You may have seen headlines suggesting a powerful new banking rule is about to force banks to pay back everyone scammed on Zelle, Cash App, or Venmo. The rule is real. It’s called Nacha’s “false pretenses” fraud-monitoring rule, and its second phase goes live in June 2026. But the headline version is misleading. Let’s separate what the rule actually does from what people wish it did.
The Short Answer
No — the Nacha false pretenses rule does not force your bank to refund scam victims, and it mostly doesn’t even touch Zelle, Cash App, or Venmo transfers. It is a monitoring and detection rule for the ACH network. Nacha itself has stated plainly that the rule “does not change the allocation of liability” between parties. It requires banks and businesses to watch for suspicious payments — not to reimburse the people who send them.
What the Rule Actually Says
Nacha (the National Automated Clearing House Association) governs the ACH network — the system behind direct deposit, bill pay, and bank-to-bank transfers. In 2024 it approved a “Risk Management” package aimed at credit-push fraud, where a victim is tricked into authorizing a payment.
The rule introduces a defined term, “False Pretenses,” meaning a payment induced by someone misrepresenting their identity, their authority to act for another person, or the ownership of the account being paid. Think business email compromise, fake-vendor invoices, or payroll impersonation. Notably, it does not cover scams involving fake, non-existent, or poor-quality goods.
The obligation is to build “risk-based processes” to identify and flag suspected unauthorized or false-pretenses credit entries. That’s it. There’s no mandate to freeze, reverse, or refund.
The Two Phases
| Phase | Effective date | Who must comply |
|---|---|---|
| Phase 1 | March 20, 2026 | All ODFIs (originating banks) plus originators, third-party senders & service providers whose 2023 volume topped 6 million entries |
| Phase 2 | June 19, 2026 (a federal holiday, so practically June 22, 2026) | The 6-million threshold is removed — all non-consumer originators, third-party senders/service providers, and all receiving banks (RDFIs) must comply |
Phase 2 simply widens the net so that every business and bank on the ACH network — not just the giants — has to run fraud monitoring. It changes who monitors, not who pays.
Why Zelle, Cash App & Venmo Are (Mostly) a Different World
Here’s the part the headlines skip: these apps largely don’t run on ACH for the actual person-to-person transfer.
- Zelle runs on its own network operated by Early Warning Services (bank-owned), moving money between enrolled bank accounts in near-real-time — not through the ACH batch system.
- Venmo and Cash App move money on their own internal ledgers. ACH usually only appears when you load a balance from a linked bank or cash out to it — not for the app-to-app payment itself.
Because the peer-to-peer leg isn’t an ACH “credit entry,” the Nacha rule generally doesn’t govern the transaction that scammers exploit. A rule about ACH monitoring can’t force a refund on a payment that never rode the ACH rails.
So What Does Decide Whether You Get Money Back?
For consumer app scams, the deciding framework is federal Regulation E (the Electronic Fund Transfer Act), and it draws a hard line:
- Unauthorized transfers (a criminal took over your account and sent money without you) — generally protected; the bank must investigate and typically reimburse.
- Authorized transfers (you personally tapped “send,” even though a scammer manipulated you) — not covered by Regulation E. Most scams fall here, which is why refunds aren’t automatic.
As of 2026, no federal law requires reimbursement for authorized-but-deceived transfers. That’s the gap the Nacha rule does not close.
Worked Examples
- You Zelle $2,000 to a “utility company” that turns out to be a scammer. You authorized it. Not an ACH entry, and not a Reg E-protected unauthorized transfer. The Nacha rule changes nothing here — recovery depends on your bank’s own policy and any voluntary scam-reimbursement program.
- A hacker takes over your Cash App and drains $500 while you’re asleep. This is unauthorized — Regulation E likely applies, and the Nacha rule is irrelevant.
- Your company’s accountant is tricked by a fake-vendor email and sends a $40,000 ACH payment. This is squarely a false-pretenses ACH credit. The originating bank must have monitoring to flag it under the new rule — but even here, Nacha doesn’t guarantee the money comes back. It improves the odds of catching and recovering it, not a right to refund.
The Real Reimbursement Movement (Separate From Nacha)
Refund pressure on P2P apps is coming from different directions:
- Zelle’s own operating rules: Since 2023, Early Warning’s rules require member banks to reimburse victims of certain imposter scams — notably “me-to-me” bank-impersonation fraud — a real shift from blanket denials, though it covers only specific scam types.
- Litigation: The CFPB sued over Zelle fraud in December 2024 but dropped the case in March 2025. New York’s Attorney General is pursuing a separate roughly $1 billion state lawsuit still moving through the courts in mid-2026.
These may eventually expand refunds — but they are not the Nacha rule, and none of them is a settled federal guarantee yet.
How to Protect Yourself (Because Refunds Aren’t Guaranteed)
- Treat Zelle, Cash App, and Venmo like cash — hard to claw back once sent.
- Never send money to “verify” your account or “reverse” a charge; that’s a classic false-pretenses script.
- If scammed, report it to your bank and the app immediately — same day matters for any recovery attempt.
- Ask specifically whether an imposter/”me-to-me” scam policy applies to your case.
- File complaints with the CFPB and FTC (reportfraud.ftc.gov) to create a paper trail.
Frequently Asked Questions
Does the Nacha false pretenses rule mean my bank must refund a Zelle scam?
No. The rule requires ACH participants to monitor for suspicious payments; Nacha has explicitly said it does not change liability or mandate refunds. Zelle transfers also generally don’t run on ACH, so the rule usually doesn’t apply to them at all.
What’s the difference between Phase 1 and Phase 2?
Phase 1 (March 20, 2026) applies to originating banks and the highest-volume originators (over 6 million entries in 2023). Phase 2 (effective June 22, 2026, since June 19 is a holiday) removes the volume threshold so every non-consumer originator and receiving bank must comply. The duties are the same — the scope just widens.
If I authorized the payment, am I ever protected?
Under federal Regulation E, authorized transfers generally aren’t protected even if you were deceived. Your best paths are your bank’s voluntary policies, Zelle’s imposter-scam reimbursement rules, or evolving state litigation — not the Nacha rule.
Does the rule help businesses at all?
Indirectly, yes. Wider ACH fraud monitoring should catch more business-email-compromise and fake-vendor payments before they settle, improving the chance of recovery. But it’s a detection improvement, not a repayment guarantee.
The Bottom Line
Nacha’s false pretenses rule is a meaningful upgrade to fraud detection across the ACH network — and Phase 2 in June 2026 makes that monitoring universal. But it is not a scam-refund law, and it largely doesn’t reach the Zelle, Cash App, and Venmo transfers people ask about. Your best protection is still prevention plus knowing your app’s specific policies. Watch the Zelle imposter rules and state lawsuits — that’s where consumer refunds are actually being fought over.
WalletWisp is informational and does not provide financial, legal, or tax advice. Verify current rules and dispute options with your bank or provider before acting.
