ForeGaze research · Trust · Part 1b · Fraud

When Fraud Hits: Who Pays

14 min read · Data: statutes and regulations, Nacha, FBI, provider and bank pages, read 25 Oct 2026 · US, with California noted; Canada not covered

ForUS small businesses, from solo owners to 500 people, that take card payments, pay by bank or send moneyUS (California noted)

Fraud in 2026 for US small businesses: who pays, what proof to keep, and what fraud tools cost.

In our reading of the rules below, the business bears the loss unless an exception applies. The main exceptions: the card issuer pays when a chip card was read by chip or an online order passed 3-D Secure; a bank pays for a wire if it did not follow the agreed security procedure; and a bank can pay for a forged check if you report it in time. A business card can also cap your loss at $50 (Reg Z), under conditions we did not fully confirm. For a payment you send after being tricked, we found no rule that makes someone else pay; the main option is a fast bank recall.

2 banking daysTo return an unauthorized ACH debit on a business account. A consumer gets 60 days (EPCOR, a payments association, on the Nacha return rules).

58%Of the money the FBI’s Recovery Asset Team tried to freeze in 2025: $679M of $1.16B, in 3,900 cases (FBI IC3). The report does not define the rate or say how fast reports were made.

$0–$75Monthly bank fee for positive pay or an ACH debit block, across eight US banks’ 2025–26 fee schedules. Chase lists $0.

0.40%PayPal’s fee per transaction for Chargeback Protection (0.60% for the Effortless tier), subject to a monthly loss cap (PayPal fee page, 2026).

Part 1 · What fraud costsThe numbers$20.9B reported to the FBI in 2025 · $3.05B from business email compromise.

Part 1b · When fraud hits · you are hereWho pays, what to keep, what tools costThe business pays unless an exception applies · 2 banking days to return a business ACH debit · bank fraud controls cost $0–$75 a month.

The answer

Assume you pay. Know the few cases where someone else does.

Our reading: the business bears the loss unless an exception applies. The issuer pays for a counterfeit chip card read by chip, and for an online order that fully passed 3-D Secure (fraud codes only). A bank pays for a wire it released without following the agreed security procedure, and for a forged or altered check if you were not careless or slow.
Business accounts do not get consumer rules. Reg E covers personal accounts. A consumer has 60 days to return an unauthorized ACH debit; a business has 2 banking days.
For payments you send after being tricked, we found no rule that makes someone else pay. Business email compromise cost $3.05 billion in 2025 in FBI reports. The main option we found is a fast bank recall. The FBI’s Recovery Asset Team froze 58% of the money it chased in 2025, $679 million of $1.16 billion; the report does not say how those cases compare with small-business payments.
Proof wins disputes. IP address, device ID, login and delivery proof, saved at checkout and kept 13 months, are what rebut a buyer who disputes a real sale.
Our reading: bank controls are the cheapest first step. Positive pay and ACH blocks cost $0–$75 a month on the schedules we read, and calling back on a known number costs nothing. Fraud guarantees look worthwhile mainly for online sellers with real third-party fraud, which we have not measured.

First step: ask your bank two things today: how long you have to return an unauthorized ACH debit, and what security procedure your wires use. Get both in writing.

1 · Who pays · US, with California

Who bears the loss, case by case

Read each row with its last column. Primary means we read the law or the provider’s own page; secondary means someone’s summary of it.

