FTC Staff Comment Before NACHA - The Electronic Payments Association, Regarding Proposed Revisions To the NACHA Operating Rules Described in the Request For Comment - ACH Network Risk and Enforcement Topics

Bureau of Consumer Protection
Bureau of Economics
Dear Ms. Bondoc:
UNtTED STATES OF AM ERIC A
FEDERAL TRADE COMMISSION
WASHINGTON, D.C 20S80
January 13, 2014
The staffs of the Federal Trade Commission's Bureau of Economics and Bureau of
Consumer Protection (collectively, "FTC staff')1 appreciate the opportunity to comment on the
proposed revisions to the NACHA Operating Rules ("Rules"), as described in the Request for
Comment- ACH Network Risk and Enforcement Topics ("RFC"). 2 FTC staff supports
NACHA's proposal and offers the following comments to assist NACHA in considering the
potential impact of the proposed changes on consumers.
I. Introduction
On November 11, 2013, NACHA- The Electronic Payments Association ("NACHA")
published proposed revisions aimed at improving the Automated Clearing House ("ACH'')
process by reducing the incidence of returned ACH transactions and decreasing th~ costs to
receiving depository financial institutions c··RDFis") associated with handling consumer
complaints and retumed transactions.
The Federal Trade Commission ("FTC' or ·'Commission'') is an independent agency
responsible for safeguarding consumers throughout nearly all segments of the economy,
including jurisdiction over most nonbank entities. 3 To fulfill its consumer protection mandate,
the Commission enforces the Federal Trade Commission Act, 15 U.S.C. 41 -58 ("FTC Act")
and other laws that prohibit businesses from engaging in practices that are deceptive or unfair to
1 rhe se comments represent the views of the staff of the Federal Trade Commission· s Bureau of Economics and
Bureau of Consumer Protection. The letter does not necessarily repre.sent the views of the Federal Trade
Commission or of any individual Commissioner. The Commission has, however, voted to authorize us to submit
these comments
2 On the same date. NACHA published a .. related and compleme;;ntary proposed Rule to improve ACH Network
guality: ·· NACHA. ACH Network:_.Rtsk and Enforcement Topics. Request (or Comment and Request for
Information. Execu.Jii ·e Swnmwy and Rules Description, at 1 (Nov. 11 , 20 B), available at
httos: // www.nacha.org/page/reguest-commenL
J See 15 U.S.C. 44, 45(a)(2) (excluding from the Commission' s JUrisdiction several types of entities, including bona
fide nonprofits, bank enttties (includmg, among others, banks. thrifls. and federally cha11ered credit unions), and
common cru11ers ).

consumers. In addition, the Commission engages in po licy research and advocacy, public
education outreach, and rulemaking.
II. The Commission's Efforts to Combat Fraud in Payments Systems
For more than a decade, the Commission has engaged in a variety of efforts to address
the critical role of nonbank payment processors and other intermediaries in providing the
petpetrators of fraud with the means to access and obtain payment from consumers' accounts.
These efforts include aggressive law enforcement and coordination with other federal agencies
and regulators.
The Commission's law enforcement cases have halted allegedly fraudulent schemes
responsible for debiting or attempting to debit more than $300 million from hundreds of
thousands of consumer bank accounts. 4 Typically, the estimates of consumer injury do not
reflect the full measure of harm inflicted on consumers, who expend time and resources fighting
these illegal debits. In many cases, con artists have duped victims into revealing their financial
account information to pay for fraudulent goods or services, apply for bogus payday loans, or
obtain " free" products. In other cases, the FTC has charged that perpetrators obtained or reused
lists of consumer bank account information and began debiting accounts of consumers without
any contact whatsoever. 5 The ability of these perpetrators to electronically extract money from
consumer bank accoun~s severely undem1ines confidence not just in the marketplace, but in the
financial institutions that safeguard our money.
