Funding Source Signals

What it measures

The funding decision is the first point on the money path where a platform takes on loss exposure: once you make funds available (instant buying power, instant deposit, cashback advance, P2P balance), any later reversal is your loss. Funding source signals describe the source along four axes:

Behavioral features add to these: time from bank link to first funding; funding amount relative to account history; number of funding sources added; prior returns (ACH return codes, returned deposited items, card disputes) on this source anywhere on your platform.

Why it matters

ACH and check funding fraud monetize the float between "funds available" and "funds final", so the funding source is the place to intervene. Nacha's WEB debit rule requires originators to include account validation in a commercially reasonable fraud detection system before the first use of an account number and when a customer changes to a new account number; at a minimum, confirming the account is open and can accept ACH entries. Ownership verification is not part of the minimum. Unauthorized-debit losses concentrate in that gap, where the account is real and open but belongs to someone other than the customer.

Card funding is changing too. Visa and Mastercard now require funding of accounts for future use (wallets, brokerage, crypto, money transfer) to be processed as Account Funding Transactions (AFTs) for in-scope merchants, on dates running from January 2025 (Visa, US) through 2027, with Visa's securities MCC 6211 global deadline on October 18, 2026. AFTs carry a transaction-type classifier and, for Mastercard, the recipient's name. Issuers get a clearer view of funding events, and merchants get better data for their own funding risk.

The exposure differs by industry. In Brokerage and Investing it's instant buying power on unsettled ACH deposits; in Neobanks and Consumer Fintech, instant availability of mobile check deposits; in Payments and P2P, card-funded P2P sends. In Cashback, Coupons and Rewards, funding is less central, but linked bank accounts used for payout double as identity linkage.

How to collect it

• Account validation and ownership: open-banking credential-based linking, bank-data networks and account-status databases, micro-entries, prenotes. Database and credential methods are instant but vary in coverage; micro-entries are slower but universal. Most programs waterfall methods (see Bank Account Ownership Verification).
• Return and dispute history: your own ACH return codes (unauthorized vs. NSF vs. account closed), returned deposit items and card chargebacks, keyed to the funding source as well as the customer account.
• Consortium data on account-level fraud and returns (Consortium and Data Sharing, Credit Bureau and Consortium Signals).
• Card data: BIN attributes, AFT response codes, 3DS results (Payment Instrument Signals).

How to use it

• Size availability to verification depth: ownership-verified + tenured + clean history → more instant availability; validated-only → smaller limits; unverified → hold until settlement (Funds Availability Holds, Velocity and Exposure Limits).
• Combine with destination: funding from source A followed quickly by withdrawal to destination B is the core fast-in, fast-out pattern; A ≠ B is the high-risk version.
• Combine with linkage: one bank account funding many customer accounts suggests Multi-Accounting or Money Mules; many customers funded from accounts at the same small set of institutions on the same day can indicate a coordinated wave.
• Return-code learning: unauthorized returns (e.g., R10, R11 and related codes) are fraud labels that arrive late. Feed them back into source and identity risk quickly (see Fraud Labeling and Feedback Loops).

Strengths and limitations

Strengths: acts before exposure; strong ownership signals sharply cut unauthorized-debit losses; return history is a high-quality label.

Limitations: ownership data coverage is uneven across institutions; credential-based linking proves access, not ownership, so a fraudster with stolen bank credentials passes it; mule-owned accounts legitimately belong to the person linking them; first-party fraud uses the customer's own real account. Validation outcomes can be degraded by determined attackers, so never treat a single "verified" flag as final. Pair it with holds sized to the remaining reversal window.

False positives and fairness

• Legitimate name mismatches from joint accounts, spouses funding each other and parents funding young adults' accounts.
• Customers at credit unions and small banks with weaker data coverage fail instant ownership checks more often.
• Small business owners funding personal brokerage or savings from business accounts.
• Name variations, transliterations, hyphenated and married names.

Offer a fallback path (micro-entries, statement upload) rather than outright denial, and monitor pass rates by institution size.

Privacy and compliance considerations

Bank data obtained via open-banking aggregators is subject to consent terms and to evolving data-access rules; use it for the disclosed purpose. Hold policies must comply with Reg CC (for deposit accounts) and be disclosed. ACH return-rate thresholds and the 2026 Nacha fraud monitoring rules make funding risk a compliance matter as well as a loss matter (see Nacha Rules and ACH Risk).

Mechanisms it helps detect

ACH Funding Fraud · Instant Funding Abuse (Kiting) · Check and Mobile Deposit Fraud · Card-Not-Present Fraud (card-funded accounts) · Sign-Up Bonus Abuse (bonus-qualifying deposits from shared sources) · Money Mules · Account Takeover (ATO) (new funding source added after takeover)

Related signals and controls

Payment Instrument Signals · Fast In Fast Out Patterns · Customer Tenure and History · Bank Account Ownership Verification · Funds Availability Holds · Playbook - ACH Funding Fraud Members · Playbook - Instant Funding Abuse Members · Playbook - Mobile Deposit Fraud Members

Sources and further reading

• Nacha: Supplementing Fraud Detection Standards for WEB Debits: account validation at first use and on account-number change; ownership not the minimum.
• Fiserv: Understanding Nacha's WEB debit account validation rule: overview of validation methods and waterfall approach.
• Checkout.com: AFT compliance dates: Visa and Mastercard AFT mandates and dates by MCC and region.
• NMI: Account Funding Transactions: AFT use cases and recipient-data requirements.
• 12 CFR 229.13 (Regulation CC exceptions): exception holds for new accounts and large deposits.