Case	Who usually pays	Time limit	Recovery chance	What we read
Stolen card, chip or tap, in person	Card issuer	Network dispute window; rule text not read	High for the merchant	Unconfirmed: the chip liability shift is known history; network rules: Visa rules, Mastercard rules
Same card swiped or keyed though it had a chip	Merchant	Same	Low	Unconfirmed: network rules: Visa rules, Mastercard rules
Online order disputed as fraud, no 3-D Secure	Merchant	Response windows are short; we did not confirm Shopify’s window from a Shopify source (secondary reports 7 to 21 days)	Low to moderate for true third-party fraud	Stripe support note; network rules: Visa rules, Mastercard rules
Online order with completed 3-D Secure	Card issuer, for fraud codes only	Authentication must have completed, not fallen back	High for fraud codes; none for “not received” or “not as described”	Stripe Support (primary for Stripe); processor guide
Buyer disputes a real sale (friendly fraud)	Merchant, unless it rebuts	Visa Compelling Evidence 3.0: two earlier undisputed sales on the same card, 120 to 365 days old, with matching IP or device ID plus one more element	Moderate to high if the data was saved at checkout; near zero if not	Secondary: vendor summaries; Visa rule text not read. Mastercard has a similar First-Party Trust program (Mastercard releases, primary)
Unauthorized ACH debit on a business account	You, unless it is returned in time	2 banking days after settlement for the return; your bank may ask for notice sooner (one bank guide says 24 hours)	High inside the window; low after	Secondary: EPCOR, Modern Treasury and a Nacha-exam guide
Payment you sent after being tricked (fake invoice, changed bank details)	You	Recall only, as fast as possible	Unclear; the FBI froze 58% of money it chased in 2025, but the figure may not apply to small-business payments	FBI IC3 2025 report (primary). Time-window freeze rates seen online are not in that report
Wire after an account takeover	You if the bank followed an agreed, commercially reasonable security procedure; otherwise the bank must refund	Report within a reasonable time, at most 90 days, to keep interest; one-year outer limit	Depends on the contract and the bank’s procedure	California Commercial Code §§11202, 11204 and 11505 text; Zengen v. Comerica (2007). Primary. The §11505 link is not saved in Sources yet
Forged, altered or washed check on your account	The bank, unless you were careless or slow to review statements	One-year outer limit; account agreements often shorten review periods	Moderate to high if reported fast and you use positive pay	UCC 3-406 and 4-406 text from three state codes (Michigan, Massachusetts, Kansas; primary); California text not read. The model text may add a shorter rule for repeat forgeries; not confirmed
Counterfeit check you deposited	You; the bank can charge it back	—	Very low	Unconfirmed: not read
Business credit card used without authorization	Card issuer, up to $50, unless the issuer gave you 10 or more cards and the agreement says otherwise	Not confirmed: we did not read a notice deadline; the $50 cap also depends on conditions the issuer must meet (rule text not read)	High for firms with fewer than 10 cards	12 CFR 1026.12 and the CFPB interpretation (primary)
Payment-app or processor account takeover	You, as a rule	Report at once; payouts may freeze	Low to moderate	Unconfirmed: provider terms not read
Employee theft	You, unless insured	Policy notice deadlines	Depends on cover; social-engineering cover is usually a sublimit	Broker pages only; no policy wording reviewed

2 · Business accounts · US

Consumer protections mostly stop at the business door

CFPBReg E

Personal accounts only

Reg E defines an account as one “established primarily for personal, family, or household purposes,” and a consumer as a natural person (12 CFR 1005.2).
So a business account falls outside its limits ($50, $500, 60 days). That is our reading of the definition.
Consumer liability tiers are in 12 CFR 1005.6.

NachaACH returns

60 days vs 2 banking days (Nacha rules as read in 2026; our reading)

Consumer unauthorized debit (R10): 60 calendar days, with a written statement.
Business unauthorized debit (R29): the receiving bank must return it by the second banking day after settlement.
After that, the business’s rights come from the account agreement and other law; we found no rule that extends the ACH return window for a business.

eCFRBusiness cards

$50 cap, with a catch (Reg Z text as read in 2026; our reading)

Reg Z’s $50 limit applies to business cards too (12 CFR 1026.12).
An issuer that gives an organization 10 or more cards may agree different liability.
It may not use that clause if the firm clearly cannot hold 10 cards, such as a three-person shop.

3 · Payment providers · US

How a fraud loss flows through your processor

The buyer’s bank sends a dispute. Your processor debits the amount plus a dispute fee from your balance.
You respond with evidence inside the window. Win, and the amount comes back. Lose, and you carry it.
Your dispute ratio is watched. From 1 Apr 2026 Visa names a merchant once fraud reports plus disputes reach 1.5% of online card transactions with at least 1,500 events a month. Acquirers use a lower limit of about 0.5% (secondary), so your processor can act long before Visa does.
Reserves, holds or closure follow. These come from your processor agreement, so read the clause (see The Small Print).