To cut off the supply of money to fraudulent operations, the Commission's law
enforcement actions have targeted a variety of nonbank payment processors and other
intermediaries - so-called ''gatekeepers "- that allegedly engaged in unfair acts and practices in
violation of the FTC Act or provided substantial assistance to telemarketers in violation of the
Telemarketing Sales Rule, 16 C.F.R. 310 (2013) ("TSR"). The Commission has pursued
payment processors that processed ACH debits to siphon money from consumer bank accounts
on behalf of merchant clients allegedly engaged in abusive or deceptive telemarketing.6 Many
4 See, e.g, FTC' '· Ideal Financial Solwions, Inc., Civ. No. 13-00143-MMD-GFW (D. Nev. Feb. 15 , 2013 (Prelim.
Inj.) (alleging defendants made more than $24 million in debits and attempted debits to consumer accounts via
ACH, RCPOs, and credit card charges); FTC l'. FTN Promotions, Inc .. Civ. No. 07-1279-T·30TGW (M.D. F la . Dec.
30, 2008) (Stip. Penn. Inj.) (same, $172 million and $42 million alleged in contempt); FTC\'. Group One Networks,
In c .. Civ. No. 09-0352 (M.D. Fla. Mar. 19, 2010) (Stip. Penn . Inj.) (alleging defendants defendant~ debited o~
attempted to debit $17 million from consumer accounts via ACH and RCCs).
5 See, e.g ., FTC l'. Ideal Financial, supra note 4; FTC 1'. 3d Union, Civ. No . 04-0712-RCJ-RTJ (D. Nev. July 19,
2005) (Default J.).
6 E. g., FTC v. Your Money Acces.\~ LLC ( " YMA "), C iv. No. Oi-5147 (E.D. Pa. Aug. 11 , 201 0) (Stip. Penn. Inj.)
(alleging ACH and RCC payment processor unfairly debited or attempted to debit more than $200 milli on from
consumer accounts on behalf of fraudulent telemarketers); FTC\'. Global Marketing Group, Inc., Civ. No 06-02272
(JSM) (M.D. Fla. 2006) (same, $5. 1 million); FTC\'. First American Payment Processing, Inc., eta/., No. CV-04-
0074 (PHX) (D. Ariz . Nov. 3, 200 4) (Stip. Penn. Inj.) (settlement requiring de fe ndants to pay $3.9 million); FTC\ '.
Electronic Financial Group, eta/., No. W-03-CA-211 (W.O. Tex. Mar. 23, 2004) (Stip. Perm. lnj.) (settlement
requiring defendants to pay $ 1.5 milhon).
2

unscrupulous merchants and their payment processors also have taken advantage of alternative
payment methods. In response, the Commission has charged that various payment processors
and intermediaries provided fraudulent merchants with access to: credit and debit cards, 7 money
transfers, 8 unsigned demand drafts known as Remotely Created Checks (''RCCs"), and electronic
versions ofRCCs , known as Remotely Created Payment Orders ("'RCPOs''). 9
Regardless of the type of payment method used, the Commission's cases have
highlighted the numerous red flags that put the processors (and, in many cases, the processors'
banks) on notice of the high likelihood of illegal activity. These signs in clude unusually high
rates of returned or reversed transactions (or chargeback rates in connection with credit cards);
sales scripts or websites containing statements that are facially false or highly likely to be false;
consumer complaints; and inquiries fi:om law enforcement or regulators. In some cases, payment
processors not only know about underlying law violations committed by their merchant clients,
but also actively help their merchant clients avoid detection. For example, the Commission has
alleged that certain payment processors have urged fraudulent merchants to switch from ACH
debits to RCCs and RCPOs to avoid NACHA ·s one percent threshold for unauthorized returns 10
or used tactics to evade compliance monitoring systems designed to flag fraud. 11
The Commission also works closely with other agencies and bank regulators that
scrutinize the crucial role that banks and payment processors can play in providing deceptive or
1 E.g , FTC Press Release, FTC Settlements Crack D own on Payment Pro cessing Operation chat Enabled ··coogle
Mo n'') Tree " Scammers to Charge Consumers $15 Million in Hidden FC'e~ '' Process America") (Nov. 18, 20 13)
(announcing proposed settlement agamst credit card payment processor); FTC r . LO<t lh!n, 2013 WL 5816420
(W .D.Wash. Oct. 29, 2013) (Summ. J.) {finding defendants· actJvities. including credit card processing, violated the
TSR). FTC, . WV Uni1•ersal Management, LLC, Civ. No. 12 -C V-1 618 (M.D. Fla. June 18, 2017) (alleging credit
card payment proc-.ess or assisted and facilitated VIolations of the TSR); lnnomcil·e Wealth Builders, C1v. No. 13-CV-
00 123 (M.D. Fla. June 4, 2013) tsame).
