Is ACH safe?

What protects an ACH payment, and where it stops

How well you are protected depends on the kind of account and on who started the payment.

Personal accounts

Two sets of rules cover a personal account: the ACH rules, written by Nacha, and Regulation E, which is federal law.

• A company needs your permission first. For a recurring payment from a personal account, the permission must be in writing, or the electronic equivalent, and you must get a copy.
• You can stop a recurring payment. Tell your bank at least three business days before the scheduled date.
• You can report a payment you did not authorize. Tell your bank no later than 60 days after it sent the statement that first shows the payment.
• The bank must investigate. It has 10 business days. It can take up to 45 days if it puts the money back in your account while it investigates.
• The bank can send the payment back. Under the ACH rules, your bank can return an unauthorized debit for 60 days after it was taken, once you sign its Written Statement of Unauthorized Debit.

If more than 60 days have passed, tell your bank anyway. You can lose protection for payments taken after the 60 days, but the bank must still apply Regulation E’s liability rules before it makes you bear a loss. See how to dispute an ACH payment.

Regulation E defines an unauthorized transfer as one started by someone else, without authority, from which you get no benefit. A complaint about the goods or the service is not covered.

The steps are in how to stop an unauthorized ACH withdrawal and how to dispute an ACH payment.

Business accounts

A business account has less protection and much less time.

• Regulation E does not apply. It covers accounts set up for personal, family or household use.
• The return window is short. The bank must return an unauthorized debit by the opening of business on the second banking day after it settled. That leaves a business about one banking day to see the debit and tell the bank. Ask your bank for its cut-off time.
• Check the account every business day.
• Ask the bank for an ACH debit block or filter. Chase describes its ACH Debit Block as a service to block all ACH debits or allow some. Wells Fargo’s ACH Fraud Filter can stop all ACH debits except those the business has approved.

More steps are in ACH fraud prevention.

What someone can do with your routing and account numbers

Your routing and account numbers are printed on every check you write. Sharing them to be paid is normal.

With the two numbers, a person or a company can try to send an ACH debit against your account. The numbers alone do not give anyone permission. A debit with no authorization is an unauthorized payment, and for a personal account your bank can send it back if you report it in time.

So the numbers are not a secret, but treat them with care.

• Share them only with people and companies you mean to deal with.
• Prefer a form handed over in person, a secure upload link or a password-protected file to plain email.
• Check your statements. Report a payment you do not know as soon as you see it.

See what an ACH withdrawal is and who took it.

How companies must protect your account number

The ACH rules put duties on the companies that send payments.

• Stored account numbers. Companies that are not banks and send more than 2 million ACH payments a year must make stored account numbers unreadable, for example by encryption, truncation or tokenization.
• Online debits. Since March 19, 2021, a company that takes debits that consumers authorize online must check the account the first time it uses an account number.
• Fraud monitoring. Since 2026, every business that sends ACH payments must have risk-based steps for spotting payments started by fraud, and must review them at least once a year.

These rules lower the risk. They do not remove it.

Payments you send yourself

This is where ACH protection is weakest.

Many scams do not take money from you. They get you to send it. Nacha’s consumer page describes imposter scams, where someone pretends to be a government worker, a police officer or a family member and says you must send money fast.

Regulation E’s rules about unauthorized transfers are written for a transfer started by someone other than you. A payment you start yourself is hard to get back, even if you were tricked.

• Your bank can ask the receiving bank to return the payment. Since October 1, 2024, it may ask for any reason. The receiving bank must reply within ten banking days, but it does not have to return the money.
• A reversal will not help. A reversal is only for the sender’s own mistakes, such as a duplicate or a wrong amount.
• The money may already be gone.

If it happens, call your bank at once, using the number on its website or your card.

How to keep your ACH payments safe

• Confirm before you pay. If someone sends you new bank details, call a number you already have for them. Nacha’s advice is to double-check by calling the person directly using a known number.
• Do not send money to strangers. Nacha’s consumer page says government agencies will not ask for money over the phone. Hang up and call the real agency to check.
• Check the numbers. Test a routing number with the routing number checker and read the account number back.
• Look at your account often. The 60 days run from the statement, not from the day you notice.
• Report at once. Tell your bank the day you see a payment you did not authorize.

ACH and other ways to pay

We do not rank payment methods by safety. The rules differ, and each has limits.

• Debit card. Regulation E lists both ACH payments and debit card payments as electronic fund transfers, so a personal account has error and dispute rights for either one.
• Credit card. See ACH vs credit card and debit card.
• Paper check. See ACH vs check.
• Wire transfer. A domestic wire is not covered by Regulation E. See ACH vs wire transfer.
• Other electronic payments. See ACH vs EFT.

Common mistakes

• Thinking “safe” means “always refunded”. The protection depends on the account, on who started the payment, and on how fast you report.
• Waiting. For a personal account, report within 60 days of the statement. If you are late, report anyway. For a business account you have about one banking day.
• Trusting an email that changes bank details. Call first, on a number you already had.
• Treating a business account like a personal one. Regulation E does not cover it.
• Counting on a reversal. It is a tool for the sender’s own errors, and it is not a way to recover money sent to a scammer.