1. © 2009 National Automated Clearing House Association. All rights reserved. Industry Perspectives on Emerging Risks and Public/Private Engagement: Network Industry Perspectives on Emerging Risks and Public/Private Engagement: NACHA and the ACH Network Retail Payments Risk Forum November 5, 2009 Jane Larimer EVP ACH Network Services General Counsel NACHA -The Electronic Payments Association

2. © 2009 National Automated Clearing House Association. All rights reserved. 2 NACHA and The ACH Network As administrator of the ACH Network, NACHA creates and maintains the NACHA Operating Rules, enforces the Rules, proactively develops Network risk policy, and responds to Network risk events Risk events are managed to minimize the long-term effect on consumers and financial institutions NACHA’s risk strategy includes making changes to the NACHA Operating Rules, disseminating best practices and developing tools to manage the risk profile of the Network on an ongoing basis As ACH Network volume has grown and usage has expanded, there has been great attention to risk and fraud mitigation. The ACH Network has experienced lower rates of return for unauthorized entries and other returns indicative of fraud –Since 2001, debit unauthorized return rates reduced from.09% to.04%.

3. © 2009 National Automated Clearing House Association. All rights reserved. 3 Unauthorized Debit Rate One measurement of risk in the ACH Network continues to trend down: Where is the path of least resistance? –Risk across payment channels – the “keys” to the house –Risk management tools

4. © 2009 National Automated Clearing House Association. All rights reserved. 4 Perspective on Risk and Losses * 71% of organizations: attempted or actual payments fraud (consistent with past years) 55% report same incidence of attempted or actual fraud – check fraud increasing faster –30% - increased incidents, while 15% decreased incidents Only 17% of organizations that experienced ACH-related fraud attempts incurred losses –Didn’t follow best practices: no debit block / no ACH positive pay / not timely return Payment Method% subject to actual or attempted fraud % with increased incidents Payment method most responsible for losses Checks91%82%60% ACH Debits28%14%5% Consumer Cards18% 20% Corporate Cards14%11%10% ACH Credits7%3% Wire Transfers6%4%1% * Source: AFP 2009 Fraud Study

5. © 2009 National Automated Clearing House Association. All rights reserved. 5 Emerging Risks and Public/Private Engagement: Corporate Account Takeover In 2007 and again in 2009, NACHA issued risk alerts about keylogging and “Corporate Account Takeover” – a compromise of businesses’ online banking credentials –Referenced 2005 FFIEC Guidance – Authentication in an Internet Banking Environment –Best practices Once the fraudster has access to the account, can do anything the legitimate account holder can do – often including assuming administrative rights –Add accomplices to payroll – “money mules” –Send funds transfers ACH credits and debits Wire transfers Collaboration with FS-ISAC and FBI on FI Alert –Communicated issues and best practices to financial Institutions and industry Drafted new section for Better Business Bureau Data Security publication for small businesses Held Keylogging Teleseminar on issues to educate FIs and Network participants –Speakers from: Justice Department, Federal Reserve, a large FI Risk Management Vendor Showcase –FFIEC Regulatory Panel Direct Member Summit Session with FBI and FS-ISAC

6. © 2009 National Automated Clearing House Association. All rights reserved. 6 Paradigm Shift? When using the ACH Network to process payments “traditional” frauds including telemarketing fraud, credit repair, and membership clubs have used ACH debit applications So, traditionally we have looked to unauthorized debit rates as the key indicator of fraud because unauthorized debits are coded and returned But there has been more activity lately regarding unauthorized funds transfers from DDAs – mainly credit payments –Corporate account takeover Credit transactions that the Originator claims are unauthorized cannot be monitored through the Network (as of now) Need Network-wide data to assess extent of problem –benchmarking