How to Fill Out and Submit an ACH Dispute Form for Unauthorized Debits

To fill out an ACH dispute form, you identify the debit on your statement, enter your account details, check the box that matches why the charge is wrong (never authorized, authorization revoked, or the amount or timing didn’t match what you agreed to), write a short factual description of what happened, and sign the attestation. Then submit it to your bank as quickly as you can, because under Regulation E your liability for an unauthorized electronic transfer grows the longer you wait.

Every bank uses its own layout, and some call it an “ACH Dispute Form” while others use “Unauthorized ACH Return Form.” The information required is the same across institutions, and the signed form is what your bank needs to send the return back through the ACH network.

Gather This Before You Start

Pull up the statement showing the debit before you open the form. You’ll need:

Your full account number and your bank’s nine-digit routing number.
The exact posting date, dollar amount, and originator name as they appear on the statement.
Any evidence supporting your claim: cancellation confirmations, the original payment agreement, emails to the merchant, or a police report if it’s identity theft.

Republic Bank tells customers specifically to have the dates, amounts, and descriptions of disputed items ready before contacting them.¹ If you revoked authorization with a merchant, note the date you notified them, the method (email, portal, certified letter), and any confirmation number they gave you.

Pick the Right Reason Code

The reason section is the part of the form that most often trips people up. Your bank uses your selection to map the return to a specific ACH return code, and the wrong choice can get the dispute rejected. Three categories cover most consumer situations:

Completely unauthorized (R10). You have no relationship with the company and never gave anyone permission to debit your account. This covers identity theft, fraud, and cases where a company hit the wrong account.
Authorization revoked (R07). You did give the company permission at some point, but you cancelled it with them before this debit was initiated.
Doesn’t match your authorization (R11). You authorized debits from this company, but this particular one was for the wrong amount, arrived before the scheduled date, or was tied to an incomplete purchase.

Nacha’s rules define R10 as covering debits where the receiver doesn’t know the originator or never authorized the debit, R07 as authorization revoked, and R11 as an entry that doesn’t match the terms of the authorization.² The checkboxes on your form will use plainer language. Huntington Bank’s form, for instance, offers options like “amount different than authorized” and “authorization revoked,” which map to these codes behind the scenes.³ Bank of America’s form similarly distinguishes between debits where you never authorized the originator at all and debits where authorization existed but its terms weren’t met.⁴

Filling Out Each Section

Layouts differ, but most forms move through the same five sections in roughly this order.

Account Identification

Your name as it appears on the account, account number, mailing address, daytime phone, and email. Match your bank’s records exactly. If the name on the account is slightly different from how you usually sign, use the version on file.

Transaction Details

List the disputed debit with its date, amount, and originator name. If you’re disputing more than one transaction, enter each one on a separate line rather than lumping them together. If the same merchant made several unauthorized pulls, each debit still gets its own row.

Reason for Dispute

Select the single box that best fits the situation. If more than one seems to apply, choose the one closest to the core problem. A debit you never authorized at all is R10, even if the amount also happens to be wrong. Revocation is only R07 if you had authorized the company at some earlier point.

Narrative Explanation

Most forms give you a few lines to describe what happened in your own words. Keep it short and factual. State when the charge appeared, why it’s wrong, and any step you’ve already taken, such as contacting the merchant. Avoid speculation about the company’s motives; stick to what you know and can document.

Attestation and Signature

The signature line is the operative part of the document. Some banks require you to sign under penalty of perjury that the information is accurate. Huntington’s form requires you to attest that you’ve reviewed the circumstances and the debit was not authorized.³ Under Nacha rules, this signed statement is called a Written Statement of Unauthorized Debit, or WSUD, and it’s what authorizes your bank to send the return entry back through the ACH network.⁵ Date the form on the day you sign it.

How to Submit It

Most banks accept the form through online banking, mobile app, mail, fax, or in person at a branch. The online portal is usually fastest and produces an instant confirmation. If you mail a physical copy, send it certified with return receipt requested so you can prove when the bank received it. If you fax, keep the transmission confirmation page.

You can also start the dispute by phone. Regulation E requires the bank to begin investigating as soon as it gets an oral notice of error; it can’t wait for written confirmation to start. But the bank may require you to send the signed form within ten business days of your call. Miss that deadline and the bank can stop investigating and isn’t required to give you provisional credit.⁶ So call first if it’s faster, then send the written form the same day if you can. Log every call: the date, who you spoke with, and any claim or reference number.

File Quickly to Protect Yourself

Under Regulation E, your maximum liability for an unauthorized electronic transfer depends on how fast you report it.

Within 2 business days of learning about the unauthorized transfer: your liability is capped at $50, or the amount taken before you notified the bank, whichever is less.⁷
After 2 business days but within 60 days of the statement: liability can climb to $500.⁷
After 60 days from the statement date: you can be liable for the full amount of any unauthorized transfers occurring after the 60-day window closes, with no cap.⁷

The 60-day clock runs from the statement date, not from the day you happened to notice the charge. That’s why reviewing statements matters even when nothing looks wrong.

What Happens After You Submit

Once your bank has a valid error notice, 12 CFR 1005.11 sets the timeline:

Ten business days to investigate and decide whether an error occurred.⁸
If the bank needs longer, it can extend the investigation up to 45 days, but only if it provisionally credits your account for the disputed amount within those first ten business days. It may hold back up to $50 if it has a reasonable basis to believe the transfer was unauthorized.⁶
Within two business days of issuing provisional credit, the bank must tell you the amount and date and let you use the funds while it continues investigating.⁶
If it finds an error, the bank must correct it within one business day. Either way, it must report the results to you within three business days of finishing the investigation.⁸

If the Bank Denies Your Dispute

If the bank concludes no error occurred, it must send you a written explanation within three business days, and any provisional credit can be reversed. You’re entitled to request copies of the documents the bank relied on.

Ask the bank to reconsider first, and provide any additional evidence you’ve gathered. If that fails, file a complaint with the Consumer Financial Protection Bureau. You can attach up to 50 pages of supporting documents; include your key dates, amounts, and copies of communications with the bank. The CFPB forwards the complaint to the bank, which generally responds within 15 days and has up to 60 days for a final response. You then have 60 days to give feedback on whether the response resolved the issue.⁹

Business Accounts Are Different

The steps above assume a personal account. If the debit hit a business account, Regulation E doesn’t apply. The CFPB confirms that the Electronic Fund Transfer Act and Regulation E cover only consumer accounts, not those established for business purposes.¹⁰ Most banks still offer a dispute process for business customers, but the federally mandated timelines, provisional credit, and liability caps don’t apply. Your commercial account agreement controls what rights and deadlines you have, so check it or call your business banker before filing.

1
Republic Bank. Can I File a Dispute on Transactions Using My Account and Routing Number (ACH) at Republic Bank?
2
Nacha. Differentiating Unauthorized Return Reasons
3
Huntington Bank. ACH Dispute Form
4
Bank of America. Unauthorized ACH Return Form
5
Nacha. Risk Management Topics – October 1, 2024
6
Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors
7
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
8
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
9
Consumer Financial Protection Bureau. Submit a Complaint
10
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs