Most likely, the originating bank will release the money to the account that requested it a day or two later. 3 business days is pretty typical. More if they're high risk.
You complain, make a statement under penalty of perjury that it's Unauthorized. Your bank sends a return (R10 or one of the other shades) to the Fed. The fed debits the originating bank, and sends them the return message. You've got your money back, and it's the originating bank's problem.
The originating bank then has a potential problem. They go after the company that initiated the debit. Depending on things, that might be a company or a 3rd party payment processor. If it's a 3pp, then they probably still have money from that originator or another, and now it's their problem. They may have a reserve or rolling settlement against such things.
But generally, it's the fact that there's a trusted third party (The Fed) that makes sure that banks pay up on returns that makes it not your problem.
A push puts the financial responsibility for fraud on the originating bank. Imagine account X pushes to account Y, and then account owner Y walks into the bank looking to withdraw cash. From Bank Y's perspective, everything looks fine. Later on, bank X finds out the push was fraudulent, but bank Y has relied on the transaction to dispense actual cash. Bank Y may help investigate, but they surely aren't going to be out the cash due to relying on X's false transaction.
Whereas the pull transaction (with Y as the originator), bank Y will put a withdrawal hold, scrutinize the cash withdrawal and ask if this is really their customer, etc, since there is no other party they can blame.
I also personally tend towards using pulls because that's the way the system expects to work since it grew out of checks. If one pushes money and it never shows up, then the blame is ambiguous. From the originator's perspective they've completed what you've asked them to do, and from the receiver's perspective they know nothing. Whereas with a pull, the main thing you're doing is asking the originator to credit your account. If the transaction gets lost without your other account getting debited, then the discrepancy doesn't really affect you.
I have a weird, occasional fear that some of the companies I do business with might eventually enter a Chapter 7/11 bankruptcy of some sort, and that my ACH push payment could be clawed back.
- Their account will be negative - Bank wouldn't allow them to withdraw 10k due to a hold - Bank wouldn't allow them to spend money due to a hold
Anyway, in the end, victim's bank will get money back. A lot depends on the relationship of the scammer with their bank:
- On my fresh account, I once did an ACH transfer around 15k, the bank placed a 60-day hold on those funds, it was a saving account, so I literally couldn't do anything with it for 60 days.
- Some time later, the same bank got a 500k ACH transfer, bank placed a hold on half of it, but allowed me to withdraw the rest.
- Another time I had 15k ACH transfer on "well established" checking account, bank still placed a hold on 10k.
If it's a "fresh" bank account - you're not getting money out, specially if it's a transfer between two random consumer accounts until bank feels safe.
Banks and payment service providers generally mitigate this risk by e.g. demanding a security deposit and/or delaying funds availability for new customers.
What if, in this order:
1. they take $10k from my account to their account
2. they take the $10k out of their account immediately
3. I call my bank and ask them to reverse the transaction (aka the funds are no longer there to yank back)