Two sets of rules sit behind every ACH dispute
- Regulation E is federal law. It protects consumers and tells the bank what it must do when a customer reports an error.
- The Nacha rules are the banks’ own rulebook. They let the customer’s bank send a payment back to the business’s bank, called a return.
You deal with your bank. Your bank deals with the other bank.
What you can dispute
Regulation E treats these as errors on a personal account:
- an unauthorized electronic transfer: one started by someone else, without your permission, from which you got no benefit;
- an incorrect transfer, such as the wrong amount.
A dispute about the goods or services you received is not an error under these rules. Nacha’s definitions say the same: its unauthorized return codes do not cover disputes about goods and services.
How to dispute an ACH payment
- Tell your bank as soon as you see the problem. You can call or write. Say which payment, how much, and why it is wrong.
- Confirm in writing if asked. The bank may require written confirmation within 10 business days of a phone call.
- Sign the bank’s form. For an unauthorized debit, the bank asks you to sign a Written Statement of Unauthorized Debit. Nacha rules let the bank take it electronically or by phone.
- Wait for the result. The timings are in the table below.
- Stop future payments from the same company by revoking your authorization. See how to stop an unauthorized ACH withdrawal.
The time limits
| Step | Time limit |
|---|---|
| You report the error | Within 60 days of the statement that first shows it |
| Bank investigates | 10 business days |
| Bank investigates, with temporary credit | Up to 45 days |
| Bank tells you the result | Within 3 business days of finishing |
| Bank corrects an error | Within 1 business day of finding it |
| New accounts | 20 business days in place of 10, and 90 days in place of 45 |
How much can you lose?
Report quickly. Regulation E says you must report an unauthorized transfer that appears on a statement within 60 days of the bank sending that statement, to avoid being liable for transfers that happen after those 60 days. The well-known $50 and $500 limits in the regulation are written around a lost or stolen card or code. For a debit made with only your account number, the 60-day statement rule is the one that matters.
If your bank says no, or charged you fees
These rules are for personal accounts. They say what the bank must do. They do not promise any result.
- If the bank finds no error, it must explain its findings in writing. You can ask for copies of the documents it relied on, and it must send them promptly.
- If it takes back a temporary credit, it must tell you the date and the amount. For five business days after it tells you, it must still pay your checks and automatic payments to others that it would have paid if the credit were still in your account. It may not charge an overdraft fee for them.
- If the bank finds an error, it must correct it. Where they apply, that includes refunding fees the bank itself charged because of the error. This rule does not cover fees charged by other companies.
- If you think the bank got it wrong, you can submit a complaint about your bank to the CFPB, the Consumer Financial Protection Bureau. The CFPB sends your complaint to the bank so the bank can review it. A complaint is not a promise that the decision will change.
What happens between the banks
When your bank accepts your dispute, it returns the payment through the ACH network.
| Your situation | Return code | Window for the bank |
|---|---|---|
| You never authorized this company | R10 | 60 calendar days from the payment |
| You authorized it, but the amount or date was wrong | R11 | 60 calendar days |
| You had cancelled your authorization | R07 | 60 calendar days |
| A business account says it did not authorize the debit | R29 | 2 banking days |
Once your bank has finished reviewing your signed statement, it must send the return within six banking days.
For businesses: when a customer disputes your debit
The return arrives with one of the codes above, and the money is taken back from your account.
- You cannot contest it in the ACH network. There is no appeal step as there is with card chargebacks. Your bank can refuse a return only on narrow grounds, such as one sent too late.
- You can ask for the customer’s statement. Your bank can request a copy of the Written Statement of Unauthorized Debit from the customer’s bank.
- You may not simply debit again. After R10 or R07 you need a new authorization. After R11 you may correct the error and send a new payment within 60 days.
- The debt may still be owed. A return does not settle whether the customer owes you money. Collect it another way, or through the courts.
- Keep unauthorized returns under 0.5%. Above that level, your bank has to act.
The best defense is paperwork: a clear, signed ACH authorization form, kept for two years after it ends, and a company name on the customer’s statement that they will recognize.
Later claims between banks
Banks also have a deadline for claims against each other over unauthorized payments. Since June 30, 2021, a claim on a business account must be made within one year of settlement. For a consumer account, the first 95 days from the first unauthorized payment are always covered, and otherwise the limit is two years.
Common mistakes
- Waiting to see if it sorts itself out. The 60 days run from the statement, not from when you noticed.
- Disputing a payment you did authorize. These rules do not cover a complaint about goods or services. If the problem is the product, deal with the seller.
- Treating a business account like a personal one. For a business account, the bank must return an unauthorized debit by the opening of business on the second banking day after settlement. Report it the day you see it.