An ACH credit and an ACH debit move money in opposite directions, and almost every legal difference between them flows from that one fact. A credit is a push: the sender tells their bank to send money to someone else’s account. A debit is a pull: the recipient reaches into the payer’s account and withdraws funds that the account holder has authorized in advance. In 2025, the ACH network processed 35.19 billion payments worth roughly $93 trillion, so the rules governing these two transaction types touch nearly every paycheck, bill, and benefit payment in the country.1Nacha. ACH Network Volume and Value Statistics The direction of the transfer determines who needs permission, how you can stop or reverse it, and what happens if the money moves without your consent.
How an ACH Credit Works
With a credit, the person or business holding the money starts the transaction. They give their bank the recipient’s routing and account number and tell it how much to send. The bank batches the instruction with other outgoing transfers, and the funds arrive in the receiving account, usually within one to two business days.
Direct deposit of wages is the most familiar example. Social Security and other government benefits arrive the same way. Businesses use credits to pay vendors, distribute tax refunds, and issue rebates. In 2024, ACH credits accounted for 14.7 billion transactions and $56.8 trillion in value, driven largely by payroll and business-to-business payments.2Nacha. 2024 ACH Network Infographic Because the sender controls the timing and amount, credits carry less risk of unauthorized activity on the sender’s side. The tradeoff appears later: once a credit lands, getting it back is difficult.
How an ACH Debit Works
A debit flips the relationship. The recipient initiates the withdrawal and pulls money from the payer’s account. Monthly mortgage payments, utility bills, gym memberships, and insurance premiums typically run this way. You set it up once, and the biller pulls on schedule. ACH debits made up 18.8 billion transactions in 2024, roughly 56 percent of all ACH volume by count.2Nacha. 2024 ACH Network Infographic
Because someone else is reaching into your account, both federal law and network rules impose stricter requirements on debits than on credits. The most important is authorization.
Authorization Rules for ACH Debits
Every ACH debit from a consumer account requires the account holder’s advance permission. Under NACHA’s operating rules, the authorization must be in clear, easy-to-understand language and identify the specific payments being authorized. For consumer debits, it generally has to be in writing and signed or similarly authenticated. Oral authorization is allowed, but the business collecting the payment must either record the conversation or send written confirmation before the first payment settles, and it has to keep that record for at least two years.3Nacha. Meaningful Modernization Becomes Effective Sept 17 2021
Many billers verify account ownership before the first pull using micro-deposits. A micro-deposit credit must be less than $1.00, any offsetting debit cannot exceed the total credits, and the company entry description must read “ACCTVERIFY” so you can spot it on your statement. The biller cannot begin regular debits until you confirm the amounts.4Nacha. Micro-Entries
Credits do not carry the same requirement. The sender is moving their own money; nobody needs to authorize being paid.
Stopping a Debit or Reversing a Credit
Here the difference between the two shows up clearly, because the tools available to you depend on which direction the money is flowing.
Stopping a Scheduled Debit
You can stop a scheduled ACH debit by notifying your bank at least three business days before the payment date. The notice can be oral, but the bank may require written confirmation within 14 days. If you don’t send the written follow-up when asked, the oral stop order expires.5eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.10 Banks typically charge a fee, often between $15 and $36.
A stop order blocks one payment. To end recurring debits entirely, you also need to revoke the authorization directly with the company. Tell the biller in writing that you are withdrawing permission for future withdrawals, and separately notify your bank that you have done so. Once informed, the bank must block future debits from that originator, even if the company later claims the authorization is still active.6Consumer Financial Protection Bureau. How Can I Stop a Payday Lender From Electronically Taking Money Out of My Bank or Credit Union Account
Reversing a Credit After It Has Landed
Pulling back a credit is much harder because the money already sits in someone else’s account. NACHA rules permit a reversal only in narrow situations: a duplicate payment, an incorrect dollar amount, an incorrect recipient, or a payment that settled on the wrong date. The reversal request has to reach the receiving bank within five banking days of the original settlement date.7Nacha. ACH Network Rules – Reversals and Enforcement
Even when the reason qualifies, success isn’t guaranteed. If the recipient has already withdrawn the funds or the receiving bank refuses, the sender may have to pursue recovery through other channels. This friction is intentional. Recipients of payroll, vendor payments, and benefits need confidence that money in their account will stay there.
