How to Dispute an ACH Debit: Step-by-Step Guide

You open your checking account on a Tuesday morning and see a debit you do not recognize. Maybe it is a gym you canceled months ago. Maybe the company name is a string of letters you have never heard. Maybe the amount is wrong, or the date is wrong, or you never signed up for anything at all. Your stomach drops, and the first question is simple: how do you get the money back?

ACH debits are one of the most common ways money leaves a U.S. consumer bank account. Payroll credits, rent, insurance, streaming bills, loan payments, and gym memberships all ride the same rails. Most of those pulls are ones you meant to authorize. The rest are the ones this guide is for.

This is a practical, education-only walkthrough for U.S. consumers in 2026. You will see how ACH debits actually work, how unauthorized claims differ from authorized-but-wrong claims, what Regulation E and Nacha rules mean for your timelines, how to dispute with your bank, when a stop payment is the right tool versus a full revocation of authorization, what paperwork to keep, what happens after you file, and how to reduce the chance of a repeat. None of this is legal advice for your specific facts. It is the map most people wish they had before they spent an afternoon on hold.

How ACH Debits Actually Move Money

ACH stands for Automated Clearing House. It is a batch electronic network that moves money between U.S. bank accounts. When a company pulls money from your checking account, it is usually originating an ACH debit. Your bank receives that debit as the receiving institution, and the funds leave your available balance according to the settlement schedule for that entry.

Two ideas matter immediately. First, ACH is not the same as a wire, and it is not the same as an instant payment rail like FedNow or RTP. Standard ACH often settles next business day or later. Same Day ACH can settle the same business day when the originator hits a window, but it is still ACH, not instant 24/7 settlement. Second, consumer ACH debits are generally covered by the Electronic Fund Transfer Act and Regulation E, which is why error-resolution rights exist for many consumer electronic transfers.

A company that wants to debit you needs authorization. That can be written, electronic, or in some cases telephone-based under Nacha rules for consumer entries. The authorization is supposed to spell out the amount or how the amount is determined, the timing, and how you can stop future pulls. When that authorization is missing, forged, revoked, or not followed, the dispute tools below become relevant.

On your statement the company name may not match the brand you know. Processors, doing-business-as names, and truncated descriptors all show up. That is why a calm review of every recurring pull, not just the familiar logos, is part of basic account hygiene. If you keep most of your cash cushion in a high-yield savings account and only enough in checking for near-term bills, a surprise debit hurts less while you sort it out.

Unauthorized vs Authorized-But-Wrong: Name the Problem First

Banks and ACH operators sort consumer disputes into different buckets. If you use the wrong bucket, you can waste days and still get the wrong return code. Start by naming what happened in plain English.

Truly unauthorized

You never authorized this company to debit this account, or the "authorization" is not yours. Common examples include a stranger who obtained your routing and account numbers, a canceled relationship that somehow never stopped, or a merchant name you do not recognize at all. In Nacha terms, consumer claims in this neighborhood often land under return reason codes such as R10 (originator not known or not authorized) or related unauthorized codes, after your bank collects a Written Statement of Unauthorized Debit.

Authorized, but not according to the terms

You did authorize the company, yet this specific debit does not match what you agreed to. Wrong amount. Debited earlier than allowed. Improperly reinitiated after a return. Incomplete transaction. Nacha carved these situations into return reason code R11 so banks and originators can tell "no relationship" claims apart from "relationship exists, but this entry is defective." That distinction matters because an R11 return can sometimes be corrected and resubmitted within rules, while a true unauthorized return generally requires a fresh authorization before another debit.

You authorized it, then changed your mind

If you once said yes and later want the pulls to stop, you are usually in revocation territory, not "I never authorized this." You revoke with the company the way the agreement says, then you may also place protections at the bank. Mixing these up is how people get stuck arguing about a debit that was still authorized under the old terms.

One more line people blur: a payment you yourself sent because a scammer pressured you is often treated as authorized from the bank's point of view, even though you feel robbed. That scenario is closer to a scam-loss problem than a classic unauthorized ACH return. ACH dispute tools still matter when a third party pulls without permission. They are a weaker fit when you pushed the money yourself.

The Clocks That Matter: Regulation E and Nacha

Two overlapping clocks run on consumer ACH problems. Understanding both keeps you from missing a window.

Regulation E error resolution

Regulation E is the federal consumer rule for many electronic fund transfers from consumer accounts. When you give your bank a proper notice of error, including an unauthorized electronic fund transfer or an incorrect transfer, the bank generally must investigate on a set timetable.

• You generally need to notify the bank no later than 60 days after it sends the periodic statement that first shows the problem.
• The bank generally has 10 business days to investigate, or it may take up to 45 days if it provisionally credits your account within the shorter window (with limited exceptions, including a possible $50 holdback in some unauthorized cases, and longer clocks for newer accounts or certain point-of-sale and foreign situations).
• After it finishes, it must report results and correct an error it finds on the timelines in the rule.

