How to Find Out Where an ACH Payment Came From

To find out where an ACH payment came from, start with three data points: the descriptor text on your statement, the 10-digit company identification number attached to the transaction, and the 15-digit trace number. The descriptor and company ID often surface the sender through a plain search. The trace number’s first eight digits are the routing number of the bank that originated the transfer, which gives you a direct line back to the sender’s financial institution. Your banking app shows only part of this; the rest sits in the full ACH record, which your bank can pull for you.

Start With the Descriptor and Company ID in Your Banking App

Open the transaction in your bank’s portal or app and read the company name field carefully. ACH files cap that field at 16 characters, so what you see is often a truncated or abbreviated version of the real business name. The text comes from the company that initiated the transfer, not from your bank, which is why it sometimes looks like an internal accounting label rather than something recognizable.

Look for a 10-digit number in the transaction details. That’s the company identification number, a unique identifier assigned to the entity that originated the transfer.¹ Copy the descriptor text and the company ID, then search for both together. Other people receiving payments from the same originator often post about them in forums and Q&A threads, and the originator’s own website may reference the descriptor it uses on statements.

If the descriptor names a payment processor like STRIPE or PAYPAL instead of a merchant, you’re looking at the intermediary that handled the transfer. The company ID still helps because processors assign a unique ID to each merchant they serve, and the ID is often more identifiable than the generic processor name.

Check Whether It’s a Credit or a Debit

Before going further, confirm which direction the money moved. An ACH credit means someone pushed money into your account, like a payroll deposit, benefit payment, or refund. An ACH debit means someone pulled money out, like a subscription or loan payment collecting what you owe.

For a credit, the originator is whoever sent you money. For a debit, the originator is a company that requested money from your account, which implies someone authorized them to do so at some point. The distinction matters for your investigation and for your rights: unauthorized debits are where the real financial risk sits, and the reporting deadlines below only matter if money left your account without your permission.

Ask Your Bank for the Full ACH Record

The customer-facing view of a transaction is a simplified summary. The actual ACH file contains several records with far more detail. A phone call to your bank asking for the full ACH data on a specific transaction will get you further than any amount of clicking in the app.

Ask for the following:

The full Company Name and Company ID from the batch header record. The name may be longer or formatted differently than what your app displayed.²
The Originating Depository Financial Institution, meaning the bank where the sender initiated the transfer. The ODFI has a direct relationship with the sender, so identifying it narrows the field considerably.¹
The Company Entry Description, a short field in the batch header (something like “GAS BILL” or “SALARY”) chosen by the originator when the transfer was set up.²
The Trace Number, a 15-digit identifier unique to the transaction.

Banks keep ACH records for several years. How far back they’ll dig without a fee varies, and some charge a research fee that isn’t standardized. If you’re reporting an unauthorized transaction, most banks waive the fee as part of the dispute process.

Use the Trace Number to Find the Sending Bank

Every ACH transaction carries a 15-digit trace number assigned by the originating bank, and the structure is predictable. The first eight digits are the routing number of the financial institution that processed the transfer on the sender’s behalf. The remaining seven digits identify the specific transaction within its batch.

Enter those first eight digits into any public routing number lookup. You’ll get the name, location, and contact information for the originating bank. That bank has a direct business relationship with whoever sent or pulled the money, which makes it a concrete lead even when the descriptor and company ID don’t resolve the sender on their own. The originating bank won’t hand over the sender’s personal information to you, but if you’re disputing an unauthorized debit, your bank can use the trace number to communicate with it through the ACH network’s formal return process.

Read the SEC Code to See How the Payment Was Authorized

Each ACH transaction carries a three-letter Standard Entry Class code describing how the payment was authorized and whether it’s a consumer or business transaction. The code narrows your investigation because it tells you where to look for the authorization.

Consumer Codes

PPD (Prearranged Payment and Deposit): The most common consumer code. Payroll direct deposits, mortgage autopay, and utility bill payments typically use PPD. Authorization was given in writing.¹
WEB (Internet-Initiated Entry): Payment was authorized through a website or mobile app. Online subscription signups show up as WEB.¹
TEL (Telephone-Initiated Entry): Authorization was given over the phone. For single transactions, the call must be recorded or written confirmation sent afterward.¹

Business and Check-Conversion Codes

CCD (Corporate Credit or Debit): Business-to-business payments. On a personal account, this is worth investigating.
ARC (Accounts Receivable Entry): A paper check you mailed was converted into an electronic payment and the original check destroyed.¹
BOC (Back Office Conversion): A check handed over in person and converted electronically after the fact.
POP (Point of Purchase): A check written at a retail location and converted on the spot.

Each code points to a different place to look. WEB means you probably authorized something online, so checking email for subscription confirmations is a logical next step. TEL means a phone call, so your call history may surface the match. ARC, BOC, or POP means a paper check you wrote was converted, and the originator should match whoever you wrote the check to.

If the Payment Was Unauthorized, the Clock Is Already Running

Once you’ve identified the transaction as something you didn’t authorize, your federal protections depend on how quickly you report it. Under Regulation E, the liability tiers are hard cutoffs.

Within 2 business days of learning of the unauthorized transfer: Your maximum liability is $50.³
After 2 business days but within 60 days of the statement date: Liability caps at $500.³
After 60 days from the statement date: You can be held liable for the full amount of any unauthorized transfers occurring after that 60-day window. There is no cap.³

A small mystery debit of $30 looks minor and gets ignored. Then it recurs. By the time anyone notices, several months have passed and the 60-day window has closed on the earlier charges. Review statements the day they arrive.

How to Dispute the Charge and Stop Future Ones

Contact your bank as soon as you’ve identified a transaction as unauthorized. Oral notice is enough to start the process, though your bank may ask you to follow up in writing within 10 business days.⁴ Many banks call that follow-up a Written Statement of Unauthorized Debit or an ACH dispute form. Include your name, account number, the date and amount of the transaction, and why you believe it was unauthorized.

The bank has 10 business days to investigate and tell you what it found. It can extend the investigation to 45 days, but only if it provisionally credits your account within those first 10 business days and gives you full access to the funds while it continues looking.⁴ If the bank concludes no error occurred, it has to explain in writing and provide the documents it relied on if you ask. You can escalate by filing a complaint with the Consumer Financial Protection Bureau.

Stop Payment Orders

Once you know who’s pulling the money, you can place a stop payment order with your bank to block future debits. The order must reach the bank at least three business days before the next scheduled payment.⁵ Most banks charge a fee, and the order typically expires after six months, so you may need to renew it or close the account if charges keep coming. Also revoke your authorization directly with the originator in writing.

Business Accounts Follow Different Rules

The liability caps, provisional credits, and error resolution timelines described above apply to consumer accounts. Business ACH transfers are governed by UCC Article 4A instead of the Electronic Fund Transfer Act, and Article 4A is less protective.⁶ A business has up to 90 days to report an unauthorized transfer and preserve its right to a refund, but the bank can shift liability to the business if it shows the transfer passed through a commercially reasonable security procedure. There are no $50 or $500 caps. Business account holders dealing with suspicious ACH activity should involve their bank’s commercial fraud team, and potentially legal counsel, right away.

1
ACH Guide for Developers. ACH File Details
2
ACH Guide for Developers. ACH File Overview
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
5
Consumer Financial Protection Bureau. How Can I Stop a Payday Lender From Electronically Taking Money Out of My Bank Account
6
Legal Information Institute. UCC Article 4A – Funds Transfer