ACH Return Rate Statistics 2026
By Axis Intelligence Research
Co-author: Sarah Davis | Last updated: August 24, 2026 | License: CC BY 4.0
Every ACH originator in the United States is measured against three return rate ceilings: 0.5% unauthorized, 3.0% administrative, 15.0% overall. According to Axis Intelligence Research, those ceilings sit a severity-weighted 13.2 times above the last network-wide return rates Nacha published, and that publication covered calendar year 2013.
Quick Answer
Nacha enforces an unauthorized return rate threshold of 0.5%, an administrative return rate level of 3.0% (R02, R03, R04) and an overall return rate level of 15.0%, each calculated on ACH debits over the preceding 60 days or two calendar months. According to Axis Intelligence Research, the Axis Return Threshold Headroom Index (RTHI) reads 1,325 as of August 24, 2026, where 100 would mean the thresholds sat exactly at the published network return rate. On the fraud side, the FBI recorded $3.05 billion in business email compromise losses in 2025, with wire transfer or ACH the reported movement method in 86% of BEC transactions.
Key Findings
- According to Nacha’s ACH Network Risk and Enforcement rule, the unauthorized return rate threshold is 0.5% of debit entries, and exceeding it is the only one of the three that is treated as an automatic Rules matter rather than a preliminary inquiry trigger.
- According to Axis Intelligence Research, the Axis Return Threshold Headroom Index reads 1,325 as of August 24, 2026 — Nacha’s enforcement ceilings are 13.2 times the last network return rates the association published, which were 2013 figures.
- According to Axis Intelligence Research, the three thresholds applied to the ACH Network’s 19.59 billion debits in 2025 define an annual return envelope of 97.95 million unauthorized returns, 587.7 million administrative returns and 2.94 billion total returned debits.
- According to the FBI’s 2025 Internet Crime Report, business email compromise produced $3,046,598,558 in losses across 24,768 complaints, and the IC3 Recovery Asset Team froze $679,013,183 of $1,163,919,846 in attempted theft for a 58% success rate.
- According to Axis Intelligence Research, average reported BEC loss per complaint fell 4.8% in 2025 to $123,005 even as total BEC losses rose 10.0% — the category grew by adding victims, not by extracting more from each one.
Source: axis-intelligence.com/ach-payments-statistics/ — CC BY 4.0
What Is a Normal ACH Return Rate?
There is no published network-wide average, and the honest answer to the question is that the payments industry has been navigating by a fifteen-year-old star.
Nacha sets three ceilings under its ACH Network Risk and Enforcement rule, and the rule text explains each one by reference to a network average. Unauthorized debit returns averaged 0.03% across the ACH Network in calendar year 2013. Administrative returns for account data errors averaged 0.33%. All debit returns for any reason averaged 1.42%. Those three figures are the last network-level return rates Nacha has stated in a public rule document, and every threshold in force today was calibrated against them.
The Three Return Rate Thresholds
| Category | Codes | Ceiling | Nature | Published network average | Source |
|---|---|---|---|---|---|
| Unauthorized | R05, R07, R10, R29, R51 | 0.5% | Threshold — breach is a Rules matter | 0.03% (CY2013) | Nacha |
| Administrative | R02, R03, R04 | 3.0% | Level — opens preliminary inquiry | 0.33% (CY2013) | Nacha |
| Overall | All codes, RCK excluded | 15.0% | Level — opens preliminary inquiry | 1.42% (CY2013) | Nacha |
Source: Nacha, ACH Network Risk and Enforcement Topics, retrieved August 24, 2026. Calculation methods are set out in Nacha’s unauthorized return rate worksheet and its administrative and overall return rate worksheet.
A code-list discrepancy we are not going to smooth over. Nacha’s rule page names five codes in the unauthorized category. Most originator-facing return rate reporting in the market counts six, adding R11, which Nacha created as a distinct code for debits authorized but improperly originated. The rule page has not been amended to reflect it. If you are calculating a return rate for a compliance file, confirm the code set your ODFI applies rather than assuming either list.
