We offer ACH origination to our business customers via internet banking. Files must be created by one user, then approved by another and are further verified by the bank by call back. In the case of some of our sole proprietor businesses, however, there are not two business employees to fulfill the requirement of one user creating the file and another approving it. We have looked into the use of tokens, but they are very expensive and our IB vendor requires a minimum order of tokens that far exceeds anything we would need.

We are interested in knowing how other banks verify ACH files originated via IB for sole proprietor businesses. We do perform call back verification to the sole proprietor, but in the event of a man in the middle attack in which the details of a legitimate file are altered, a call back would not help us as we do not verify the detail of each entry within the file.

Thank you!

Typically what you would see would be some sort of a token system- It really is the best system that you could have in terms of limiting your risk ( and the customers). However, I think the best answer to your situation would be to verify at minimum the file amount when you do your call back to the customer. Also- you should be familiar with what the customer is sending, if it is unusual or not.

There comes a point in time that when you can't afford to offer a product due to the economies of scale, you just say we don't offer that product. In this case, to sole proprietors that do not have an additional authorized user.