8 FTC v. MoneyGram, Civ. No. 09-6576 (N.D. Ill. Oct. 19, 2009) (Stip. Penn. Inj .) (resolving allegations that
defendant allowed its money transfer system to be used for fraud).
9 E.g. , FTC v. Automated Electronic Checking, Inc. ("AEC"), Civ. No. 13-00056-RCJ-WGC (D . Nev. Feb. 5, 2013)
(Stip. Pem1. Inj.) (payment processor ofRCCs and RCPOs): FTC, .. Landmark Clearing Inc., Civ. No. 4: ll-00826
(E.D. Tex. Dec. 15, 2011) (Stip. Perm. Inj .) (payment processor ofRCC~ and RCPOs); FTC' · YMA. Civ. No. 07-
5147 (payment processor of RCCs and ACH debits); FTC ,. MJO l'i, inc.. 598 F. Supp. 2d 1104 (S D. Cal. Sept. 16,
2008), t!ff'd, 604 F.3d 1150, 1158 (9th Cir. 2010) (Perm. Inj.) (Internet-based check creation and delivery service).
1
° FTC ,. AEC, .wpra note 9. Complaint~ 29 (defendants allegedly urged me 1·chant clients to avoid NACHA's
threshold by switching from ACH debits to RCPOs): FTC l'. Landmark Clearing, supra note 9, Complaint ~ 23
(a ll eging that defendants expressly advertised their RCPO processing product as a less regulated altemative to ACH
transactions).
11 Process America. supra note 7 (allegi~g defendant<; used multiple ~ erchant account<; , shell corporat10ns, and a
mampulation of transaction volume to help fraudulent merchant evade detection by credit card associations); FTC,.
AEC. supra note 9, Complaint ,158 (alleging defendants advised merchants to us e differt:nt billing descriptors.
customer service email accounts and phone numbers, as well as corporate names or DBAs, to ·•fly und er the bank
radar").
3

fraudulent merchants with access to consumers' bank accounts through ACH debits, RCCs,
RCPOs, and other payment methods.t 2 For example, as part of the Consumer Protection
Working Group of President Obama ·s Financial Fraud Enforcement Task Force led by the U.S.
Department of Justice, the Commission coordinates with a broad coalition of law enforcement,
investigatory, and regulatory agencies assembled to combat fraud in all aspects ofthe
economy. 13 One result of this coordination is the series of actions taken by the Commission,
bank regulators, and federal prosecutors involving First Bank of Delaware, t4 which culminated
in a $15 million civil penalty against the bank based on its origination of RCCs, RCPOs, and
ACH debits on behalf of merchants and payment processors engaged in fraud. 15
III. FI'C Staff Supports NACHA's Proposals
FTC staff supports NACHA •s proposal to strengthen its risk management oversight to
reduce the incidence of returned ACH debits, including those that have been most closely
associated with consumer fraud , and offers the following comments based on its experience in
combating fraud. By improving the quality of ACH debits and origination practices, increasi ng
oversight of payment pr_ocessors, and expanding NACHA's enforcement authority, the Rules
12 See, e.g., In the Matter ofBay Cities Bank, FDIC-l3-026b (May 20, 20 13) (consent order requiring, among other
things, cessation of all third-party payment processing unless and until bank submits an approved plan showing
adequate policies and procedures for oversight), In the Matter ofMeridian Bank, FDIC l2 -367b (Oct. 19, 20 12)
(same, unless and until bank completes comprehensive due diligence on each paymen t processor and its merchant-
clients); In the Matter ofMetro Phoenix Bank. FDIC lll-08~b (Jun. 21, 2011) (same, including cessation of all
third-party payment processing for CheckGateway LLC and Teledraft, Inc.); see also United States\ '. Payment
Processing Ctr., LLC, Civ. No . 06-0725 (E.D. Pa. Feb. 12, 2007) (Stip. Perm. lnj.) (alleging mail and wire fraud in
connection with defendants' processing of RCCs).