What Happens If a Transfer Was Unauthorized
Consumer accounts have federal protection under the Electronic Fund Transfer Act, implemented through Regulation E. Your exposure depends on two things: whether an access device like a debit card or PIN was lost or stolen, and how quickly you tell your bank.
Unauthorized Debits Without a Lost Card
Most unauthorized ACH debits fall here. Someone gets your routing and account number and pulls funds without permission, but no card or access code was lost or stolen. In that scenario, the tiered liability caps don’t apply. You have zero liability for unauthorized debits shown on your statement, provided you report them within 60 calendar days of the bank sending the statement. Miss that window, and you can be held responsible for further unauthorized transfers that occur after the deadline and before you finally notify the bank.8Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
Unauthorized Transfers With a Lost or Stolen Access Device
When the fraud traces back to a lost or stolen debit card, PIN, or similar access device, the tiered rules apply:
- Reported within 2 business days of discovering the loss: maximum liability is $50.
- Reported after 2 business days but within 60 days of the statement: maximum liability is $500.
- Reported after 60 days: potentially unlimited liability for transfers occurring after the 60-day period.
The clock on the first two tiers starts when you learn the device is missing, not when the unauthorized transfer posts.9eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.6
The Authorized-User Wrinkle
If you voluntarily give someone access to your account and they exceed the authority you granted, you are fully liable for those transfers unless you have already told your bank the person is no longer authorized.10Consumer Financial Protection Bureau. Comment for 1005.2 Definitions A family member you once allowed to use your debit card who then makes an unauthorized charge is your problem until you formally revoke access with the bank.
How Your Bank Must Investigate
Regulation E does more than cap your loss. It forces your bank to actually investigate when you report an error. Once you notify the bank, it must complete the investigation and report its results within 10 business days. If it finds an error, it has one business day after that finding to correct it.11Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors
If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account within those initial 10 business days. You get full use of the provisional funds while the investigation continues. The bank can hold back up to $50 if it reasonably believes an unauthorized transfer occurred and has properly disclosed your liability. If the investigation ultimately clears the transaction, the bank can reverse the provisional credit after notifying you.12eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
This is where the direction of the transaction has real consequences. If an unauthorized debit drains your checking account, Regulation E requires the bank to put the money back quickly while it sorts things out. No equivalent federal mechanism exists for clawing back a mistaken credit, because the sender already chose to move the money.
Business Accounts Are Governed by a Different Law
Regulation E’s consumer protections do not apply to business accounts. Commercial ACH transactions fall under UCC Article 4A, which allocates loss based on security procedures rather than dollar caps. If your bank offered a commercially reasonable security procedure to verify payment orders and followed it properly, the bank is not liable for an unauthorized transfer, even if someone outside the business initiated it. The loss lands on the business.13Cornell Law Institute. UCC 4A-202 – Authorized and Verified Payment Orders
What counts as commercially reasonable depends on the business’s size, the typical frequency and dollar amount of its payments, what alternatives the bank offered, and what similar businesses and banks use. If the bank proposed multi-factor authentication and the business declined it in favor of something simpler, the business is deemed to have accepted the risk. Deposit agreements often impose reporting windows as short as 24 hours, a far cry from the 60-day consumer window.
The practical takeaway for business owners: take every security option your bank offers seriously. Declining stronger verification because it’s inconvenient can shift the entire loss to you if a fraudulent payment slips through.
Return Codes That Signal a Dispute
When an ACH transaction fails, the receiving bank returns it with a standardized code identifying the reason. The one that matters most for disputes is R10, which the account holder uses to say they never authorized the debit, don’t recognize the company, or have no relationship with the originator. Other common codes include R01 (insufficient funds), R02 (account closed), R03 (no account), and R04 (invalid account number).
NACHA sets an unauthorized return rate threshold of 0.5 percent. If a company’s unauthorized returns exceed that rate over a rolling 60-day period, it triggers a risk investigation and potential enforcement action through NACHA’s industry review panel.14Nacha. ACH Network Risk and Enforcement Topics Exceeding the threshold doesn’t automatically trigger a fine, but it puts the originating bank on notice and can end in penalties or loss of ACH origination privileges.15Nacha. Differentiating Unauthorized Return Reasons For an account holder, a properly filed R10 dispute is the mechanism that turns Regulation E’s paper protections into a returned deposit.