The distinction between a threshold and a level is the one most treasury teams get wrong. Crossing 0.5% unauthorized puts an originator into the ODFI obligations written into Article Two of the Rules. Crossing 3% or 15% does not, on its own, constitute a violation — it opens a preliminary inquiry in which an industry review panel of bank, payments association and ACH Operator representatives examines origination practice before any directive to reduce is issued. The panel weighs total forward and returned volume, the unauthorized rate, evidence of reinitiation violations, legal or regulatory actions, and consumer complaint materiality.
Sarah Davis: The 15% overall level reads generous until you notice what it is made of. Insufficient-funds returns dominate the overall rate for most debit originators, and NSF is a collections outcome, not a fraud signal. Nacha built the level high on purpose so that subscription billers and lenders with structurally NSF-heavy books do not get swept up alongside the outliers. The number that actually costs an originator its banking relationship is 0.5%, and most ODFIs enforce well inside it.
Axis Return Threshold Headroom Index (RTHI)
Nacha itself framed the thresholds as multiples of the network average when it wrote them — more than 16 times for unauthorized, more than nine times for administrative, roughly 10.5 times for overall. Axis Intelligence Research turned that framing into a single trackable reading, so the gap between the enforcement ceiling and the observed network can be quoted, compared and refreshed the moment a newer network figure appears.
RTHI: definition, components and formula
RTHI — Return Threshold Headroom Index. A severity-weighted composite of the three category headroom multiples, expressed on a scale where 100 = thresholds set exactly at the published network return rate (zero headroom).
| Component | Threshold | Published network rate | Headroom multiple (RHM) | Weight | Index points |
|---|---|---|---|---|---|
| Unauthorized returns | 0.50% | 0.03% | 16.67x | 50% | 833.3 |
| Administrative returns | 3.00% | 0.33% | 9.09x | 25% | 227.3 |
| Overall returns | 15.00% | 1.42% | 10.56x | 25% | 264.1 |
| RTHI reading, August 24, 2026 | 1,324.7 |
Sources: thresholds and network averages both from Nacha, ACH Network Risk and Enforcement Topics, retrieved August 24, 2026. Multiples, weights and index computed by Axis Intelligence Research.
Formula: RTHI = [ 0.50 x (0.005 / 0.0003) + 0.25 x (0.030 / 0.0033) + 0.25 x (0.150 / 0.0142) ] x 100
Weights, and why. Unauthorized carries half the index alone because it is the only category where a breach is an automatic Rules matter with ODFI obligations attached; administrative and overall each open a preliminary inquiry and split the remainder evenly, since neither carries more procedural weight than the other in the review panel process.
Data vintage. The denominators are Nacha’s calendar-year 2013 network averages, the most recent network-wide return rates the association has published in a rule document. The index measures the distance between the enforcement ceiling and the last observable network floor. It does not claim 2013 rates persist today.
Scope. RTHI describes regulatory headroom, not risk. A reading of 1,325 says the thresholds are far above the last measured network behaviour; it says nothing about how any individual originator is performing, and it moves only when Nacha changes a threshold or publishes a new network rate.
Review trigger: recomputed the day Nacha publishes a network-wide return rate for any year after 2013, or amends any of the three ceilings.
Cite this metric as: Axis Intelligence Research, Axis Return Threshold Headroom Index, reading of August 24, 2026. CC BY 4.0.
How Many ACH Returns Do the Rules Actually Permit?
Percentages hide scale. Converting the thresholds into transaction counts at 2025 network volume produces numbers that reframe what the rulebook tolerates.