Provider	Dispute fee per chargeback	Read
Stripe (US)	$15 when received, plus $15 when you counter, refunded if you win (stripe.com/pricing, primary)	Stripe pricing page, Oct 2026
Shopify Payments (US)	Not stated on Shopify’s Shopify chargebacks page, which links its fee page; secondary guides say $15, returned if you win	Third-party guides
PayPal (card chargeback)	$20.00	PayPal fee page, primary
PayPal Braintree	$15	PayPal fee page, primary
Square (US)	$0: “There are no fees for dispute management services for chargebacks”	Square Help, primary. Square’s old paid chargeback protection ended in 2019 (history).

4 · Proof · US

What to keep, in four tiers

Built from the official guides and rules we could read. The tiers are our grouping.

Tier 1Minimum

Every dispute

Order or transaction ID, date, amount, authorization code.
Customer name, billing and shipping address, email.
For online card orders: the address and security-code check results.
For in-person card sales: proof of a chip or tap read.
Delivery proof with tracking.

Tier 2Good

Wins most fraud-coded disputes

The 3-D Secure result.
IP address, device ID and login, saved at checkout and kept 13 months.
Signed delivery to the billing address.
Wires: logs showing whether your bank’s security procedure (MFA, call-back) was followed.
Checks: positive pay exception records and a statement review you can date.

Tier 3Supportive

Helps, rarely decisive alone

Customer messages and account age.
Earlier undisputed orders from the same buyer.
Usage logs for digital goods.
The refund policy shown at checkout.
A police report and your IC3 complaint number.

Tier 4Nothing to claim

No one else carries it

A payment you sent to a fraudster after the money has left.
A counterfeit check you deposited and spent.
A business ACH debit noticed after the 2-banking-day window: the ACH return window has closed, so only your account agreement and statement-review rules are left (low odds).
A wire or check objection made past the one-year limit.
A dispute on a one-time buyer with no checkout data and no signed delivery.

5 · Tools · US

What fraud tools cost small online sellers

Listed by category, not ranked. No provider paid to be here and we have no affiliate ties. “Quote only” means no price is published; we have not guessed one. Read 25 Oct 2026.

Provider	Price model	Price	What it covers	Worth it or skip	What we read
Stripe Radar Lite	Included with standard card pricing	$0	None; screening only	Always on. Radar Standard moves to a per-transaction fee from 22 Jan 2027	Stripe notice and pricing page (primary)
Stripe Radar Standard	Per screened transaction	From $0.05 per screened transaction or from $10 a month (stripe.com/radar/pricing, primary; the page lists “starting at $10 per month” and does not show the per-transaction price or the 22 Jan 2027 date)	None	Worth it if card testing or fraud is real; skip at low fraud and low volume	Stripe support pages say the fee starts 22 Jan 2027 but give no amount; the figure comes from a copy of Stripe’s email (secondary)
Shopify Protect	Free for eligible orders; requires Shopify Payments and Shop Pay, and the order must show protection active	$0	Covers the order amount and chargeback fee on eligible fraud chargebacks	Always on if you qualify (US stores, tracking within 7 days, approved carrier); fraud chargebacks only	Shopify page (primary); detailed terms not read
PayPal Chargeback Protection	Per transaction	0.40%; Effortless tier 0.60%	Unauthorized and item-not-received chargebacks, up to a monthly loss cap; the cap amount is not published	Worth it if those losses exceed the fee; skip if your losses are “not as described” or friendly fraud. Enrolling turns off PayPal’s Fraud Protection tool	PayPal fee and help pages (primary)
Square	Built in	$0 dispute fee	No paid chargeback protection. Square covers Cash App Pay fraud disputes in full; processing fees are not refunded on a lost dispute (Square Help)	Low dispute cost; you still lose the amount on a lost dispute	Square Help (primary)
Signifyd	Share of approved order value	Quote only	Financial guarantee up to a full liability shift	For larger online sellers; likely above small-shop scale	Signifyd pricing page (primary)
ClearSale	Per approved order, or a fixed fee	Quote only; a pricing page says from $0.25 per approved order (unconfirmed)	Optional guarantee on fraud chargebacks; conditions not stated	Worth a quote for small online sellers who want a guarantee	ClearSale page (primary, prices unconfirmed)
NoFraud	Monthly tiers by volume	Quote only; a Shopify listing says $250 a month or 1% of revenue	“100% financial guarantee” on passed orders; limits not stated	High-fraud online verticals; costly at 1% to 1.5% of revenue if fraud is low	Shopify listing (vendor) and NoFraud policy
Riskified	Share of approved orders	Quote only	Covers fraud chargebacks on approved orders	Usually above small-shop scale	Riskified page (primary)
Sift	Volume contract	Quote only	None	Usually above small-shop scale	Sift terms (primary)
Chargeflow	Success fee	25% of recovered chargebacks; other plans’ prices conflict across its pages	Recovers disputes; does not prevent them	If you lack time to respond to winnable disputes	Chargeflow pages (primary but inconsistent)