Missing the 60-day notice window for error-resolution procedures can cost you provisional credit rights and the tight investigation calendar, even if other remedies remain in play. Report as soon as you see the debit. Do not wait for the next statement cycle to "see if it happens again."

Nacha return windows for consumer unauthorized claims

Separately, Nacha Operating Rules give receiving banks return reason codes and timeframes for sending an entry back through the network. For several consumer unauthorized and authorization-related returns (including codes in the R05, R07, R10, and R11 family), the return window is commonly measured as availability to the originating bank by the opening of business on the banking day following the 60th calendar day after the settlement date. Your bank will usually ask you to sign a Written Statement of Unauthorized Debit before it uses those codes.

Stop-payment returns (often R08) live on a different, much shorter operational clock for the return itself, which is why placing a stop before the debit posts is so much cleaner than scrambling after settlement.

Practical takeaway: call or message the bank the day you notice the debit, follow up in writing the same day, and ask whether they need a Written Statement of Unauthorized Debit. The federal error-resolution clock and the ACH return clock are related but not identical. Acting early protects both.

A Worked Example With Real Dates

Suppose your bank sends a statement on March 3 that first shows a $186.40 ACH debit from a company descriptor you do not recognize. Under the Regulation E notice framework, the rough outer edge for that error-resolution notice is about 60 days after the statement is sent, so waiting until mid-May is already playing with fire. If you call on March 4, follow up in writing the same day, and complete a Written Statement of Unauthorized Debit when asked, you are inside both the federal notice window and a typical Nacha unauthorized-return window measured from settlement.

Now change one fact. You authorized a $49.00 monthly pull, but March shows $149.00 on the same descriptor. That is usually an authorized-but-wrong claim, closer to an R11-style story than a pure R10 story. You still notify the bank as an error, still keep screenshots, and still ask how they will classify the return. The merchant may later try a corrected entry. Your job is to confirm whether any new debit matches terms you still agree to.

Change the facts again. You canceled a gym on January 10 by email and kept the confirmation. A $42.00 debit posts February 1. Your path is revocation plus bank tools: show the January 10 proof, ask about an authorization-revoked return, and place a stop or subsequent-entry block so March cannot repeat the same surprise. The math people miss is calendar math, not interest math. Every week of delay spends the only asset that matters early in a dispute: time inside the rule windows.

Consumer Accounts vs Business Accounts

This guide focuses on consumer accounts. Business checking often sits outside the same Regulation E consumer protections, and Nacha return rights for corporate entries can be much shorter than the consumer unauthorized windows described above. If you are disputing a debit on a business account, ask your bank which rules apply before you assume a 60-day consumer path exists. Mixing consumer expectations with a business account is a common and expensive mistake for freelancers and small LLCs who use one login for everything.

How to Dispute an ACH Debit With Your Bank

Here is a clear sequence many consumers follow. Your bank's app labels may differ, but the substance is the same.

1. Screenshot and list everything. Capture the date, amount, company descriptor, confirmation or trace numbers if shown, and the statement period. Note whether this is a one-time pull or part of a series.
2. Contact the bank through an official channel. Use the number on your card or statement, secure message, or branch. Say you are reporting an error or unauthorized electronic fund transfer. Ask for a case or reference number.
3. Be precise about the claim type. "I never authorized this company," "I authorized them but this amount or date is wrong," and "I revoked authorization on this date" are different stories. Tell the true one.
4. Put it in writing the same day. A short secure message or letter that names the account, the debit, the amount, the date, and why you believe it is an error creates a dated record. Oral notice can start the process. Written follow-up protects you if memories diverge later.
5. Complete the Written Statement of Unauthorized Debit if asked. Banks commonly require this signed statement before returning certain consumer ACH entries as unauthorized or authorization-revoked. Read it. Check only the boxes that match your facts.
6. Ask about provisional credit and the investigation timeline. Under Regulation E, if the bank needs more than the short investigation window, provisional credit is part of how the longer window works in many cases. Ask when you should see funds and how you will get the written results.
7. Decide whether you also need a stop payment or revocation for future pulls. Disputing one posted debit does not automatically block the next one from the same originator. Handle future risk on purpose (next section).
8. Keep a folder. Save the case number, names of representatives, dates of calls, copies of the statement pages, emails with the merchant, and any cancellation or revocation proof.

If the debit looks like identity theft or account takeover, also change your login credentials, review recent payees and external transfers, and consider a credit freeze. After a messy bank-account incident, many people also review scores and alerts through a tool like WalletHub Premium so a stolen identity problem does not quietly spread into new credit accounts while the ACH case is open.

Stop Payment vs Revoke Authorization

These two tools sound similar and are not interchangeable.

Stop payment

A stop payment asks your bank to refuse a specific ACH debit (or sometimes a narrow set of them) when it tries to post. You usually need enough detail for the bank to match the item, such as the company name and the amount or a close amount range. Banks often charge a fee. Stops can be temporary unless you renew them under the bank's rules. Operationally, stop-payment returns are often coded R08 and sit on a short return timeframe, which is why the stop works best when it is in place before the debit hits.

