An ACH credit pushes money from the sender’s account to someone else. An ACH debit pulls money out of an account at the request of whoever is collecting the payment. That single distinction, at the heart of ACH credit vs. ACH debit, drives everything else: who starts the transaction, who controls the amount, and what protections apply when something goes wrong.
How an ACH Credit Works
In a credit, the person or company sending money starts the process. Direct deposit is the familiar example. Your employer collects your bank details when you’re hired, then before each payday submits a payment file to its bank. The employer is the “Originator,” and its bank is the Originating Depository Financial Institution (ODFI). The ODFI forwards the payment through an ACH Operator, which routes it to your bank. Your bank, the Receiving Depository Financial Institution (RDFI), deposits the funds into your account.1Nacha. How ACH Payments Work
Because the sender controls the whole process, credits are called “push” transactions. The Receiver doesn’t have to do anything beyond having an active account. Federal agencies use this mechanism to send Social Security benefits, tax refunds, and other government payments directly to recipients.2eCFR. 31 CFR Part 210 – Federal Government Participation in the Automated Clearing House Most credits settle within one business day.3Nacha. The Significant Majority of ACH Payments Settle in One Business Day or Less
How an ACH Debit Works
A debit flips the roles. The party collecting the payment starts the transaction. If you authorize your electric company to withdraw your monthly bill from your checking account, the utility becomes the Originator. It sends a payment file to its bank, which routes the request through the ACH Operator to your bank, and your bank withdraws the funds to cover the bill.1Nacha. How ACH Payments Work
This is a “pull” transaction, and that reach into your account requires explicit permission. The authorization must clearly state the amount, the date the debit will occur, how to revoke permission, and the routing and account numbers involved. For recurring debits, if the company changes the amount, it must notify you at least ten calendar days before the next scheduled withdrawal. A change to the scheduled date requires at least seven calendar days’ written notice.
How you authorize depends on the channel. Debits arranged in person or by mail need a written signature. Phone-authorized debits need either a recorded oral authorization or a written confirmation sent to you afterward. Internet-authorized debits use what the rules call “similarly authenticated” methods, meaning a secure electronic signature or click-through agreement.4Payments Innovation Alliance. Standard Entry Class Codes
The Practical Differences
The core distinction is who holds the trigger. In a credit, the payer starts the process to send money out. In a debit, the payee starts the process to pull money in. The party submitting the file is always called the Originator, but the Originator’s relationship to the money is opposite in each case: an Originator sending a credit is spending money, while an Originator sending a debit is collecting money.
That has real consequences for risk. When you send a credit, you control the amount and the timing. Nobody can take more than you authorize because you’re the one pressing the button. When you authorize a debit, you’re trusting the collector to pull the right amount at the right time. If they pull too much or too early, you catch it after the fact. That difference in who controls the flow is why debits carry more consumer protection rules than credits.
Where You’ll See Each One
Credits dominate whenever one entity distributes funds to many recipients. Payroll direct deposit is the most common example, along with government benefit payments, vendor payments from businesses to suppliers, and tax refunds. Businesses paying other businesses sometimes use a format called Corporate Trade Exchange (CTX), which lets them attach invoice details alongside the payment.
Debits are the workhorse of recurring bill payment. Mortgage servicers, utility companies, insurance providers, gyms, and streaming services all commonly collect this way. The appeal is convenience: once you authorize the debit, payments happen automatically. Debits also show up in one-time transactions, like paying a bill through a company’s website by entering your bank account number.
Stopping an ACH Debit
You can stop a recurring debit two ways, and doing both is the safest approach.
First, tell the company collecting the payment that you’re revoking your authorization. Put it in writing so you have a record. Second, contact your bank and request a stop payment order. Federal law requires your bank to honor a stop payment request as long as you give at least three business days’ notice before the next scheduled debit.5Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.10 Preauthorized Transfers You can make the request by phone, but your bank can require you to follow up in writing within 14 days. If you don’t send the written confirmation when asked, the oral stop payment order expires.
Banks commonly charge a fee for stop payment orders, typically in the $25–$35 range, whether or not the debit ultimately goes through. Revoking authorization directly with the company is free and eliminates the problem at the source, which is why doing both matters.
Consumer Protections Under Regulation E
Regulation E, which implements the Electronic Fund Transfer Act, protects personal bank accounts when an ACH debit goes wrong. If an unauthorized debit hits your account, your liability depends on how quickly you report it:
- Within 2 business days of learning about it, your maximum liability is $50.
- After 2 business days but within 60 days of receiving the statement, your maximum liability is $500.
- After 60 days, you could be liable for the full amount of any unauthorized transfers that occur after that window, if the bank can show it would have prevented them with earlier notice.
The 60-day clock starts when your bank sends or makes available the periodic statement showing the unauthorized transaction.6Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.6 Liability of Consumer for Unauthorized Transfers Once you notify your bank of an error, it must investigate and resolve the issue, typically by provisionally crediting your account while it looks into the claim.7Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.11 Procedures for Resolving Errors
Check your statements regularly. The faster you report a problem, the less money you’re on the hook for.
Business Accounts Are Not Covered the Same Way
Regulation E only covers consumer accounts. If a business account gets hit with an unauthorized ACH debit, the leash is much shorter. Under Nacha’s rules, an unauthorized debit to a business account using a corporate transaction code can only be returned within two banking days of settlement. Miss that window and the bank loses the ability to return the transaction through normal ACH channels.8Nacha. ACH Network Rules – Reversals and Enforcement
Business-to-business credit transfers fall under Article 4A of the Uniform Commercial Code rather than federal consumer law.9Legal Information Institute (LII) / Cornell Law School. U.C.C. – Article 4A – Funds Transfer Article 4A holds financial institutions liable for their own errors and for failing to follow agreed-upon security procedures, but it also allows banks and their business customers to modify many of the default protections by contract. A business generally has 90 days to notify its bank of an error and up to one year to seek reimbursement, but those windows can be shortened by agreement.
The gap matters. A consumer who notices a fraudulent $2,000 debit six weeks later can still dispute it with minimal liability. A business owner in the same situation may have no recourse through the ACH system at all.
Reversals When the Sender Made a Mistake
A reversal is not the same as a dispute. Reversals are initiated by the Originator when it made an identifiable error. Nacha limits reversals to a short list of permissible reasons: a duplicate payment, funds sent to the wrong account, the wrong amount, or wrong timing (a debit processed earlier than intended or a credit processed later than intended).
The Originator must transmit the reversal within five banking days of the original transaction’s settlement date.8Nacha. ACH Network Rules – Reversals and Enforcement After five days, the reversal option closes and the parties have to resolve the problem outside the ACH system. Even inside the window, a reversal isn’t guaranteed to work. If the Receiver has already withdrawn the funds, the receiving bank may not be able to pull the money back.
Reversals exist to fix honest mistakes, not to claw back payments the Originator later regrets. Using a reversal for a reason outside the permitted list can result in enforcement action from Nacha, including fines against the originating bank.10Nacha. End-user Briefing – Reversals