What's the Dilly-o with fraud detection: a buyer's guide for credit unions

The Dilly-o

Nacha says its rules are neutral on the methods or technologies used to spot fraudulent credits.⁴ So we'd start with what your digital banking platform and core already include, write down how you use it, and buy a specialist tool only for the gap your own loss data shows. Think of it as a moat with several rings: one tool rarely covers logins, checks, ACH and scams at once.

How we'd size up a vendor

1. Coverage - which channels does the tool watch: logins, ACH credits, checks, card or calls?
2. Fit - is it already connected to your digital banking platform and your core, or does it need a custom build? Ask the vendor to show you how it connects to your core today.
3. Evidence - does it keep an audit trail of each alert and the action taken on it? Ask to see a sample record before you sign.
4. Pricing model - do you pay per event, per alert, per seat or a flat fee? Ask the vendor to price your real login and transaction volume before you sign.

What changed this year

On October 1, 2024, Nacha defined "false pretenses," codified return code R17 for suspected fraud and allowed R06 for any reason.⁵ From April 1, 2025, an RDFI had to answer a sending institution's R06 request within ten banking days.⁶ From March 20, 2026, originators must label wage credits "PAYROLL" and e-commerce debits "PURCHASE".⁷⁸ You must also review and update your monitoring procedures at least once a year.⁹

Will it work with your systems?

Your digital banking platform may already carry fraud tools. On November 4, 2026, TEN Credit Union was reported to have picked Bankjoy, whose platform includes its FraudSense real-time fraud system.¹⁰ Lumin Digital announced an identity security partnership with ID Dataweb on October 15, 2024.¹¹ Mitek is listed as an Alkami partner integration for check fraud detection.^C On the core side, Alogent is a Corelation Keystone preferred partner and is listed in Jack Henry's network for Symitar credit unions.^C Narmi is KeyBridge certified for Keystone and listed for Symitar, and Unit21 is a Keystone preferred partner for collections and risk.^C Ask your provider which fraud partners are live today, what data they receive, and who owns the alert when one fires.

What other credit unions did

Suncoast Credit Union, with $20.7 billion in assets, moved onto Alloy for identity and fraud decisions.¹² Raiz Federal Credit Union reported stopping more than $286,000 in fraud in its first year with BioCatch and other measures.¹³ MSUFCU, a Michigan credit union, launched Pindrop's Passport and Protect products in its call center in August 2024.¹⁴

What your examiner will ask

NCUA's 2026 priorities look for strong monitoring and alerts on unusual activity, plus periodic updates and testing of fraud safeguards.¹⁵¹⁶ The FFIEC authentication guidance, which counts credit union members as customers, calls for layered security.¹⁷¹⁸ It also calls for monitoring, logging and reporting of activity to identify and track unauthorized access.¹⁹ For the vendor, NCUA says third-party contracts should address service level agreements, performance reports and penalties for poor performance.²⁰ Have ready your fraud risk assessment, your written monitoring procedures with their last annual review, test results, and the signed vendor contract.

What it costs

Most vendors in this category do not publish prices, so expect a quote. NCUA warns that some credit unions signed steep termination penalties believing them fixed, when such terms are often negotiable.²¹ Have outside counsel read the exit terms before you sign.

Food for thought

The plaintiffs in Chen v. Bank of America had lost about $106,000 through remote access to an iPhone.²²