How to Find Out Where an ACH Payment Came From: Trace and Deadlines

To find out where an ACH payment came from, start with the identifiers already sitting in your account: the company descriptor on your statement, and the Company ID and three-letter SEC code visible when you open the transaction in online banking. If those don’t tell you enough, your bank can run a formal trace using the 15-digit ACH trace number tied to the transfer. One deadline to keep in mind while you work: federal law gives you 60 days from the statement date to report an unauthorized ACH debit before your liability protections fall away.

Start With the Descriptor on Your Statement

The short label next to the dollar amount is the Company Name field from the ACH record, and NACHA’s file format caps it at 16 characters.¹ That limit forces heavy abbreviation. “AMZN MKTPLC” is Amazon Marketplace. “MSFT RES” is Microsoft Rewards.

If the descriptor looks unfamiliar, copy the exact text into a search engine with quotation marks around it. Abbreviated ACH descriptors show up frequently in consumer forums and lookup databases. Watch the opening characters too, because they sometimes reference a parent company rather than the brand you recognize. A descriptor beginning with “GPC” can trace to Genuine Parts Company even when your relationship is with NAPA Auto Parts.

Open the Transaction in Online Banking

A printed statement hides fields that your bank’s website or app will show once you click into an individual transaction. Two of them do most of the identification work: the Company ID and the Standard Entry Class code.

The Company ID is a 10-digit alphanumeric identifier assigned to the originator by its bank.² Dropping that number into a search engine can surface the originator’s legal name or business filings. Some banks run free lookup tools that return the originator’s name and phone number when you enter the ID. If nothing turns up online, your bank’s customer service team can look up the originator directly from the ID.

The SEC code is a three-letter tag that describes how the payment was initiated.² Knowing the code often jogs your memory about a forgotten authorization. The common ones:

PPD (Prearranged Payment and Deposit): a recurring or one-time consumer payment authorized in writing, common for payroll direct deposit and utility autopay.
WEB: a payment you authorized through a website or mobile app.
CCD (Cash Concentration or Disbursement): a business-to-business transfer.
ARC (Accounts Receivable Entry): a paper check you mailed that was converted to an electronic debit.
POP (Point of Purchase): a check you handed over in person, converted to an electronic debit at the register.
RCK (Re-presented Check Entry): a check that bounced for insufficient funds and is being re-presented electronically.
IAT (International ACH Transaction): a transfer entering or leaving the United States, carrying extra data including the originator’s name, address, and country code.

ARC, POP, and RCK all involve a paper check converted to electronic form, so the debit can look unfamiliar even though you wrote the check yourself.² For an IAT, the transaction addenda must carry the originator’s name and address plus their bank’s name and country, and your bank can pull those details for you.³

Ask Your Bank to Trace It

When the descriptor and online details still don’t identify the sender, the next step is a formal trace through the ACH clearing network. Gather three pieces of information before you contact the bank:

ACH trace number: a 15-digit identifier unique to the transfer. The first eight digits are the originating bank’s routing number, and the last seven identify the specific transaction. It usually sits under “extended details” or “additional info” in the online banking transaction view.⁴
Exact dollar amount, including cents. A one-cent discrepancy can prevent a match.
Settlement date: the official ACH processing date when funds moved between banks. It can differ from the date the transaction posted to your account, because banks post on their own schedules.⁵

You can submit the request through your bank’s secure message portal, at a branch, or by calling the ACH or fraud department. Phone is usually fastest, because the representative can pull the trace data and open the investigation on the call. Once the trace surfaces the originating bank, you can contact that institution directly to resolve a billing dispute or report fraud.

If you believe the debit was unauthorized, the bank will also ask you to sign a Written Statement of Unauthorized Debit that includes the trace details and your declaration that you did not authorize the transfer.⁶ You can sign and date it as soon as the transaction appears in your account, even before it fully settles.⁷

Reporting Deadlines if You Don’t Recognize the Charge

How fast you report an unauthorized ACH debit determines how much of the loss you have to eat. Regulation E sets a tiered liability structure for consumer accounts:⁸

Within 2 business days of learning about the unauthorized transfer: your maximum liability is $50, or the amount transferred before you notified the bank, whichever is less.
After 2 business days but within 60 days of your statement: your maximum liability rises to $500.
More than 60 days after your statement: no cap on further unauthorized transfers that occur after the 60-day window closes.

The 60-day clock starts when the bank sends the periodic statement showing the unauthorized transfer, not when you open it or notice the charge.⁸ Extenuating circumstances such as a hospital stay require the bank to extend the deadlines to a reasonable period, but the safer habit is to check every statement when it arrives and flag anything unfamiliar right away.

After you file the notice, Regulation E requires the bank to investigate within 10 business days for most consumer accounts, with a possible extension to 45 calendar days if it issues provisional credit to your account in the meantime.⁹

These consumer protections apply only to accounts established primarily for personal, family, or household purposes.¹⁰ Business and commercial checking accounts are not covered by Regulation E, and the return window for an unauthorized business ACH debit is typically the next banking day after the entry posts. If the account you’re tracing is a business account, your protections come from NACHA’s operating rules and your account agreement, so check both.

If the Payment Was an Unexpected Deposit

Sometimes the ACH entry you’re trying to identify is money arriving, not leaving. Handle it carefully. A common scheme runs like this: a scammer sends money to your account using stolen bank credentials, then contacts you, often by payment app or email, claiming the deposit was a mistake and asking you to send it back.

Sending the money back does not reverse the original transaction. It moves your own funds to the scammer. When the bank later identifies the initial deposit as fraudulent, it reverses that deposit as well, and you lose the amount you sent.

Do not send funds to anyone contacting you about an unexpected deposit. Call your bank directly, explain what happened, and let the bank handle the reversal through the normal ACH return process. Keeping the money is not an option either, because the fraudulent deposit will be reversed automatically once the originating bank identifies the unauthorized transfer.

1
NACHA. NACHA ISO 20022 Credit Transaction Guide
2
ACH Guide for Developers. ACH File Details
3
Federal Reserve Financial Services. International ACH Transaction (IAT) Frequently Asked Questions
4
U.S. Department of the Treasury Bureau of the Fiscal Service. Trace Number
5
U.S. Department of the Treasury Bureau of the Fiscal Service. A Guide to Federal Government ACH Payments (Green Book)
6
Federal Reserve Financial Services. Written Statement of Unauthorized Debit Copy (WSUD)
7
Nacha. Risk Management Topics – October 1, 2024
8
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
9
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
10
Consumer Financial Protection Bureau. 1005.2 Definitions