The ACH Network carried 19.59 billion debits in 2025 within a total of 35.19 billion payments worth $93.00 trillion, per Nacha’s full-year figures. Axis Intelligence Research applies each threshold to that debit base to produce the ACH Debit Return Envelope (ADRE) — the annual count of returned debits the ceilings permit at network scale.
| Category | Threshold | ADRE at 2025 debit volume | Implied at CY2013 network rate | Gap | Source |
|---|---|---|---|---|---|
| Unauthorized | 0.5% | 97,950,000 | 5,877,000 | 92,073,000 | Nacha, Axis calculated |
| Administrative | 3.0% | 587,700,000 | 64,647,000 | 523,053,000 | Nacha, Axis calculated |
| Overall | 15.0% | 2,938,500,000 | 278,178,000 | 2,660,322,000 | Nacha, Axis calculated |
ADRE formula: ADRE(category) = 2025 ACH Network debit volume x category threshold. Debit volume from the Nacha ACH Network Volume and Value Statistics page, retrieved August 24, 2026. Debits were 55.67% of 2025 network payments, calculated by Axis Intelligence Research.
According to Axis Intelligence Research, the overall return rate level would accommodate 2.94 billion returned debits a year before a single originator crossed it — against roughly 278 million implied by the last published network rate. This is not a criticism of the ceiling. Return rate levels are designed to isolate outliers, and a ceiling set near the mean would flag half the network. It is a measurement of how much room the outlier-detection system leaves, which is the thing nobody had put a number on.
One calculation we refused. We were able to divide BEC losses by ACH Network value and produce a fraud rate for the rail. We will not publish it. IC3’s loss figures are victim-reported across wire, ACH and other rails without a clean split, and Nacha’s $93.00 trillion covers credits and debits across every use case. The quotient would be a fraud rate for neither system. Where the numerator and denominator come from different populations, the honest output is two numbers side by side.
Sarah Davis: Originators do not manage to the Nacha ceiling. They manage to whatever their ODFI wrote into the origination agreement, which is routinely a fraction of it — 0.4% unauthorized, 2.5% administrative, sometimes an overall cap in the single digits. The bank’s risk appetite is the binding constraint, and it is repriced whenever the sponsor bank’s own examiners get interested. Read the ceilings in this article as the outer wall, not the fence you will actually hit.
Where ACH Fraud Actually Moves: The 2025 Federal Data
Return rates catch unauthorized debits after the fact. The fraud that has grown fastest since 2023 runs the other direction — credit-push, where the victim authorizes a payment they were deceived into sending, and no return code applies.
The FBI’s 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in losses, up 26% year over year. Business email compromise, the category that overwhelmingly rides payment rails rather than cards or crypto, produced $3,046,598,558 across 24,768 complaints. In IC3’s transaction-type breakdown, wire transfer or ACH accounts for 86% of reported BEC transactions — the highest concentration of any fraud category on any single method in the report. Applying that share, Axis Intelligence Research estimates $2.62 billion of 2025 BEC losses moved over wire or ACH rails.
Business Email Compromise, 2023-2025
| Year | Complaints | Reported loss | Loss per complaint | Source |
|---|---|---|---|---|
| 2023 | 21,489 | $2,946,830,270 | $137,132 | FBI IC3, Axis calculated |
| 2024 | 21,442 | $2,770,151,146 | $129,193 | FBI IC3, Axis calculated |
| 2025 | 24,768 | $3,046,598,558 | $123,005 | FBI IC3, Axis calculated |
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report, retrieved August 24, 2026. Per-complaint figures calculated by Axis Intelligence Research.
According to Axis Intelligence Research, BEC complaint volume rose 15.5% in 2025 while total losses rose 10.0% and average loss per complaint fell 4.8%. The headline every outlet ran was the $3 billion. The number underneath it says the category is broadening into smaller targets rather than deepening against large ones — which is exactly the pattern that pushes fraud attempts down-market into originators with thinner controls.
IC3’s own operational note is the most ACH-specific sentence in the entire federal record for 2025: account takeover incidents referred to its Recovery Asset Team can contain fifty or more transactions to different recipient accounts at multiple banks simultaneously, via ACH. Account takeover itself produced roughly 4,700 complaints and $359.7 million in losses, an average of $76,532 per incident.
