ACH filter services are bank tools that let you pre-approve which companies can pull money from your account by ACH debit and automatically hold or return everything else. Instead of discovering an unauthorized withdrawal after it has cleared, you build a list of originators you trust, and any debit that doesn’t match that list gets suspended before the money moves. For business accounts especially, that pre-settlement intercept is the difference between a quick fix and a loss you can’t recover.
Filter or Block: Pick the Right Tool
Banks offer two services that sound similar and behave very differently. An ACH block closes the account to all ACH debits. Nothing clears, ever. That makes sense for an account that should only send money out, like a payroll funding account, but it will reject every legitimate recurring vendor debit along with the fraudulent ones.
An ACH filter is the flexible version. You maintain a list of approved originators, and debits from companies on that list clear normally. Anything not on the list is held as an exception for you to review. Some banks market this as “ACH positive pay,” and depending on the institution it can cover incoming debits, credits, or both. If your only concern is unauthorized withdrawals, a debit-only filter is the standard setup.
How the Filter Catches a Debit
Every ACH transaction carries identifying data inside the file. When an incoming debit arrives, the bank’s software reads specific fields from the transaction record and compares them against your rules. If the originator’s Company ID, the Standard Entry Class code, and the dollar amount all match an approved entry, the payment settles without any action on your part.
When something doesn’t match, the system suspends the transaction before any money leaves your account. That timing is the whole point. Other fraud tools flag transactions after settlement; a filter intercepts the debit during processing, so your balance stays intact while you decide what to do.1Nacha. ACH Guide for Developers – ACH File Details
Building Your Approved Originator List
The filter is only as good as the list behind it. Three pieces of data drive each entry.
Company ID
Every ACH originator is assigned a 10-digit Company ID that identifies them in every file they send.1Nacha. ACH Guide for Developers – ACH File Details You can usually find it on your bank statement next to the transaction description, or ask the vendor’s accounts receivable team. A single wrong digit will reject legitimate payments, so double-check every entry.
Standard Entry Class Code
Each ACH transaction is tagged with a Standard Entry Class code that describes the type of payment. The three you’ll see most often:
- CCD, corporate credit or debit, used for business-to-business payments such as vendor invoices and cash concentration transfers.
- PPD, prearranged payment or deposit, used for recurring consumer transactions where written authorization exists.
- WEB, internet-initiated entries, used for payments authorized online or through a mobile device.
A vendor that debits with CCD transactions won’t match a filter entry set to PPD, even if the Company ID is right.1Nacha. ACH Guide for Developers – ACH File Details Match the code to how the vendor actually sends the debit.
Dollar Cap
Most filter systems let you set a maximum dollar amount for each approved originator, and this is where filters earn their keep beyond catching outright fraud. If your electric bill never exceeds $400, capping that vendor at $500 means any unusually large debit routes to the exception queue instead of clearing automatically. The cap doesn’t reject the transaction; it just makes you look at it.
Turning the Service On
Setup usually happens through your bank’s online treasury management portal, often under a section labeled Fraud Services or Cash Management. You enter each originator’s Company ID, the associated SEC code, and any dollar thresholds, and the filter becomes a standing instruction that applies to all future incoming debits.
Larger corporate accounts may require a signed authorization form from an account officer before the service activates. The paperwork sets the filtering parameters, allocates liability between you and the bank, and formally fixes your default action for unmatched transactions. Activation generally takes one business day after the bank processes the request. Confirm with your relationship manager that monitoring is live before you rely on it.
Handling Exceptions and the Decision Window
When an incoming debit doesn’t match your list, your bank generates an exception alert by email or through the portal. The alert shows the originator’s name, Company ID, SEC code, and dollar amount, and you issue a “pay” or “return” decision.
Timing is tight. Banks impose a daily cutoff for exception decisions, often between 10:00 AM and noon on the business day after the debit attempt. Miss that window and your default action takes over. If the default is “return,” the bank rejects the transaction automatically, which protects your cash but can irritate a legitimate vendor whose debit was fine and you simply didn’t respond. If the default is “pay,” an unauthorized debit could clear while you aren’t watching.
