Blogs

Special thanks to @Emily Nelson, AAP, AFPP, APRP, NCP, Manager, Payments Education for helping me write this blog!

As clients are increasingly using mobile devices, online platforms and connected tools to initiate payments, it’s no surprise that we need to examine how artificial intelligence (AI) is becoming more involved in the initiation of payments and dispute processes. It is important to be able to identify the key components of a transaction to properly investigate an entry if it is disputed, maintain compliance and effectively protect the consumer.

Determining the Authorization Method and SEC Code

First, let’s identify how an Entry was authorized and what would be required based on the authorization method. In our example, we’ll say a payment is initiated for an online purchase via oral instruction through a virtual voice assistant using voice recognition technology, such as Alexa. In this case, the Entry initiated to their account would be a WEB debit. This is because the client used their voice to communicate over the internet or a wireless network, which falls under the WEB debit Entry classification per the ACH Rules. 

Now that we have identified the appropriate Standard Entry Class (SEC) code, let’s review the requirements for Entry authorization under the ACH Rules. While WEB debits are considered a higher risk activity, the overall authorization requirements include:

• Defining whether the Entry is single, subsequent or recurring
• Amount of the Entry
• Timing and number or frequency of Entries
• Receiver’s name or identity
• Account to be debited
• Date of the Receiver’s authorization
• Instructions for revoking authorization

These elements establish the baseline information that must be captured and maintained to support a valid authorization under the ACH Rules.

Originator Responsibilities and Risk Controls

In addition to these requirements, an Originator of such Entries has several responsibilities according to the ACH Rules, including:

• General Rule – Originator Must Obtain Authorization from Receiver– Section 2.3.1
• Debit Entries to Consumer Accounts – Subsection 2.3.2.2
• Electronic Authorizations – Subsection 2.3.2.3
• Standing Authorization for Debit Entries to Consumer Accounts– Section 2.3.2.5
• General Rule for WEB Entries – Subsection 2.5.17.1
• Annual Audit Requirements for Debit WEB Entries – Subsection 2.5.17.3
• Use of Fraud Detection Systems – Subsection 2.5.17.4
• Verification of Receiver’s Identity – Subsection 2.5.17.5
• Verification of Routing Numbers – Subsection 2.5.17.6
• Secure Transmission of ACH Information via Unsecured Electronic Network – Section 1.7

The Originator of the Entry must implement commercially reasonable security procedures to verify both the Receiver's identity and the routing number used in the WEB Entry. Additionally, the Originator must establish and implement a commercially reasonable fraud detection system that validates the account number at first use and when any subsequent changes occur. 

The Originator is also responsible for ensuring that an annual security audit is conducted for WEB Entry transmissions. The timeframes for which an Originator must maintain a WEB authorization depend on whether the Entry was authorized as a single, recurring or standing authorization. This provides a foundation for what is required of an Originator of a WEB debit Entry and insight into what the authorization would look like for this type of Entry.

When a Consumer Disputes an Entry

So, what happens when a client notifies your financial institution that an entry posting to their account is unauthorized? This is where both Regulation E and the ACH Rules come into play, as both sets of rules will need to be reviewed to determine the best option.

Let’s use a more detailed example: a client notifies you on Monday, April 13, 2026, that an Entry to their account is unauthorized. However, the Entry dates back to February 10, 2026. This falls outside the return timeframe under the ACH Rules but is still within the Regulation E timeframe to constitute a timely dispute. At this point, we can utilize the ACH Rules to support the investigation process. 

Investigation and Proof of Authorization (POA)

An investigation process is an opportunity to determine if an error occurred and, if so, what type. The process typically begins with reviewing an account to identify relevant Entry or Entries and requesting proof of authorization (POA). Once the POA is received, a determination needs to be made of whether there is enough information and if the Entry was authorized. 

In this example, additional information from your client states that they do not, and have never had, an Alexa device. If the authorization does not include the account holder’s name, then the investigation would conclude and make our client whole. 

In addition, a Breach of Warranty Claim would likely need filed with the ODFI to recover the funds. The Breach of Warranty Claim letter may outline the following options for recovery:  

• Request the ODFI allow the Entry to be returned as R06 – Return per ODFI’s Request
• Allow the ODFI to send a credit directly to a general ledger account, 

• Allow the ODFI to send the funds via wire transfer. 

Any of these options may be used; however, it is important to document everything clearly to demonstrate compliance.

Ultimately, disputes involving AI-enabled authorizations reinforce the importance of adhering to foundational error-resolution principles, regardless of how innovative the payment method may be. Whether a transaction is initiated through a traditional online interface or a virtual voice assistant, financial institutions must rely on the same core steps: 

• Identifying the payment channel,
• Validating the authorization method,
• Requesting and reviewing POA and
• Applying Regulation E requirements to determine whether an error occurred.

By grounding investigations in these basic fundamentals and leveraging the ACH Rules as a framework for documentation, warranties and recovery, financial institutions can confidently navigate emerging technologies while maintaining compliance, protecting clients and ensuring consistent, defensible outcomes.

Join us for EPCOR Payments University in Branson, MO, August 20–21, for interactive, multi-track learning sessions on fraud trends, industry best practices and more for all skill levels. Take advantage of early bird pricing and save $80 when you register today!