do apply to unauthorized corporate debits. Of particular significance is NACHA’s warranty under which an ODFI warrants to the RDFI that transactions have been properly authorized by the Receiver, for which it is required to indemnify the RDFI for “all claims, demands, losses, liabilities, and expenses, including attorneys’ fees and costs, that result directly or indirectly” from the breach of warranty.
In less than a month after L&R contacted the RDFI, both banks reversed their positions, and the U.S. subsidiary was reimbursed for its full loss.
For further information, contact Salvatore Scanio at sscanio@ludwigrobinson.com or 202-289-7605 or Robert Ludwig at rludwig@ludwigrobinson.com or 202-289-7603.