An eCheck payment authorization form gives a company written permission to pull money from your bank account through the ACH network instead of charging a card or waiting for a paper check. To fill one out, you provide your name and contact details, your bank’s nine-digit routing number, your account number, the account type, the amount and timing of the payment, and your signature (on paper or electronically). Get those fields right and the form is enforceable the moment you sign. Get a digit wrong and the payment bounces, usually with a fee attached.
What the Form Has to Include
Nacha, which runs the ACH network, requires every consumer debit authorization to contain a specific set of elements.1Nacha. The Importance of Compliant ACH Authorizations If any of them is missing, the authorization can be ruled non-compliant later, and the merchant may not be able to prove you agreed to the debit. When you look at the form, make sure you see all of these:
- Clear authorization language, such as “I authorize [Company Name] to debit my account.” Buried or vague wording does not count.
- The transaction amount. For a one-time payment, an exact dollar figure. For recurring debits, a fixed amount, a range, or a formula tied to usage.
- The date or frequency. Recurring authorizations spell out the billing cycle and start date.
- Your account number.
- Your bank’s nine-digit routing number.
- Revocation language explaining how to cancel and how much notice the merchant needs.2Nacha. WEB Proof of Authorization Industry Practices
Most forms also ask for your full legal name, mailing address, phone, email, and whether the account is checking or savings. The account type matters: a debit sent to a savings account when the form says checking will bounce.
Filling In Your Routing and Account Numbers
These two numbers cause the most trouble, because they sit next to each other at the bottom of a paper check and look similar at a glance. The routing number is always nine digits and appears first on the left. The account number comes after it and can be any length your bank uses. If you don’t have a check in front of you, both numbers are also in your bank’s online portal or mobile app, usually under account details or direct deposit setup.
Check every digit against two sources. A voided check plus the number shown in your online banking is the simplest cross-check. A single transposed digit usually causes the ACH transaction to fail, which triggers a returned-item fee from your bank and sometimes a second fee from the merchant.
Then fill in the payment fields. A one-time payment needs the exact dollar amount and withdrawal date. A recurring payment needs the billing frequency, start date, and (when the form offers them) an end date or total number of payments. Don’t leave fields blank on a recurring authorization. Blanks create ambiguity about what you actually agreed to.
Signing the Form
If the form is on paper, sign and date it in ink. If it’s online, you’ll typically check a box and click an “Authorize” button, or type your name into a signature field. Either way, the signature is binding. The federal Electronic Signatures in Global and National Commerce Act (E-SIGN) says a contract cannot be denied legal effect just because it was signed electronically or exists only as an electronic record.3Office of the Law Revision Counsel. 15 U.S.C. Chapter 96 – Electronic Signatures in Global and National Commerce Nearly every state has adopted the Uniform Electronic Transactions Act, which carries the same principle into state commerce. A click online carries the same weight as a pen signature on paper.
The merchant has to keep your signed or similarly authenticated authorization for two years after you terminate or revoke it.4Nacha. Meaningful Modernization If your bank ever asks the merchant to prove the debit was authorized, the merchant has ten business days to produce the record. Keep your own copy too, whether that’s a scanned PDF or a confirmation email. It’s the first thing you’ll want if a charge later looks wrong.
How to Submit It
Submission method depends on the merchant. Online forms are submitted through the merchant’s secure portal; look for “https” in the address bar before you type account numbers into any web page. Paper forms can be handed in, uploaded as a scan, or mailed. If you mail a paper form, send it by certified mail so you have delivery confirmation.
Avoid sending account numbers through regular email or filling them into unencrypted web forms. Nacha requires everyone handling ACH data to encrypt banking information in transit and restrict access to stored data, and a merchant that asks you to email account details or uses an unsecured page is not following those rules. That’s a reason to pause before submitting.
What Happens After You Submit
Most merchants verify the account before the first real debit. The traditional method is micro-deposits: within one or two business days, the merchant sends two small deposits (often a few cents each) to your account. You log in to your bank, read the exact amounts, and enter them back on the merchant’s site. Matching them proves you actually have access to the account.
Many merchants now use instant verification instead. You log in to your bank through the merchant’s verification partner, confirm your identity, and the account is validated in seconds. If a merchant uses micro-deposits and you don’t see them after two business days, check with your bank to make sure the account can receive small ACH credits.
Once verification succeeds, you should get a confirmation (usually by email) listing the merchant’s name, the first withdrawal date, and the amount or billing terms. Save it. If a later debit doesn’t match those terms, this confirmation is your first piece of evidence.
Changing the Bank Account on File
If you switch banks, close the account, or just want the merchant to debit a different account, submit a new authorization with the updated routing and account numbers. Do it before the next scheduled withdrawal. A debit aimed at a closed or incorrect account will bounce, and the return can trigger fees from both your bank and the merchant. Many merchants let you update banking details through an online dashboard; others require a new signed form.
Canceling a Recurring eCheck
You can stop a recurring ACH debit by notifying your bank at least three business days before the next scheduled withdrawal. The notice can be oral or in writing.5Office of the Law Revision Counsel. 15 U.S.C. 1693e – Preauthorized Transfers If you call the bank, it can require you to send written confirmation within 14 days; if you don’t, the oral stop-payment order expires.6eCFR. 12 CFR 1005.10 – Preauthorized Transfers
Stopping payment at the bank is not the same as canceling with the merchant. Even after your bank blocks the debit, the merchant may keep trying to withdraw, and each attempt can produce a return and more fees. Send the merchant a cancellation notice too. The revocation language on your original authorization tells you how the merchant wants to receive it.
If a Debit Looks Wrong
Report unauthorized ACH debits to your bank quickly. Under Regulation E, how fast you report sets how much you can be held responsible for: notify the bank within two business days of learning about the problem and your maximum loss is $50; delays push that cap higher, and waiting more than 60 days after the statement arrives can leave you on the hook for later unauthorized transfers in full.7Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Your bank may ask you to sign a Written Statement of Unauthorized Debit, after which the merchant has ten business days to produce its proof of authorization. If the merchant can’t produce a complete record with all the required elements, the bank can reverse the charge. This is the moment the copy you saved earns its keep.