5b · What customers say · US

What customers say about fraud tools

Opinion, not measurement. The samples are small, run by the vendors’ review pages, and lean toward larger merchants. We rank no provider from this. Read 25 Oct 2026.

Provider	Where we read	Praise	Complaints
Signifyd	G2 (347 reviews, 4.6); Capterra (64, 4.7; visible reviews 2017 to Jun 2024)	Guarantee shifts the risk; less manual review	False declines; claim exclusions; opaque decisions
Riskified	G2 (240 reviews, 4.4); 10 read, Oct 2025 to Sep 2026	Fewer manual reviews; setup	False declines; commission on thin margins
NoFraud	G2 (269 reviews, 4.7, no text); Capterra (1 review, 2020)	Not enough text read	Not enough text read
Sift	G2 (617 reviews, 4.6, no text)	Not enough text read	Not enough text read
ClearSale	Trustpilot (183 reviews, 2.8; unverified, some look invited); one page read	Not enough read	Denied reimbursements; orders refused with no appeal
Stripe (whole platform, not Radar)	Capterra (3,390 reviews, 4.6)	Not Radar-specific	False declines; fund holds with little warning; slow support

PatternPraise

Risk moves off you

Guarantees that take on the fraud chargeback.
Less manual review of orders.
Easy setup.

PatternComplaints

The fine print and the false decline

Good customers refused (false declines).
Guarantee exclusions, such as not-received claims, and short claim windows.
Decisions that are hard to see into, and slow support.
Fund holds with little warning.

No usable dataNot covered

PayPal, Square, Chargeflow, bank controls

We found only marketing pages from 2024 on.
Older threads (a 2022 Shopify post, a 2020 Square article) are anecdotes older than 2024 and are not used.
Regulator complaint data (CFPB) was not searched.

Review counts are what the sites show, not what we verified; where a site gave a count but no text we say so. Next step if you want more: an export of CFPB complaints and the Shopify App Store reviews.

6 · Banks · US

What bank-side controls cost

Positive pay and ACH blocks are the cheapest high-value controls. Fees come from each bank’s published schedule.

Bank	ACH debit block or filter	Check positive pay	Schedule date
Chase (business)	$0 a month	$0 a month per account	14 Jun 2026
Beneficial State Bank (California)	$20 a month per account (block and filter)	$20 a month per account	1 Apr 2026
Western Alliance	Listed; fee not captured	$25 a month per account	2 Feb 2026
Banner Bank	Not listed	$35 first account, $20 each more	2026
Cambridge Savings Bank	$10 a month (ACH block)	In a $50 checking tier	20 Jul 2026
SSFCU (credit union)	Not listed	$15 a month plus $15 setup	14 Oct 2026
ConnectOne Bank	Not listed	$25 per account; required unless you sign an opt-out	2026
Amalgamated Bank	Not listed	$45 a month; ACH positive pay $60; bundle $75	30 Apr 2025

Against $123,005, the average business email compromise loss per FBI complaint in 2025, even the $75 bundle is small. ConnectOne requires positive pay unless the customer opts out in writing; we draw no conclusion from that. The Fraud Costs post’s calculator uses $25, $45 and $80 a month from two credit unions’ schedules; this table covers eight banks. The samples differ and are not combined. Multi-factor sign-in and email-security costs were not researched.