Fund Recovery: Financial Fraud Kill Chain, 2025
| Metric | Domestic | International | Total | Source |
|---|---|---|---|---|
| Incidents | 3,574 | 326 | 3,900 | FBI IC3 |
| Funds frozen | $507,042,623 | $171,970,560 | $679,013,183 | FBI IC3 |
| Attempted theft | — | — | $1,163,919,846 | FBI IC3 |
| Success rate | — | — | 58% | FBI IC3 |
| Frozen per incident | $141,870 | $527,517 | $174,106 | Axis calculated |
Source: FBI IC3, 2025 Internet Crime Report, retrieved August 24, 2026. Per-incident figures calculated by Axis Intelligence Research.
According to Axis Intelligence Research, international FFKC actions represented 8.36% of incidents but 25.33% of all funds frozen, with an average freeze 3.72 times the domestic figure. The cases that cross borders are the large ones, and the international channel — coordinated through FinCEN’s Rapid Response mechanism — is recovering them at a rate that undercuts the industry assumption that money out of the country is money gone. The counterweight sits in the same table: $484,906,663 of attempted theft was not frozen in 2025, which is what a 58% success rate looks like in dollars.
Recovery is also uneven by sector. IC3 initiated 655 FFKC actions for critical infrastructure organizations against $261,451,001 in losses and froze $146,561,094, a 56% rate — with the financial sector itself at 53%, below the all-incident average.
Sarah Davis: Follow the timing rather than the totals. The kill chain works because a domestic ACH credit or wire is still sitting in a mule account when the complaint lands, and it stops working the moment the second hop clears. That is the entire economics of the 58%. It is also why Nacha’s 2026 rules put monitoring obligations on the receiving side for the first time — the ODFI cannot see the mule, and the RDFI can.
What Changed in the Nacha Rules in 2026?
Nacha’s Risk Management Framework produced the largest expansion of ACH fraud obligations in the network’s history, and both phases are now live.
Phase 1 took effect March 20, 2026, applying to all ODFIs and to non-consumer Originators, Third-Party Service Providers and Third-Party Senders whose 2023 origination volume exceeded 6 million entries, plus RDFIs whose 2023 receipt volume exceeded 10 million entries. Phase 2 followed on June 19, 2026, eliminating the volume thresholds entirely — Nacha notes that because June 19 is a federal holiday, the practical compliance date was Monday, June 22, 2026.
The substance is a reversal of thirty years of design assumptions. Return rate thresholds police debit pull. The 2026 rules require risk-based processes to identify credit entries initiated due to fraud, on both sides of the transaction, and Nacha’s Credit-Push Fraud Monitoring Resource Center lists velocity checks, anomaly detection, behavioural tolerances and pattern recognition as acceptable approaches without mandating any of them. The Rules are technology-neutral by design, which means examination will turn on documented risk assessment rather than on any particular control.
Two adjacent obligations landed in the same package: standardized Company Entry Descriptions for PPD credits covering payroll and e-commerce purchases, and an annual review requirement written into the rule itself, so the risk assessment is a recurring exercise rather than a one-time implementation.
Where this shows up in practice is in the receiving institution’s queue. Federal Reserve Financial Services surveyed more than 400 risk professionals in the fourth quarter of 2025 and found ACH-related fraud rising through account holder scams at 41% of institutions, alongside business email compromise, unauthorized debits and account takeover. In the same survey, account takeover by authorized parties affected 23% of institutions, a 7% year-over-year increase, and debit card fraud remained the most widespread type at 75% of institutions and an estimated 40% of total payments fraud losses.
Consumer-side reporting points the same way. The Federal Trade Commission recorded $3.5 billion in imposter scam losses in 2025 within about $16 billion of total reported fraud losses, up roughly 25% on 2024, with business impersonators accounting for nearly $1 billion and the highest losses within that group attributed to bank impersonators. The FTC’s description of the mechanism is the one that matters for ACH: a fake security alert from a bank, followed by the victim moving money to “protect” it.
The regulatory interest in return rates is not new, incidentally. When Nacha proposed lowering the unauthorized threshold from 1.0% to 0.5%, FTC staff filed a comment supporting it on the grounds that high unauthorized return rates flag problematic business practices. That framing — return rate as a consumer-protection tripwire rather than an operational metric — is why the number carries the enforcement weight it does.
