ACH, or the Automated Clearing House, is a payment network used for electronic bank transfers in the United States. Businesses rely on it for routine transactions such as payroll, vendor payments, reimbursements, and bill collection. ACH transfers are usually processed in batches rather than as instant card-style payments, which makes them efficient and widely trusted in normal finance workflows.
In cyber security, ACH matters because attackers often target the approval process around it instead of trying to break into banking systems. Business email compromise, executive impersonation, and fake invoice scams aim to trick finance staff into sending fraudulent ACH requests. Once a transfer is approved, the transaction can look legitimate and may be difficult to reverse. Defenses include out-of-band verification, dual approval for payments, vendor-change controls, transaction limits, and monitoring for unusual amounts, destinations, or urgent requests.