7 · Judgment · US

Worth it, or skip

GetAlmost everyone

Cheap and high value

ACH debit block or filter, and check positive pay, if you write checks or publish an account number.
A call-back rule for any change to bank details.
Multi-factor sign-in on email, bank and payment accounts.
Your processor’s free screening (Stripe Radar Lite, Shopify Protect if you qualify).

MaybeDepends on your fraud

Test against your own numbers

PayPal Chargeback Protection: worth it if unauthorized and not-received chargebacks exceed 0.40% of card volume.
A guarantee product: get a quote only if third-party card fraud is a real, repeated loss.
Commercial crime insurance with a social-engineering endorsement; sublimits are often $25,000 to $100,000 (broker pages; Insureon puts the average at $75 a month, own-customer data).

SkipUsually not for small firms

Above scale or off target

Enterprise fraud platforms (Sift, Riskified) at small volume.
Any guarantee that excludes “not as described” and business email compromise, your biggest exposure.
Paying for tools before turning on the free ones above.

8 · What to do

Seven steps, cheapest first

Ask your bank for your ACH return window and your wire security procedure, in writing. Accept its strongest wire procedure.
Turn on an ACH debit block and check positive pay. Reconcile daily so a 2-banking-day window is usable.
Write a call-back rule and require two approvals on wires.
Save IP, device ID and login on every online order and keep them 13 months.
Use 3-D Secure on risky orders and watch your dispute ratio each month, aiming well under 0.5%.
If you use Stripe, decide before 22 Jan 2027 whether Radar Standard’s per-transaction fee is worth it.
If money went out to a fraudster: call your bank to recall it first, then file at ic3.gov. Speed matters: the FBI report says time is of the essence.

9 · Gaps

What this research did not cover

Open, not answered.

Network rule text (Visa, Mastercard) and Nacha’s own rulebook: we used guides and vendor summaries.
California’s check-fraud code text (§§3406, 4406) and UCC 4-214 for deposited checks.
Provider terms for payment-app and processor account takeover.
The amount of PayPal’s monthly loss cap.
Recovery rates by how fast you report; the FBI report does not give them.
Prices for multi-factor sign-in and email security.
Canada: its laws and bank rules were not researched.

Small print

The contract terms behind this

Where a rule above comes from a provider's terms, The Small Print quotes and rates it.

The Small Print: fees Dispute, chargeback and fee-change clauses.
The Small Print: money Holds, reserves and how fast your money arrives.

Disclaimers

Read this before you act on it

How we workIndependent. Impartial. On your side.

IndependentNo paid, referral, partner or affiliate ties to any company named here.
ImpartialEvery provider is judged on the same evidence, with the sources shown.
Your voiceWe stand for small-business owners: your costs, your questions, your side of the story.
Our interestOur founder previously worked at PayPal and now leads ForeGaze, an AI studio for small businesses. The research, views and analysis are our own.

We make the hidden visible, the complex simple and the unheard heard.

The research, views and analysis are our own.

Corrections and replies

Spotted an error, or represent a company named here? Write to hello@foregaze.ai . We fix errors, date each change and publish company responses.

Not advice

We're not lawyers, accountants or financial advisers. This covers published prices and terms as read on the dates shown under Sources.

Dated and partial

Read on the dates shown under Sources. Prices and terms change and vary by plan, region and contract, and custom-priced accounts can differ. Check the provider's own page before you sign or switch.

Reports aren't verdicts

Complaints and forum reports are what businesses say, unverified unless marked. Nothing here says a company broke the law.