How Do ACH Return and Fraud Metrics Compare Across Rails?
ACH remains the dominant rail by value. The Federal Reserve’s 2025 triennial payments study found total noncash payments reached 236.6 billion in 2024, with ACH accounting for almost three quarters of noncash payment value for the first time.
That concentration is why the return rate architecture matters beyond compliance. A rail carrying three quarters of noncash value with a reversibility window measured in days — 60 days for consumer unauthorized debits under Regulation E, two banking days for most others — is running the largest exception-handling operation in US payments. Our ACH Payments Statistics page covers network volume and the instant-rail comparison in depth, and Same Day ACH Statistics covers the faster settlement window where recovery timelines compress hardest.
Segment exposure varies more than most originator guidance admits. Direct Deposit is credit-push and generates almost no unauthorized debit returns, but is squarely in the payroll-diversion path the 2026 rules target. Healthcare EFT carries administrative return exposure through stale provider account data rather than fraud. And per-payment ceilings shape the loss distribution directly, which is why ACH transfer limits belong in the same risk conversation as return rates.
Methodology
Collection. Every figure was fetched from a primary source during production on August 24, 2026. Return rate thresholds, category code lists, calculation methods and the CY2013 network averages come from Nacha rule documents and Nacha calculation worksheets. Network volume and value come from Nacha full-year 2025 results. Fraud, recovery and transaction-type data come from the FBI Internet Crime Complaint Center’s 2025 Internet Crime Report. Institutional fraud incidence comes from the Federal Reserve Financial Services 2026 Risk Officer Report. Consumer loss data comes from the Federal Trade Commission. Noncash payment context comes from the Federal Reserve’s 2025 triennial payments study. No figure came from an aggregator, a competitor compilation or model memory.
Calculations. All shares, ratios, per-unit figures and index readings labelled as Axis Intelligence Research figures were computed in Python from the sourced inputs and are reproducible from the accompanying CSV. RTHI and ADRE formulas, components, weights and baselines are disclosed in full above. Percentages are reported to two decimals from unrounded inputs.
What was refused. Two calculations were available and rejected. First, any BEC-loss-to-ACH-value fraud rate, because the numerator is victim-reported across multiple rails and the denominator is a single network’s total throughput. Second, any implied 2025 network return rate derived by interpolating from the 2013 figures, because no source supports the interpolation.
Scope note. Return rate thresholds apply to debit entries. The 2026 fraud monitoring rules apply to credit entries. Figures in this article are not additive across the two regimes, and the CSV flags each row accordingly.
About This Dataset
The companion CSV contains every figure cited above as an individual row, with value, unit, as-of date, source organization, source document, source URL, retrieval date, primary-source flag, Axis-calculated flag and a method note on each derived row. It covers the three Nacha return rate thresholds and their published network baselines, the RTHI components and reading, the ADRE envelopes at 2025 network scale, BEC complaint and loss series for 2023-2025, Financial Fraud Kill Chain results by channel, account takeover figures, Federal Reserve institutional fraud incidence and FTC consumer loss figures.
License: CC BY 4.0. Free to use commercially and non-commercially with attribution.
Cite this dataset as: Axis Intelligence Research. ACH Return Rate Statistics 2026. Axis Intelligence, 2026. https://axis-intelligence.com/ach-return-rate-statistics/
Citation
APA Axis Intelligence Research. (2026). ACH return rate statistics 2026: The thresholds, the benchmark nobody has updated, and where the fraud actually moves. Axis Intelligence. https://axis-intelligence.com/ach-return-rate-statistics/
MLA Axis Intelligence Research. “ACH Return Rate Statistics 2026: The Thresholds, the Benchmark Nobody Has Updated, and Where the Fraud Actually Moves.” Axis Intelligence, 24 Aug. 2026, axis-intelligence.com/ach-return-rate-statistics/.