11 A description of the Financial Fraud Enforcement Task Force and a list of participants is available at
http://www.stopfraud.gm·'abouthtml.
14 In July 2011, the Commission filed suit against Direct Benefits Group, LLC and its principals for engaging in an
online payday lending scheme to debit consumers ' bank accounts without their knowledge or consent FTC v.
Direct Benefits Group, LLC, 2013 WL 3771322 (M.D.Fia. July 18. 2013) (pemument injunction and $9",512,1 72
judgment entered against defendants). The Direct Benefits defendants processed debits to consumer accounts
through several payment processors, including Landmark Clearing, Inc. !d. at *10. In turn, Landmark Clearin~
established merchant accounts for Direct Benefits Group and other fraudulent merchants through F1rst Bank of
Delaware. In December 2011, the Commission entered into a stipulated pennanent injunction against Landmark
Clearing, based on its payment processing activities for D1rect Benefits. FTC v. Landmark Clearing, supra note 9.
At the same time, the Federal Deposit Insurance Corporation (''FDIC") entered into a Consent Order with First Bank · ·
of Delaware in which the bank agreed to terminate all E-Payment Programs, including the processing of RCCs and ·
similar instruments. In t he Matter ofFirst Bank ofDelaware, FDIC-ll-669b, 2 (Dec. 3, 2011).
IS On November 19 , 2012, First Bank of Delaware entered into a settlement with the U.S. Department of Justice,
U.S. Attorney 's Office for the Eastern District of Pennsylvania, which included a concurrent as sessment of a civil
money penalty of$15 million with the FDIC and the Financial Crimes Enforcement Network. United States r. First
Bank ofDelaware, Civ. No. 12-65000 (E. D. Pa. Nov. 19. 2012); In the Matter ofFirst Bank ofDelaware , FDIC-12-
30 6k (Nov. 16, 2012). In its civil complaint, the Department of Justice alleged that the bank violated the Financial
Institutions Reform, Recovery and Enforcement Act b y, among other things, debiting the bank accounts of
consumer victims on behalf of fraudulent merchants and payment processors working with such fraudulent
merchants. On October 23, 2012. the bank 's shareholders approved the bank's dissolution.
4

described in the RFC have the potential to provide critical guidance for all ACH participants and
protection for consumers.
NACHA 's rules and guidelines already emphasize the responsibility of all ACH
participants, including Originators (merchants), Third-Party Senders (payment processors), and
Originating Depository Financial Institutions or "ODFis" (merchants' banks), to monitor return
rates and other suspicious activity in order to detect and prevent fraud in the ACH Network. For
example, ACH participants must identify return rates for debits returned as unauthorized
("unauthorized returns") that exceed the industry average return rates, which NACHA publishes
in quarterly NACHA newsletters. NACHA's rules require banks to report and investigate any
merchant with an unauthorized return rate of one percent or above. To provide further guidance
regarding acceptable origination practices, NACHA proposes to modify existing Rules
concerning debit return rate thresholds used to trigger Network inquiries and enforcement
proceedings.
A. Unauthorized Returns Threshold
First, NACHA proposes to reduce the threshold for unauthorized returns from one
percent to 0.5 percent. In March 2008, NACHA first implemented the existing one percent
unauthorized return rate threshold as part of the Network Enforcement Rule. At that time,
NACHA also modified the structure and amount of fines imposed by the ACH Rules
Enforcement Panel and enabled the initiation of a rules enforcement proceeding specifically
targeting Originators or Third-Party Senders generating an excessive volume of unauthorized
debits into the ACH Network. As these and other improvements to the Network Enforcement
Rule and risk management have taken hold, the average unauthorized return rate experienced by
the ACH Network in the aggregate has consistently declined, while the one percent threshold has
remained static. To identify outliers with excessive unauthorized returns, the proposed threshold
would account for the new, lower average unauthorized return rates experienced by the ACH
Network. The average unauthorized return rate was 0.06 percent in 2005 but declined to 0.03
percent in 2012. NACHA ' s existing one percent threshold is now 33 times higher than the
average unauthorized return rate for calendar year 2012.
