Merchant Payment Processor Scam via ACH Transfer
Scammers posing as payment processors obtain business bank account and routing numbers, then initiate unauthorized ACH withdrawals framed as fees or equipment charges.
Part of: Merchant Payment Processor Scam
Last reviewed: 5 July 2026
ACH debits genuinely are how real processors settle funds and collect fees, so a request for a bank account and routing number during 'onboarding' feels routine to a business owner. That familiarity is the cover: after a pretext about a rate change, compliance update, or new equipment, the fraudster takes the numbers and initiates ACH debits, often starting small to test that the account is live. The distinction that matters most is the weaker safety net, since business accounts lack most of Regulation E's consumer fraud protections, and by the time a debit posts, the funds have usually already moved on.
How this scam works on ACH transfer
After convincing a business owner that a rate change, compliance update, or new equipment is required, the scammer requests the business's bank account and routing number to 'set up' the new arrangement, framing it as standard onboarding for any payment processor. Once obtained, they initiate one or more ACH debits from the business account, sometimes disguised as small test transactions first to confirm the account is active before larger withdrawals follow.
Because ACH transactions typically take one to two business days to post and can be harder for business accounts to dispute than consumer accounts (business banking has fewer built-in fraud protections under US regulations like Regulation E, which mainly protects individual consumers), by the time the withdrawal appears on a statement, the funds have often already been moved out of the scammer's receiving account, leaving the business with limited recovery options.
Common red flags
- Request for full bank account and routing numbers to 'set up' new processing before any written contract
- Small test withdrawals appear on the account shortly after the call, followed by larger debits
- No formal merchant services agreement or terms document was ever signed
- The requesting company cannot be verified through a business registry or your existing processor
- Refusal to use a standard merchant onboarding portal instead of direct bank details over the phone
- Pressure to provide banking details quickly to avoid 'losing the promotional rate'
How to protect yourself
- Never provide business bank account and routing numbers to an unsolicited caller or emailer
- Insist on a written merchant services agreement before any banking information is shared
- Monitor your business bank account daily for small test transactions, which often precede larger fraud
- Set up ACH debit blocks or filters with your bank that require pre-authorization for new originators
- Verify any new processor through your bank and industry review sites before switching
- Report unauthorized ACH debits to your bank immediately, as recovery windows are time-limited
How to report it
- Contact your bank immediately to dispute unauthorized ACH transactions and request an ACH block
- Report to the FTC at reportfraud.ftc.gov
- Report to the FBI's Internet Crime Complaint Center (IC3.gov)
- File a complaint with the Consumer Financial Protection Bureau if your bank is unresponsive
Frequently asked questions
What are the small test withdrawals scammers make before a larger ACH debit?
Scammers often withdraw a very small amount first to confirm the account is active and the routing details work, before attempting a larger unauthorized debit. Spotting and reporting even a tiny unexplained withdrawal quickly can stop a bigger loss before it happens.
Do business bank accounts have the same fraud protections as personal accounts for ACH debits?
Generally not — US consumer protections like Regulation E mainly apply to personal accounts, while business accounts often have shorter, contractually defined windows to dispute unauthorized transactions. This makes fast detection and reporting even more important for a business account.
How do I set up an ACH debit block with my bank?
Contact your bank's business banking or treasury services team and ask about ACH debit filters or blocks, which require pre-authorization before any new company can withdraw funds from your account. Many business banks offer this at no or low cost, and it directly helps prevent this type of fraud.
How quickly do I need to report an unauthorized ACH debit to my business account?
As soon as possible. Business accounts generally have shorter and less protected dispute windows than personal consumer accounts, so immediate reporting to your bank significantly improves the chance of recovery.
Can I block unauthorized ACH debits before they happen?
Yes, most business banks offer ACH debit filters or blocks that require you to pre-authorize any new company attempting to withdraw funds from your account.