How it was made

Written by ForeGaze Research. Claude (made by Anthropic) helped with drafting, layout and website design. Every number is checked against the sources listed and manually checked. ForeGaze is responsible for the content.

Names and marks

Company and product names are trademarks of their owners. Short quotes are used for commentary.

Limitations and method

What this doesn't cover

Customer-feedback figures come from the G2, Capterra and Trustpilot pages as read on 25 Oct 2026. The page addresses were not saved in our research notes, so they are not listed under Sources; we will add them before release.
Version note, v0.0.9 (25 Oct 2026). Layout fixes only: corrections box beside the independence block, byline under the title, geo chip, top-bar links. No figures changed.
Version note, v0.0.5 (25 Oct 2026). Removed “after a fast report” from the FBI team’s glossary entry and softened “Speed decides it”, because the FBI report gives no split by speed. Nothing else changed.
Version note, v0.0.4 (25 Oct 2026). Fixes from an independent accuracy check: Stripe Radar and second dispute fee now cite stripe.com/pricing; the 58% FBI figure is described as the Recovery Asset Team’s rate with its limits; “no legal route back”, “most cases”, “cheap controls beat guarantees” and the ConnectOne inference are now worded as our reading or removed; the ACH after-window row no longer says nothing can be claimed; the Reg Z time limit is marked not confirmed; Square’s Cash App Pay coverage, Shopify Protect’s Shop Pay requirement and unconfirmed Shopify figures are corrected; the UCC state count is three; the §11505 link gap and the positive-pay sample difference are noted.
Version note, v0.0.3 (25 Oct 2026). Removed the 2024 card-loss figure from the shared summary strip. Nothing else changed.
Version note, v0.0.2 (25 Oct 2026). Added “What customers say about fraud tools” (review-site counts, ratings and common themes for six providers; low confidence, no ranking).
Version note, v0.0.1 (25 Oct 2026). First version of Part 1b, the companion to “What Fraud Costs a Small Business”.
Law is quoted from state enactments of the uniform code and from the eCFR; it is not legal advice, and contracts can change many defaults within limits.
Card-network and Nacha rules are known here from guides and vendor summaries, not the rulebooks.
Provider prices are the pages read on 25 Oct 2026; “quote only” means no price is published.
Several figures come from vendors that sell competing services; they are marked.
The FBI’s figures are what victims reported; most fraud goes unreported.
Canada is not covered.