FTC staff supports NACHA 's proposal to lower the threshold for unauthorized returns.
NACHA proposes to cut the rate to 0.5 percent, which NACHA estimates to be more than 16
times higher than the average unauthorized return rate for 2012. 16 This change would provide a
useful tool for payment processors, banks, and NACHA to identify conduct that falls
substantially outside the norm that legitimate businesses experience. The Commission's law
enforcement experience shows that businesses engaged in hiding their unlawful practices have
worked to bting their return rates in alignment with the upper bounds of the one percent
thresholo. 17 As a result, a decre?Se in t~?.e threshold will make it more d iffi~l.!lt for these entities
to go unnoticed.
10 RFC at4.
17 FTC 1·. AEC, supra note 9, Complaint 'If 29 (AEC's principal notified one client merchant ·'NACHA is going to a
I% threshold for unauthorized transactions . . .'');FTC' '· Landmark, supra note 9, Complaint ,123 (defendants
5

As a general matter, the debiting of consumer bank accounts via RCCs and RCPOs raises
analogous concerns regarding authorization and fraud as ACl{ debits. 1
1S Entities that debit
consumer bank accounts using RCCs or RCPOs that are cleared through the check system should
not be held by industry members to a dramatically different standard for return rates. As a result,
FTC staff has looked to NACHA ·s guidelines when assessing the return rates of potentially
fraudulent operations using RCCs and RCPOs. Staff has referenced NACHA's return rate
thresholds in challenging the conduct of payment processors that allegedly advised fraudulent
merchants how to fly under the bank 's radar by employing tactics that manipulate and mask their
clients' return rates for RCCs and RCP0s. 19
In sum, the abuse of the one percent threshold rate suggests that lowering it to 0.5
percent, as NACHA proposes, could have a beneficial prophylactic effect in curbing fraud, by
strengthening a useful tool to monitor for unusual spikes in unauthorized activity. As described
below, elevated unauthorized return rates are not the onl y, or even necessarily the most
significant, indicia of potential fraud, which is why FTC staff also supports NACHA's proposals
to establish two additional return rate thresholds.
B. 	Data Quality Returns Threshold
Second, NACHA proposes to implement a 3.0 percent threshold for returns based on
'·account data issues" (i.e. , debits returned for invalid account numbers or an inability to locate
the account). NACHA proposes the threshold, which is more than I 0 times higher than the
recent average of 0.28 percent, to address questionable origination practices or high tisk
activities that have increased costs and burdens on RDFls, which must expend time and
resources on each return. FTC staff commends NACHA for recognizing that account data return
thresholds should be subject to regular scrutiny by ACH participants.
The Commission's experience confinns that a high rate of account data returns can be a
reliable indicator offraud.2° This is because excessive account data returns frequently spike
when an Originator uses a list of old consumer account infonnation or attempts to randomly
debit consumer accounts by phishing for account numbers. 21 FTC staff supports the proposed
threshold as an important component to NACHA ·s risk management and oversight of ACH
participants.
charged with explicitly invoking NACHA's one percent threshold in advertising the benefits ofRCPO processing
for merchants at risk oflugher return rates).
18 Expert Report of Elliott C. McEntee. at 144 (Oct. I. 2008),filed m FTC 1'. YMA. supra note 6.
19 See genera/6•, FTC 1': AEC and FTC 1' L~ndmark Clearing, supra note 9; FTC 1'. YMA, supra note 6.
~ 0 l·TC 1'. AEC. supra note 9. Complaint 1 36 (describing similar returns for RCC and RCPO transactions returned);
FTC 1 ·. Landmark, supra note 9, Complaint ,145 (same).
