How to Find Out Where an ACH Payment Came From: Trace Steps

To find out where an ACH payment came from, start with the identifiers already sitting in your bank records: the company descriptor on your statement, and, inside your online banking portal, the 10-digit Company ID and the three-letter Standard Entry Class (SEC) code that describes the transaction type. If those clues don’t name the sender, your bank can run a formal trace using the 15-digit ACH trace number attached to the transfer. Move quickly if the payment looks unauthorized. Federal law gives you 60 days from the statement date to report it and keep your full liability protections.

Start With the Descriptor on Your Statement

The short label printed next to the dollar amount is the Company Name field from the ACH record. It maxes out at 16 characters under NACHA’s file format rules, which forces heavy abbreviation.¹ You might see “AMZN MKTPLC” instead of Amazon Marketplace, or “MSFT RES” instead of Microsoft Rewards.

If the name means nothing to you, copy the exact string into a search engine with quotation marks around it. Abbreviated ACH descriptors are widely discussed in forum posts and consumer databases, and many turn up on the first page of results. Watch the first few characters. They sometimes point to a parent company rather than the brand you know. A descriptor starting with “GPC” can trace back to Genuine Parts Company even though the product you use is NAPA Auto Parts.

Look Deeper in Online Banking

A printed statement hides most of the useful metadata. Log in to your bank’s website or app and open the individual transaction. The detail view usually shows two fields that a paper statement leaves out: the Company ID and the SEC code.

The Company ID

This is a 10-digit alphanumeric identifier that the originator’s bank assigned to them.² Pasting it into a search engine can surface the company’s legal registration or business filings. Some banks offer free lookup tools that return the originator’s name and phone number when you enter the ID. If a web search comes up empty, your bank’s customer service team can pull the originator’s information directly from the ID.

The SEC Code

The Standard Entry Class code is a three-letter designation that tells you how the transaction was initiated.² Knowing the type narrows the field and can jog your memory about a forgotten authorization. The common codes are:

PPD (Prearranged Payment and Deposit): a recurring or one-time consumer payment authorized in writing, common for payroll direct deposits and utility autopay.
WEB: a payment you authorized through a website or mobile app.
CCD (Cash Concentration or Disbursement): a business-to-business transfer.
ARC (Accounts Receivable Entry): a paper check you mailed that was converted to an electronic debit.
POP (Point of Purchase): a check handed over in person and converted at the register.
RCK (Re-presented Check Entry): a check that bounced for insufficient funds and is being re-presented electronically.
IAT (International ACH Transaction): a transfer entering or leaving the United States, which carries extra data including the originator’s name, address, and country code.

ARC, POP, and RCK all point back to a paper check that was converted to an electronic transfer, so an unfamiliar entry may trace to a check you wrote weeks ago.² For an IAT code, the transaction addenda must include the originator’s name and address and their bank’s name and country, and your bank can retrieve those details for you.³

Collect the Details You’ll Need for a Trace

When the descriptor and online details still don’t identify the source, your bank can trace the payment back through the clearing network. Before you call, pull these items from your transaction history:

ACH trace number: a 15-digit tracking number unique to the transfer. The first eight digits are the originating bank’s routing number, and the last seven identify the specific transaction. It usually appears under “extended details” or “additional info” in online banking.⁴
Exact dollar amount, cents included. A one-cent discrepancy can block a match.
Settlement date: the official ACH processing date when funds moved between banks. It can differ from the date the transaction posted to your account, because banks post before or after settlement depending on their processing schedule.⁵

If you believe the transfer was unauthorized, your bank will also ask you to sign a Written Statement of Unauthorized Debit (WSUD), a form where you provide the trace details and declare that you did not authorize the transaction.⁶ You can sign and date it as soon as the transaction appears in your account, even before it fully settles.⁷

Asking Your Bank to Run the Trace

You can submit a trace request through the bank’s secure message portal, at a branch, or by phone to the ACH or fraud department. Calling is usually fastest, because a representative can pull the trace data on the spot and open the investigation while you’re on the line.

For consumer accounts, federal Regulation E requires the bank to investigate within 10 business days of receiving your error notice. If it needs more time, it can extend the investigation to 45 calendar days, but it has to provisionally credit your account within the first 10 business days so you are not out the money while the review continues.⁸ The bank may withhold up to $50 from that provisional credit if it has reason to believe the transfer was unauthorized. Once the investigation closes, the bank has three business days to report the results. If the trace names the originating bank, you can contact that institution directly to resolve a billing dispute or report fraud.

Deadlines That Protect You

How fast you report an unauthorized ACH transfer changes how much of it you can be stuck with. Regulation E sets a tiered liability structure for consumer accounts:⁹

Report within 2 business days of learning about the transfer: maximum liability is $50, or the amount transferred before you notified the bank, whichever is less.
Report after 2 business days but within 60 days of the statement: maximum liability rises to $500.
Report more than 60 days after the statement: you can be held responsible for the full amount of any unauthorized transfers that occur after the 60-day window closes, with no cap.

The 60-day clock starts when the bank sends the periodic statement that first shows the unauthorized transfer, not when you open it or notice the charge.⁹ If something like a hospital stay kept you from reviewing your statement in time, the bank must extend these deadlines to a reasonable period. Business and commercial accounts do not get these Regulation E protections; on those accounts your rights come from NACHA’s operating rules and your account agreement, and the return window for an unauthorized business debit is typically the next banking day after the entry posts.¹⁰

If the Payment Was an Unexpected Deposit

If the reason you’re trying to trace an ACH payment is that money you weren’t expecting showed up, be careful before touching the funds. A common scheme works like this: a scammer sends money into your account using stolen bank credentials, then contacts you through a payment app or email, claims the deposit was a mistake, and asks you to send it back.

“Returning” the money that way does not reverse the original transaction. It sends your own funds to the scammer. When the bank later identifies the initial deposit as fraudulent, it reverses that deposit too, and you are out what you paid back. Do not send money to anyone who contacts you about an unexpected deposit. Call your bank directly, explain what happened, and let the bank handle the reversal through the normal ACH return process. Keeping the funds is not an option either, because the fraudulent deposit will be reversed automatically once the originating bank flags the unauthorized transfer.

1
NACHA. NACHA ISO 20022 Credit Transaction Guide
2
ACH Guide for Developers. ACH File Details
3
Federal Reserve Financial Services. International ACH Transaction (IAT) Frequently Asked Questions
4
U.S. Department of the Treasury Bureau of the Fiscal Service. Trace Number
5
U.S. Department of the Treasury Bureau of the Fiscal Service. A Guide to Federal Government ACH Payments (Green Book)
6
Federal Reserve Financial Services. Written Statement of Unauthorized Debit Copy (WSUD)
7
Nacha. Risk Management Topics – October 1, 2024
8
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
9
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
10
Consumer Financial Protection Bureau. 1005.2 Definitions