Sources

Pages we read

Stripe pricing page (US; primary) · read 25 Oct 2026
FBI IC3: 2025 Internet Crime Report (US; primary) · read 25 Oct 2026
CFPB: Regulation E, section 1005.2 definitions (US; primary) · read 25 Oct 2026
CFPB: Regulation E, section 1005.6 consumer liability (US; primary) · read 25 Oct 2026
eCFR: 12 CFR 1026.12, Regulation Z (US; primary) · read 25 Oct 2026
California Commercial Code §11202 (primary) · read 25 Oct 2026
California Commercial Code §11204 (primary) · read 25 Oct 2026
Delaware Code, UCC Article 4A part 2 (primary) · read 25 Oct 2026
Connecticut UCC Article 4A (2025; primary) · read 25 Oct 2026
Zengen v. Comerica Bank (Cal. 2007) · read 25 Oct 2026
UCC 4-406, Michigan text (primary) · read 25 Oct 2026
UCC 3-406, Massachusetts (primary) · read 25 Oct 2026
UCC 4-406, Kansas (primary) · read 25 Oct 2026
Nacha: fraud monitoring, Phase 2 (primary) · read 25 Oct 2026
Modern Treasury: ACH return code R29 (secondary) · read 25 Oct 2026
Open Exam Prep: corporate returns R29 (secondary) · read 25 Oct 2026
East West Bank: ACH return reference guide, Aug 2024 (secondary) · read 25 Oct 2026
Stripe: Updates to Radar pricing, January 2027 (primary) · read 25 Oct 2026
Stripe: Radar coverage and pricing, October 2026 (primary) · read 25 Oct 2026
Stripe: 3-D Secure rule note (primary) · read 25 Oct 2026
Squarespace forum: copy of Stripe Radar plan email (secondary) · read 25 Oct 2026
Shopify Protect (primary) · read 25 Oct 2026
PayPal: Chargeback Protection help (primary) · read 25 Oct 2026
PayPal business fees (primary) · read 25 Oct 2026
PayPal Braintree fees (primary) · read 25 Oct 2026
Square: payment disputes walkthrough (primary) · read 25 Oct 2026
Signifyd pricing (primary) · read 25 Oct 2026
ClearSale pricing (primary; prices unconfirmed) · read 25 Oct 2026
NoFraud Shopify listing (vendor) · read 25 Oct 2026
Merchant Risk Council: VAMP thresholds, 2026 (secondary) · read 25 Oct 2026
Mastercard: First-Party Trust, Europe, 22 Oct 2026 (primary) · read 25 Oct 2026
Mastercard: First-Party Trust, June 2025 (primary) · read 25 Oct 2026
Chargeflow: Visa Compelling Evidence 3.0 explained (vendor) · read 25 Oct 2026
Chase business fee schedule, 2026 (primary) · read 25 Oct 2026
Beneficial State Bank fee schedule (primary) · read 25 Oct 2026
Western Alliance fee schedule (primary) · read 25 Oct 2026
Banner Bank treasury fees (primary) · read 25 Oct 2026
Cambridge Savings Bank fee schedule (primary) · read 25 Oct 2026
SSFCU business fee schedule (primary) · read 25 Oct 2026
ConnectOne Bank: positive pay (primary) · read 25 Oct 2026
Amalgamated Bank fee schedule (primary) · read 25 Oct 2026
Insureon: commercial crime insurance cost (broker) · read 25 Oct 2026
Coverwatch: crime and fidelity cover (broker) · read 25 Oct 2026

Pages we couldn't read

Stripe: Radar pricing page (stripe.com/radar/pricing) · not fetched; the URL needed approval
Visa and Mastercard rulebooks · not fetched
Nacha Operating Rules · paywalled; guides used

Bibliography

Reports and studies

Federal Bureau of Investigation (2026). 2025 Internet Crime Report
Consumer Financial Protection Bureau. Regulation E (12 CFR part 1005)
Board of Governors of the Federal Reserve System, CFPB. Regulation Z, 12 CFR 1026.12
Nacha (2026). Risk management topics: fraud monitoring, Phase 2