The safer default is “return,” paired with a habit of checking exception alerts first thing each morning. Any real vendor whose debit gets returned can re-initiate, and you add them to the approved list going forward. Keeping a log of exception decisions also builds an audit trail that helps during account reconciliation and any later fraud investigation.
What the Service Costs
Pricing varies by institution and generally includes a monthly maintenance charge plus per-item fees for exception processing. One large national bank’s published 2026 schedule charges $36.75 per month for ACH positive pay and $33.00 per month for a blanket ACH block, with lower rates for certain commercial account packages.2Truist. 2026 Price Changes Community banks and credit unions set their own rates, so it’s worth comparing.
Banks also face underlying processing costs they may pass through, especially if you generate heavy exception volume.3Federal Reserve Services. FedACH Services 2026 Fee Schedule Keeping your approved list current is the simplest way to hold exception fees down.
Why a Filter Matters More for a Business Account
Liability for unauthorized ACH debits splits sharply by account type, and that split is the strongest argument for business owners to get a filter in place now.
Consumer Accounts
Consumer accounts get significant protection under Regulation E. Report an unauthorized debit within two business days of discovering it and your liability caps at $50. Wait longer but report within 60 days of receiving the statement, and the cap rises to $500. Miss the 60-day window and liability is unlimited for unauthorized transfers that occur after those 60 days.4Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The bank cannot impose greater liability based on negligence, and it must extend these deadlines if circumstances such as hospitalization prevented timely reporting.
Once you report, the bank must investigate within 10 business days and report its findings within three business days after finishing. It can extend the investigation to 45 days, but only if it provisionally credits your account within 10 business days of your notice, giving you access to the disputed funds while the investigation runs.5eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Business Accounts
Regulation E applies only to accounts established primarily for personal, family, or household purposes.6Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions Business accounts fall outside that definition. Business-to-business ACH transactions are generally governed by UCC Article 4A and the NACHA Operating Rules, and under Article 4A, if your bank followed a commercially reasonable security procedure and accepted a payment order in good faith, the loss from an unauthorized transaction can fall on you even though you didn’t authorize it.
The return window is also far shorter. Unauthorized debits to business accounts using corporate entry codes like CCD or CTX must be returned within two business days of settlement, using return reason code R29.7Nacha. Differentiating Unauthorized Return Reasons Miss those two days and recovery through the ACH network effectively disappears. You’re left pursuing the originator directly, which is rarely practical when the debit was fraudulent to begin with.
If an Unauthorized Debit Still Clears
Filters aren’t absolute. The service might not have been active yet, the default might have been “pay,” or the account might be a consumer account with no filter at all. The return process depends on which it is.
For a consumer account, contact the bank right away and file an error notice identifying the transaction. You have 60 days from when the statement showing the debit was sent. The bank uses return reason code R10, which covers debits the account holder doesn’t recognize or hasn’t authorized.7Nacha. Differentiating Unauthorized Return Reasons Once you file, the Regulation E investigation and provisional credit timelines apply.5eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
For a business account, the clock is much tighter. Notify the bank and initiate an R29 return within two business days of settlement. Document the transaction, when you discovered it, and every communication with the bank. If the two-day window has passed, you may still be able to work with your bank on a recovery effort outside the standard ACH return process, but there are no guarantees.
Keeping the Filter Effective
A filter isn’t a set-and-forget service. Vendors change, companies get acquired and their Company IDs shift, and new recurring payments get added through the year. Each time you authorize a new vendor, add that originator to your filter list before the first debit hits. Otherwise it shows up as an exception, and if you miss the decision window, your default action decides for you.
Review the approved list at least quarterly. Remove vendors you no longer do business with. A stale whitelist defeats the filter’s purpose, because old authorizations stay open: if a former vendor’s credentials are compromised, stolen Company IDs could be used to initiate debits your filter waves right through. Routine cleanup also cuts unnecessary exceptions, which keeps per-item costs down and makes the alerts you do receive worth paying attention to.