Merchant Payment Processor Scam via ACH Transfer
Scammers posing as payment processors obtain business bank account and routing numbers, then initiate unauthorized ACH withdrawals framed as fees or equipment charges.
Part of: Merchant Payment Processor Scam
Last reviewed: 5 July 2026
ACH transfers are the backbone of how real payment processors move settlement funds and collect fees, which makes it easy for a fraudulent processor to convince a business owner that an ACH withdrawal request is routine.
How this scam works on ACH transfer
After convincing a business owner that a rate change, compliance update, or new equipment is required, the scammer requests the business's bank account and routing number to 'set up' the new arrangement, framing it as standard onboarding for any payment processor. Once obtained, they initiate one or more ACH debits from the business account, sometimes disguised as small test transactions first to confirm the account is active before larger withdrawals follow.
Because ACH transactions typically take one to two business days to post and can be harder for business accounts to dispute than consumer accounts (business banking has fewer built-in fraud protections under US regulations like Regulation E, which mainly protects individual consumers), by the time the withdrawal appears on a statement, the funds have often already been moved out of the scammer's receiving account, leaving the business with limited recovery options.
Common red flags
- Request for full bank account and routing numbers to 'set up' new processing before any written contract
- Small test withdrawals appear on the account shortly after the call, followed by larger debits
- No formal merchant services agreement or terms document was ever signed
- The requesting company cannot be verified through a business registry or your existing processor
- Refusal to use a standard merchant onboarding portal instead of direct bank details over the phone
- Pressure to provide banking details quickly to avoid 'losing the promotional rate'
How to protect yourself
- Never provide business bank account and routing numbers to an unsolicited caller or emailer
- Insist on a written merchant services agreement before any banking information is shared
- Monitor your business bank account daily for small test transactions, which often precede larger fraud
- Set up ACH debit blocks or filters with your bank that require pre-authorization for new originators
- Verify any new processor through your bank and industry review sites before switching
- Report unauthorized ACH debits to your bank immediately, as recovery windows are time-limited
How to report it
- Contact your bank immediately to dispute unauthorized ACH transactions and request an ACH block
- Report to the FTC at reportfraud.ftc.gov
- Report to the FBI's Internet Crime Complaint Center (IC3.gov)
- File a complaint with the Consumer Financial Protection Bureau if your bank is unresponsive
Frequently asked questions
How quickly do I need to report an unauthorized ACH debit to my business account?
As soon as possible. Business accounts generally have shorter and less protected dispute windows than personal consumer accounts, so immediate reporting to your bank significantly improves the chance of recovery.
Can I block unauthorized ACH debits before they happen?
Yes, most business banks offer ACH debit filters or blocks that require you to pre-authorize any new company attempting to withdraw funds from your account.