Glossary

Terms used here

3-D Secure: An extra check for online card payments where the card's bank confirms the buyer, often in its app.
Account takeover (ATO): A thief signs in to your email, bank or payment account as you and moves money or changes details.
ACH: The US bank-to-bank network for direct deposit, payroll and vendor payments. Nacha writes its rules.
ACH credit: An ACH payment you push out, such as paying a vendor or payroll.
ACH debit: An ACH payment pulled from your account by someone you authorized, or by a thief with your account number.
ACH debit block or filter: A bank service that stops ACH debits except from companies you name.
AFP: Association for Financial Professionals: a US body for corporate treasury staff. Runs a yearly payments-fraud survey.
Approval rate: The share of card payments the card issuer approves. Declined good payments are called false declines.
Basis point (bp): One hundredth of a percent: 1 cent in every $100. 10 bp is 0.1%.
Business email compromise (BEC): Fraud where a thief takes over or copies a business email to trick staff into paying the wrong account.
Call-back verification: Phoning a known contact on a number you already have before acting on a request to pay or change bank details.
Card-not-present (CNP): A card payment where the card isn't shown, such as online or by phone. Most card fraud happens here.
Card-present: A card payment with the card at the till: chip, tap or swipe.
Chargeback: A card payment reversed by the cardholder's bank after a dispute. The merchant loses the sale and usually pays a fee.
Check washing: Erasing the ink on a stolen check and rewriting the payee or amount.
CISA: Cybersecurity and Infrastructure Security Agency: the federal agency that publishes security guidance, such as on MFA.
Compelling Evidence 3.0 (CE3.0): Visa's rule letting a merchant answer a fraud dispute with proof of earlier undisputed sales to the same buyer.
Counterfeit card fraud: Using a copied card's data to make a fake card. Chip cards are hard to copy.
Deepfake: Fake audio, video or images made with AI to impersonate a real person.
EMV (chip): The chip standard on payment cards. Each chip payment creates a one-time code, which blocks copying.
Expected loss: Chance of a loss in a year times the loss if it happens. An average, not a forecast of any one year.
False decline: A good customer's payment wrongly refused as suspected fraud.
False Pretenses (Nacha): Nacha's term for a payment induced by someone lying about who they are, who they act for, or whose account it is.
Financial Fraud Kill Chain: The FBI's fast-response process with banks to freeze money from fraudulent transfers.
FinCEN: Financial Crimes Enforcement Network: the US Treasury bureau that collects banks' suspicious-activity reports.
First-party misuse (friendly fraud): A real cardholder disputes a purchase they made or allowed.
IC3: The FBI's Internet Crime Complaint Center, where victims report online fraud at ic3.gov.
Issuer: The bank that issued the customer's card.
Merchant Risk Council (MRC): A trade body for online merchants' fraud and payments staff; publishes a yearly global survey.
Multi-factor sign-in (MFA): Signing in with a password plus a second proof, such as an app prompt or security key.
Nacha: The body that writes the ACH network's operating rules.
ODFI: Originating Depository Financial Institution: the bank that sends an ACH payment for you.
Originator: A business or person that starts an ACH payment, such as a firm running payroll.
Payment rails: The systems that move money between accounts, such as card networks, ACH, checks and wires.
Positive pay: A bank service that matches checks or ACH debits against a list you send, and holds anything that doesn't match.
Push payment: A payment the payer sends, such as a wire, ACH credit or payment-app transfer. Hard to reverse once sent.
RDFI: Receiving Depository Financial Institution: the bank that receives an ACH payment.
Spear phishing (CAFC): The Canadian Anti-Fraud Centre's category for targeted email fraud, similar to business email compromise.
USPIS: US Postal Inspection Service: the law-enforcement arm of the Postal Service; handles mail theft and check washing.
VAMP: Visa Acquirer Monitoring Program: Visa's limits on fraud and disputes as a share of online card sales.
Wire transfer: A same-day bank transfer, usually final once sent.
Liability shift: A rule that moves the loss from the merchant to the card issuer, such as a completed 3-D Secure check or a chip read.
R29: The ACH return code for an unauthorized debit on a business account. The return must be made within 2 banking days.
Reg E: The federal rule on electronic transfers for consumer accounts. It does not cover business accounts.
UCC Article 4A: The state law on wire transfers between businesses and banks.
Recovery Asset Team: The FBI team that works with banks to freeze money sent in fraud.
Security procedure: A check your bank and you agree to, such as a call-back or token, before a wire is released.

Trust · Part 2The Compliance StackTrust, Part 2: the payment and data rules a small firm owes.Payments · Part 3Refunds Aren't FreeRefunds and disputes: what each one really costs a small seller.Payments · Part 2The Invoice Rail MapCard, ACH, check or wire: the cost of each way to get paid.Economy · Holiday 2026Holiday 2026 for Small BusinessesFraud and chargebacks in the busiest season of the year.Trust · Part 4What AI Can Learn From PaymentsTrust, Part 4: what AI can borrow from how payments got safe.Payments · DentalHow a Dental Practice Gets PaidHow one profession takes payments, end to end.Contract termsThe Small PrintThe contract terms behind holds, reserves and dispute fees.

Series

More in these series

Every ForeGaze post sits in one or more series. See them all on the Post Map.

Trust

Your next step

Ask your bank two questions today

Your ACH return window and your wire security procedure decide who pays. Get both in writing, then turn on a debit block and positive pay.

See the seven steps

Rules and fees change; check with your bank and processor before you act. Provider names are trademarks of their owners. This is general research, not legal advice. See Disclaimers above.