DEFS Learn · AI agents and online banking

How do credit unions prevent ACH and external transfer fraud when an AI agent starts the transfer?

Last updated November 2, 2026 · DEFS Agent Defense (defs.ai)

Short answer

Check the agent's request before the transfer is created. Keep external transfers and ACH off for agents by default, send the first transfer to any new destination account to the member's own device, count limits across all of the member's agents, and log each decision. Nacha's 2026 rules require every ODFI and RDFI to have risk-based processes to identify ACH entries that are unauthorized or sent under false pretenses, so agent-initiated transfers belong in those processes.

Why agent-initiated external transfers need their own controls

External transfers and ACH payments are where a member's money leaves your institution. When an AI agent signs in as the member, it inherits the member's external transfer limit. If that limit is $5,000 a day, a hijacked agent can try to use all of it. The ways an agent request can go wrong:

A hijacked or impersonated agent adds a new external account and sends money to it.
A legitimate agent is tricked by an invoice, memo or payee name that swaps in a new account number.
An agent goes beyond its job. A bill-pay helper attempts an external transfer.
Transfers are split into several smaller ones, or across more than one agent, to stay under a limit.

Nacha's new rules define "False Pretenses" as inducing a payment by misrepresenting a person's identity, their authority to act for someone else, or the ownership of the account to be credited (Nacha). Payee impersonation can be aimed at an AI agent through a doctored invoice or payee name.

What Nacha's 2026 fraud monitoring rules require

Phase	Who it covers
Phase 1, effective March 20, 2026	All ODFIs; non-consumer Originators, Third-Party Service Providers and Third-Party Senders with 2023 ACH origination volume of 6 million or more; RDFIs with 2023 ACH receipt volume of 10 million or more.
Phase 2, effective June 19, 2026 (practically June 22, 2026)	All other RDFIs, and all other non-consumer Originators, Third-Party Service Providers and Third-Party Senders.

Each covered party must establish risk-based processes and procedures, relevant to its role, reasonably intended to identify entries suspected of being unauthorized or authorized under False Pretenses, and review them at least annually (Nacha). The rules don't prescribe a method. Nacha lists velocity checks, anomaly detection, behavioral tolerances and pattern recognition as possibilities, and publishes a list of third-party fraud monitoring vendors (Nacha resource center). Monitoring before processing isn't required, but Nacha notes it gives the greatest opportunity to detect and prevent fraud (Nacha).

The rules don't mention AI agents. A risk assessment that separates higher-risk from lower-risk transactions is the minimum Nacha expects, and transfers started by software acting for a member are a new category to place in that assessment. Confirm how the rules apply to your institution with your ACH compliance lead.

Controls that stop agent-initiated transfer fraud before the entry is created

Risk	Control at the moment of the agent's request
Agent adds a new external account	Hold the first transfer to any new destination for approval on the member's enrolled device.
Invoice, memo or payee name tells the agent to pay a different account	Screen memo and payee fields for instruction-like content and hold those payments for a person.
Bill-pay agent attempts an external transfer	Give each agent an explicit list of allowed operations, with external transfers and ACH off unless the member switches them on.
Transfers split across time or agents	Apply daily and rolling limits per member across all agents, including transfers still pending.
Forged, replayed or tampered agent request	Verify the agent's signed credential on each request and reject expired signatures, reused nonces and altered bodies. See how to verify an AI agent.

Practical steps any institution can take

Add the agent channel to your ACH risk assessment. List which apps and agents can start external transfers today, and through which path.
Start with external transfers and ACH off for agents. Let members switch them on, with approval on their own device for each new destination. See setting agent limits.
Send approvals to the member's device, never to a prompt inside the agent's session. In DEFS testing, a browser agent re-entered the member's password and approved its own step-up prompt.
Count limits per member, across agents. Include pending transfers in the total.
Keep a decision record that shows why each agent transfer was allowed, held or stopped. It supports disputes and the annual review Nacha requires.
Keep your existing ACH monitoring running. File-level and return monitoring cover all entries. The agent checkpoint adds a decision before an agent's transfer is created.

