Fraud Controls for ACH and Wires: Dual Approval, Limits and Alerts
Payment fraud controls should be designed around how money can be requested, approved, released and reconciled. ACH and wire workflows differ, but both benefit from separation of duties, appropriate limits, independent verification and prompt monitoring.
Map the payment lifecycle
Start by documenting who can create a payment, modify recipient details, approve a transaction, release it and reconcile the resulting bank activity. This reveals where one person could potentially control too many steps.
Dual approval
Dual approval means a second authorized person reviews a transaction before release. Define when it is mandatory, such as above a threshold or for new beneficiaries, and make sure the second approver can independently evaluate the request.
Beneficiary verification
Requests to change bank instructions should be treated as high risk. Use an independent communication channel and verify the request against trusted records. Do not rely solely on a reply to the original email thread.
Limits and entitlements
- Set user permissions based on job responsibilities.
- Use transaction and daily limits appropriate to the role.
- Review entitlements periodically.
- Remove access promptly when employment or responsibilities change.
Alerts and monitoring
Configure alerts for activity that warrants review, such as unusual amounts, new recipients or unexpected payment events. Alerts are most useful when someone owns the response and the escalation procedure is documented.
Reconciliation as a detective control
Even strong preventive controls can fail. Daily reconciliation and exception review can identify unauthorized or unexpected activity after the fact. Escalate suspicious transactions through the organization's established bank and security procedures.
Updated operational note
Last reviewed: September 16, 2026. Security features and payment controls vary by bank and service. Confirm current settings with the financial institution and align them with internal security policies.