We recommend that you inform your customer of the situation today. Otherwise, in the event that your bank does not receive the reversal order tomorrow, you would still be placing a hold on the funds, but without your customer’s knowledge.
You do not know any facts other than those asserted verbally by third parties in your phone conversations. If by chance your customer is expecting this deposit, and if your bank does not receive a timely reversal order but continues to place a hold on the funds, you could be subject to claims of liability from your customer for damages caused by the unavailability of the funds. At a minimum, in such case, you could have a serious customer relations problem.
In the more likely event (based on your conversations) that the ACH transaction is fraudulent, you should consider asking your customer to open a new account, in order to prevent future fraudulent activity of a similar nature with the same account number.