An ACH debit is an electronic transaction in which a company or other entity pulls money directly from your bank account after you’ve given it permission to do so. Utility bills, insurance premiums, gym memberships, and mortgage payments typically move this way. The ACH Network processed over 35 billion payments worth $93 trillion in 2025, which makes ACH debits the backbone of routine electronic payments in the United States. What follows is how the pull reaches your account, what your authorization covers, how to stop one, and the protections you have if a debit was never authorized in the first place.
How the Money Actually Leaves Your Account
Five parties are involved in every ACH debit. The Originator is the company you authorized. It sends the transaction request to its own bank, the Originating Depository Financial Institution (ODFI), which batches these requests and forwards them to an ACH Operator. Two operators handle routing: the Federal Reserve and the Electronic Payments Network.1Federal Reserve Board. Automated Clearinghouse Services The Operator delivers the transaction to the Receiving Depository Financial Institution (RDFI), which is your bank. Your bank verifies the account details, posts the withdrawal, and settles with the ODFI through the Operator.2Nacha. How ACH Works
ACH debits are not instant. Standard entries settle at 8:30 a.m. ET on the next business day after processing.3Federal Reserve Financial Services. FedACH Processing Schedule A debit submitted on a Monday afternoon typically clears Tuesday morning, with weekends and federal holidays pushing the timeline forward. Same-Day ACH is available at an added cost to the Originator, moves up to $1 million per payment, and clears within hours through one of three processing windows during the business day.4Federal Reserve Financial Services. Same Day ACH Resource Center Whether you see the debit posted the same day or the next depends on the service level the Originator chose and how quickly your bank posts the entry.
One consequence of that delay matters for your balance: money can leave a day or two after you agreed to the charge, not the moment you clicked or signed. Timing a bill against a paycheck means watching for the posted date, not the authorization date.
What You Had to Authorize
No company can pull money from your account without your explicit permission. The Nacha Operating Rules, which govern the ACH Network, require every debit authorization to identify the Originator, say whether the payment is one-time or recurring, state the amount or how the amount will be determined, and explain how you can revoke your consent. For debits authorized online, the Originator must retain a copy of the authorization or provide you with a confirmation you can keep.
To set up the debit, the Originator collects your legal name as it appears on the account, your bank’s name, the account type (checking or savings), your bank’s nine-digit routing number, and your account number. If you authorized the debit through a website or app, the Electronic Signatures in Global and National Commerce Act gives that digital consent the same legal weight as a paper signature, provided you received a clear disclosure about your right to paper records and instructions for withdrawing consent to electronic communications.5FDIC. X-3 The Electronic Signatures in Global and National Commerce Act (E-Sign Act)
How to Stop an ACH Debit You No Longer Want
You have two separate tools, and using both is the safest approach.
Revoke Authorization With the Company
You can cancel your authorization with the Originator at any time. The notice period varies because each authorization agreement sets its own lead time. Some companies want a few days, others a few weeks. Check your original agreement, put the revocation in writing, and keep a copy even if the company also accepts cancellations by phone.
Place a Stop-Payment Order With Your Bank
Federal law gives you the right to stop any preauthorized electronic fund transfer by notifying your bank at least three business days before the scheduled payment date. You can give this order in person, by phone, or in writing.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers If you give the order by phone, your bank can require written confirmation within 14 days; without it, the oral order may expire.7Consumer Financial Protection Bureau. You Have Protections When It Comes to Automatic Debit Payments From Your Account
Revoking with the company tells the Originator to stop initiating debits. The stop-payment order tells your bank to reject any that slip through anyway.
If the Debit Was Never Authorized
Unlike a wire transfer, which is generally final once it clears, an ACH debit can be disputed and reversed. The Electronic Fund Transfer Act and Regulation E set the rules. Your liability depends on how fast you report the problem and whether a lost or stolen access device was involved.
No Lost or Stolen Card or Code
Most unauthorized ACH debits fit here: someone obtained your account and routing numbers and pulled money without your permission. Notify your bank within 60 days of the statement showing the unauthorized transaction and your liability is zero.8Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers Miss the 60-day window and you can be held responsible for additional unauthorized debits that occur after the deadline and before you notify the bank.
Lost or Stolen Debit Card or Access Code
When a card or access code was lost or stolen, tiered limits apply under the Electronic Fund Transfer Act:9Office of the Law Revision Counsel. 15 USC Chapter 41, Subchapter VI – Electronic Fund Transfers
- Reported within two business days: maximum liability is $50.
- Reported after two business days but within 60 days of the statement: maximum liability rises to $500.
- Reported after 60 days: you can be liable for the full amount of unauthorized transfers that occur after the 60-day window.
Extenuating circumstances such as hospitalization or extended travel require the bank to extend these deadlines to a reasonable period.
How the Investigation Works
After you report an error or unauthorized debit, your bank has 10 business days to investigate and resolve it. The bank can extend the investigation to 45 days, but only if it provisionally credits your account within those first 10 business days so you have access to the disputed funds while the review continues.10eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) The bank must notify you within two business days after issuing the provisional credit.
When an ACH Debit Bounces Back
If a debit can’t be completed, your bank sends it back with a return code. A few show up often enough to recognize:
- R01, Insufficient Funds. The account didn’t have enough money. The Originator may try again, and your bank may charge a nonsufficient-funds fee.
- R02, Account Closed. The account the Originator tried to debit has been closed.
- R03, No Account or Unable to Locate. The account number doesn’t match any open account at your bank.
- R10, Customer Advises Unauthorized. You told your bank the debit wasn’t authorized, which returns it to the Originator.
- R29, Corporate Customer Advises Not Authorized. The business-account version of R10.
If a debit came back because of incorrect information, contact the Originator to update your details. If it was returned as unauthorized, your bank will typically start the Regulation E dispute process. Repeated returns for insufficient funds can rack up bank fees, so checking your balance before scheduled ACH debits post is worth the minute it takes.