Chicago Axis Intelligence Research. “ACH Return Rate Statistics 2026: The Thresholds, the Benchmark Nobody Has Updated, and Where the Fraud Actually Moves.” Axis Intelligence. August 24, 2026. https://axis-intelligence.com/ach-return-rate-statistics/.
Frequently Asked Questions
Which return reason codes count toward the unauthorized return rate?
Nacha’s rule document names R05, R07, R10, R29 and R51. Most originator-facing return rate reporting also counts R11, which Nacha created to separate debits that were authorized but improperly originated from outright unauthorized entries; the rule page has not been amended to list it. Confirm the code set your ODFI applies before reconciling a compliance file, because the two lists produce different rates on the same portfolio.
Is the 60-day or the two-calendar-month calculation method correct?
Both are permitted. Nacha allows an originator to divide returned debits by the total debits in the files that carried the original entries, or by total debits originated, in each case over the preceding 60 days or two calendar months. The two methods diverge for originators with uneven monthly volume, and switching between them mid-review is what usually produces a rate an ODFI cannot reproduce.
Does exceeding the 15% overall return rate level mean a fine?
No. The overall and administrative figures are Return Rate Levels, not thresholds. Crossing one opens a preliminary inquiry in which an industry review panel examines forward and returned volume, the unauthorized rate, any reinitiation violations, regulatory actions and consumer complaint materiality. Fines are possible only at the conclusion of a subsequent enforcement proceeding, and the panel is the deciding authority.
Are prenotes included in return rate calculations?
Yes, when they carry debit transaction codes. Nacha includes prenotes with debit transaction codes in return rate monitoring. A prenote returned R02, R03 or R04 counts toward the administrative rate — which is the point of sending it, since catching the account error at prenote stage prevents a live entry from returning later.
Why are RCK entries excluded from the overall return rate?
Because an RCK is a re-presentment of a check already returned for insufficient funds, so an NSF return on it is the expected outcome rather than a quality signal. Including RCK entries would make a valid overall rate impractical to establish. RCK entries and their returns may be excluded from both numerator and denominator.
Do the 2026 fraud monitoring rules change return rate obligations?
No. The two regimes govern opposite directions of flow. Return rate thresholds apply to debit entries and are unchanged. The 2026 Risk Management rules require ODFIs, non-consumer Originators, Third-Party Senders, Third-Party Service Providers and RDFIs to run risk-based processes identifying credit entries initiated due to fraud, with all volume thresholds removed as of June 22, 2026.
Can an originator reinitiate a debit returned as unauthorized?
No. An entry returned as unauthorized cannot be remedied by reinitiation, and attempting it is an improper reinitiation practice. A permissible reinitiation must carry identical Company Name, Company ID and Amount, and must use the “RETRY PYMT” Company Entry Description. An originator that obtains a genuinely new authorization after receiving the return may debit again, but the authorization has to follow the return, not precede it.
How much fraudulently transferred money is actually recovered?
The FBI’s Recovery Asset Team froze $679,013,183 of $1,163,919,846 in attempted theft across 3,900 Financial Fraud Kill Chain actions in 2025, a 58% success rate, leaving $484,906,663 unfrozen. Recovery depends almost entirely on speed: the freeze works while funds remain in the initial recipient account, and IC3 extends the process to second-hop transactions only when those details are supplied at initiation.
What is the Axis Return Threshold Headroom Index measuring?
RTHI measures the distance between Nacha’s enforcement ceilings and the last network-wide return rates Nacha published, weighted 50% unauthorized, 25% administrative and 25% overall. Its August 24, 2026 reading of 1,325 means the ceilings sit 13.2 times above that baseline. It is a regulatory-headroom measure, not a risk measure, and it moves only when a threshold changes or a newer network rate is published.
Which segments face the highest administrative return exposure?
Segments with high account-data churn rather than high fraud. Healthcare claim payments, insurance premium collection and any recurring debit book with an ageing consumer file accumulate R02, R03 and R04 returns through closed and mistyped accounts. Account validation at authorization, required for WEB debits since 2021, is the control that moves the administrative rate, and it is the cheapest of the three rates to fix because the cause is data quality rather than customer intent.