Revoke authorization

Revocation is aimed at the company that has permission to debit you. You cancel that permission using the method in the authorization (online portal, written notice, phone, or whatever the agreement requires). Keep proof of the revocation date and method. If a debit posts after a valid revocation, your bank may be able to return it under an authorization-revoked reason code (often discussed as R07) once you complete the bank's paperwork. Revoking with the company without telling the bank, or telling the bank without revoking with the company, leaves a gap a recurring bill can walk through.

When to use which

• Use revoke authorization when you want the commercial relationship's debit rights to end.
• Use a stop payment when a specific debit is imminent and you need the bank to block that item while the merchant relationship is being sorted out.
• Use both when a stubborn recurring pull keeps coming after you canceled: revoke in writing with the company, place a stop or ask the bank about blocking subsequent entries, and keep proof of both.
• Use an unauthorized dispute path when you never authorized the originator at all, or the authorization is not valid.

Fees, form names, and online buttons vary by bank and credit union. Ask the representative which tool matches your facts instead of guessing from a help-center article written for a different product.

Documentation That Strengthens Your Case

Strong disputes are boring on paper. They include dates, amounts, and copies. Weak disputes rely on "I am sure I canceled" with no trail.

• Account statements or screenshots showing the contested debit and neighboring activity.
• The original signup email, contract, or checkout page if you ever had a relationship with the company.
• Cancellation confirmations, chat transcripts, certified-mail receipts, or portal screenshots proving revocation.
• Police or FTC identity-theft reports when the debit is part of broader fraud.
• A simple timeline you write yourself: when you noticed the debit, when you called, whom you spoke with, and what you were told.
• The signed Written Statement of Unauthorized Debit and any provisional-credit notice the bank sends.

If the merchant claims you still owe money after a successful bank return, that is a separate billing fight. A network return moves money between banks under ACH rules. It does not automatically erase every civil claim a company might assert. Keep records either way.

What Happens After You File

Once the bank has your notice, several things can occur in parallel.

Expect three parallel threads: the bank's Regulation E investigation, any ACH network return your bank sends, and your own merchant-side cancellation or billing fight. People get frustrated when they treat those as one phone call. They are related, but each can finish on a different day with a different document.

On the Regulation E track, the bank investigates. It may finish quickly inside about 10 business days, or it may provisionally credit you and take longer within the extended window. You should receive results. If it finds an error, it corrects the account. If it finds no error, it explains that in writing and, if provisional credit was given, it may reverse that credit after notice.

On the ACH network track, your bank may return the entry with a reason code that matches your claim, subject to Nacha timing and documentation rules. The originating bank and the company then see the return. For a true unauthorized return, responsible originators are supposed to stop debiting until they have a new authorization. For an R11-style "not in accordance with authorization" return, they may be allowed to fix the defect and send a corrected entry within the rule's window without a brand-new authorization in some cases. Watch your account anyway. Rules describe what should happen. Monitoring confirms what does happen.

If the bank denies your claim and you still believe it was wrong, ask for the written explanation, request any documentation they relied on when the rule gives you that right, and consider a complaint with the Consumer Financial Protection Bureau. Complaints do not guarantee a refund, but they create a formal record and often prompt a second look.

How to Reduce the Chance of a Repeat

Prevention is less dramatic than a dispute and far cheaper.

• Turn on transaction alerts for every debit or for amounts above a low threshold so a bad pull is a same-day problem, not a month-end surprise.
• Audit recurring ACH payees twice a year. Cancel what you do not use, and keep a list of what you still authorize.
• Prefer payments you can see and revoke easily. Some people use a dedicated checking account for subscriptions so a problem cannot touch rent and payroll funds.
• Treat routing and account numbers like secrets. Share them only with parties you intend to pay, and be wary of forms that ask for them without a clear reason.
• After any unauthorized event, rotate credentials and review whether new external transfers or payees appeared.
• Keep a small operating balance in checking and park reserves where a single surprise debit cannot empty your emergency cash.

If a dispute drained cash you needed for rent or bills, rebuild on purpose. A simple emergency-fund sketch helps you see how many months of expenses you want buffered and how a steady monthly transfer closes the gap after a loss. The point is not perfection. The point is that a one-time ACH fight should not leave your cash bare for the next shock.

The Bottom Line

Disputing an ACH debit is a process with names, dates, and clocks, not a vibe. Decide whether the pull was never authorized, authorized but wrong, or authorized until you revoked it. Notify your bank quickly, follow up in writing, complete the Written Statement of Unauthorized Debit when asked, and use stop payments and merchant revocations deliberately for anything that might come back. Regulation E gives many consumer electronic transfers a real investigation framework if you report within the statement-based window. Nacha rules give banks return codes and roughly 60-day consumer unauthorized return pathways when the paperwork lines up. Keep proof, watch for re-debits, and harden alerts so the next odd descriptor never sits unnoticed for weeks. That combination is how most people turn a sickening surprise into a recoverable, documented event.