21 Expert Report of Elliott C. McEntee, at~ 55 (Oct. I. 2008). filed in FTC r . YMA, s upra note 6.
6

C. 	Total Return Threshold
Third, NACHA proposes to set a 15 percent total return threshold for all ACH debits,
regardless of the return reason code, as a trigger for further investigation and possible
enforcement action. FTC staff commends NACHA for recognizing the importance of
monitoring and flagging excessive total return rates, in addition to unauthorized and
administrative return rates. In the Commission's experience, whenever an Originator's total
return rate is significantly higher than the industry average, it is a strong indication of
problematic business practices that warrant further investigation. Indeed, the Office of the
Comptroller of Currency has advised that banks "should not accept high levels of returns
regardless ofthe return reason." 22
FTC staff supports NACHA 's proposal to implement a new return rate threshold, but
urges NACHA to make clear that the threshold -whether it is set at 10 times the average
industry total return rate of approximately 1.5 percent or lower- must not be used to condone
rates below the threshold. As noted above, FTC staff is aware that fraudulent merchants and
payment processors have interpreted NACHA's existing one percent unauthorized return rate
trigger as a permissive threshold, concluding that any unauthorized rate that falls below one
percent is acceptable. 23 Accordingly, it is imperative that NACHA explicitly state that the total
return threshold does not represent an acceptable level of returns, but rather, the moment at
which the most stringent level ofscmtiny should be applied. Furthermore, NACHA should be
clear that return rates below any of the established thresholds do not qualify as any sort of "s afe
harbor."
The Commission's law enforcement experience also demonstrates that perpetrators of
fraud are increasingly employing techniques designed to mask and artificially reduce their actual
return rates to avoid scrutiny. One of these tactics is the use of"micro-charges·' to inflate the
number of debit transactions used to calculate the rate of returns. 24 In one case, a processor
allegedly advised its client to put through attempted debits multiple times even though each
. would be retumed due to insufficient funds (or "NSF'"), for the purpose of artificially masking
the ratio of attempted debits to returns.25 These and other tactics that manipulate retum rates also
22 OCC Bulletin 2008-12 (emphasis added); see also FFIEC BSAIAML Examination Ma,nual, Third-Par~v Payment
Processors - Oven•iew, 241 (Apr. 29, 20 I 0) ("a bank should thoroughly investigate high levels of retums and
should not accept high levels of returns on the basis that the processor has provided collateral or 'other security to the
bank. ... '').
2J See s~tpra note 17.
24 For example, in FTC v. Ideal Financial. the Commission explained how the defendants allegedly manipulated
return rates with penny debits and credits: ·'Defendants take multiple $0.0 I, $0.03. or $0.04 debits from consumer
accounts and then return them before debiting approximately $30. Defendants refund all of the penny debits as a
new, single transactions (presumably so it is not coded as a ·•return •· by the financial institutions). This increases the
to tal number of debits against the total returns for a particular merchant account, thereby lowering the total return
rate ." FTC v. Ideal Financial, supra note 4, Pl.'s Mem. Supp. TRO I I (citations omitted).
25 FTC, .. AEC, supm note 9, Complaint~ 59c.
7

should be considered by NACI-iA in s~tting the appropriate threshold for total returns,
upauthorizedretums, and data qvality retlU'lls, 	· ·· 	·
Fina.Ily; FTC staff eneovtages NACHA to :tn<>nitor carefully the reactions to ch~ges in
any of the thresholds and to stand ready to make further adjustments as suggested by additional
<lata.
D. Additional Proposals to Improve Network Risk and Enforcement
NACHA outlines additional initiatives to complement the proposals on returns
thresholds. In general~ FTC staff supports NACB'A's efforts to impiementirnprovements that
will aid in the prevention aQ.d detection of fraud;, provide NACHA with stronger enforcement
tools, and streamlihe~ the compliance reporting process.
IV. 	Conclusion
FTC staff appreciates ·the upportunity to comment on the NACHA RPC and encourages
NACI{A to adopt the propos¢c;J rules.
8
Respectfully submitted,
J·essica.L. Rich, DireCtor
Buteau of Consumer Pratecti<rn
lY{artin Gaynor, .Director
Bureau ofEconomics