How DEFS handles it

DEFS checks AI-agent requests for external transfers, ACH and moving deposits out before they reach your core or payments engine, so the decision happens before the entry exists. Each decision is logged with the agent, the member's scope and the reason, and the log can be exported for your annual review of ACH fraud procedures.

One checkpoint before money moves. Every agent request for bill pay, transfers, ACH, disputes or moving deposits out passes through DEFS before your core or payments engine sees it.
Accepts the credentials agents already carry. DEFS checks Cloudflare Web Bot Auth, Visa Trusted Agent Protocol and Google AP2 credentials today, and is adding Mastercard Agent Pay, Prove and World ID. Members and agent makers don't adopt anything new.
Your scopes and the member's, enforced together. For example: bill pay up to $500 to existing payees, no external transfers. The strictest rule wins.
Members stay in charge. New payees and new destinations go to the member's own device for approval. A "connected agents" page lets members see every agent and revoke it with one tap.
Your fraud team keeps the controls. A live decision log, approve, limit or block for any agent, a kill switch that stops all agent money movement at once, and a tamper-evident audit trail. DEFS reviewers run it day to day; your team can step in any time.
Shared protection. A rogue agent blocked at one participating institution is flagged for yours, on your terms.

The demo results

We tested DEFS in a model credit union built from public information, using test data. OpenAI and Claude agents sent it 3,259 requests: everyday member tasks mixed with deliberate attacks.

1,490 of 1,491attack attempts stopped by DEFS. The one remaining request moved $0 because the core system rejected it.
0 of 807legitimate requests wrongly blocked: zero false positives.
3,259requests from OpenAI and Claude agents, decided in a median of 7 ms.

"Stopped" means DEFS denied the request outright or held it until the member or a reviewer decided. No attack attempt moved any money.

Attack type in the test	Result
External transfers attempted by agents not allowed to make them	115 of 115 stopped
New-payee attempts	90 of 90 stopped or held for the member
Transfers split across several agents	72 of 72 stopped or held
Agents reaching beyond their scope	129 of 129 stopped

See it for yourself in the live demo environment (test data only), or book a 30-minute walkthrough.

See DEFS stop a rogue AI agent before it moves money, live, in 30 minutes.

Book a demo

Frequently asked questions

Do Nacha's 2026 fraud monitoring rules apply to credit unions?

Yes, in their roles as ODFI and RDFI. All ODFIs were covered from March 20, 2026. RDFIs with 2023 receipt volume of 10 million or more entries were covered from March 20, 2026, and all other RDFIs from June 19, 2026, practically June 22, 2026.

Do the Nacha rules mention AI agents?

They don't. The rules are neutral on method and technology. They ask for risk-based processes reasonably intended to identify entries that are unauthorized or authorized under False Pretenses, whoever or whatever started the payment.

Should AI agents be allowed to make external transfers at all?

DEFS keeps external transfers and ACH off for agents by default. The institution or the member can switch them on for an agent, and the first transfer to each new destination is held until the member approves it on their own device.

Does Nacha require monitoring before an ACH entry is processed?

No. Nacha says pre-processing monitoring is not required, and also that monitoring before processing gives the greatest opportunity to detect and prevent fraud. Checking an agent's request before the transfer is created is one way to get that earlier decision.

Does DEFS replace our ACH fraud monitoring?

DEFS covers requests from AI agents before an external transfer or ACH payment is created. Your file-level ACH monitoring and return monitoring keep running for all entries.

Sources

Nacha: Risk Management Topics (Fraud Monitoring Phase 2)
Nacha: Credit-Push Fraud Monitoring Resource Center
DEFS demo results: model credit union built from public information, using test data (3,259 agent requests from OpenAI and Claude agents).