How to Set Up Electronic Funds Transfer: Authorization, Verification, Rights

To set up an electronic funds transfer, you give the paying or billing party three things: your bank’s nine-digit routing number, your account number, and a signed authorization that lets them move money into or out of your account. Most people finish the paperwork in under 15 minutes. The connection itself usually takes a few business days to verify before the first real transfer lands.

What You Need Before You Start

Every EFT setup rests on two numbers. The routing number identifies your bank and has nine digits. The account number identifies your specific account at that bank. On a paper check, the routing number sits at the bottom left and the account number sits immediately to its right. If you don’t keep checks around, log into your bank’s website or app and look under account details or direct deposit setup. Both numbers are listed there.

You also have to tell the requesting party whether the account is checking or savings. The ACH network uses different transaction codes for each type, and the wrong selection can cause the transfer to bounce back.

Voided Check or Bank Verification Letter

Employers and billers typically ask for a voided check attached to the authorization form. Writing “VOID” across a blank check gives them a document that already shows the routing number, account number, and account holder name, which cuts down on data-entry mistakes. If you don’t have checks, ask your bank for a direct deposit verification letter. It’s a letter on bank letterhead confirming the account and listing the two numbers. Most banks can produce one through online banking or in a branch.

Keep the Numbers Private

Anyone who has your routing and account numbers can try to initiate a debit against your account. Share them only with trusted employers, billers, and financial institutions, and only through secure channels. Federal regulations require financial institutions to encrypt customer information in transit and at rest.¹ That rule governs the institution, not the person emailing you a PDF. Don’t send account numbers through unencrypted email, and treat a request to do so as a warning sign.

Fill Out and Sign the Authorization Form

The authorization form is what legally allows the other party to move money. Employers hand these out through HR portals or onboarding packets. Billers and service providers usually keep them inside their online payment settings. Your bank may also publish a standardized direct deposit form.

Enter the routing and account numbers carefully, digit by digit. A single transposed number can send money to the wrong account, and getting it back is not guaranteed. The Uniform Commercial Code lets a bank try to recover funds sent on an erroneous payment order, but the process depends on cooperation from the unintended recipient and the law of restitution.² In practice, recovery ranges from slow to impossible. Match the account holder name on the form exactly to what your bank has on file, because the ACH network validates that information and mismatches cause delays or rejections.

One-Time Versus Recurring Transfers

The authorization standard depends on whether the transfer is a single event or an ongoing arrangement. A recurring preauthorized transfer out of your account requires your written or electronically signed authorization, and the company must give you a copy.³ The standard for one-time debits is lower, and notice before the transfer is often enough. Hold onto any recurring-payment authorization you sign. It’s your proof of what you agreed to, and you’ll need it to dispute or cancel the arrangement later.

Electronic Signatures Count

You don’t have to print and mail paper. Under the E-Sign Act, an electronic signature carries the same legal weight as ink on paper.⁴ Regulation E recognizes digital signatures and security codes as valid ways to authorize a preauthorized transfer.⁵ Completing an online authorization portal is just as binding as a paper form.

Submit the Form and Let It Verify

Submit the completed form through whatever channel the organization provides. Employers usually accept uploads through an HR portal. Billers often let you enter the information directly in their payment settings. If a physical submission is required, mail or hand-deliver the form with the voided check or verification letter. Don’t fax account numbers unless you’re confident the receiving fax is secure.

The Pre-Note

Many organizations send a pre-notification, or pre-note, before moving any real money. A pre-note is a $0.00 test transaction sent through the ACH network to confirm your routing and account numbers are valid and the account can receive transfers. Under the ACH network’s operating rules, the sender has to wait at least three banking days after a successful pre-note before initiating a live transfer. In practice, full setup often takes one to two pay cycles or billing periods, because payroll and billing systems batch their processing. Watch your statement during this window. If the pre-note doesn’t settle within about a week, contact the organization to confirm they received your paperwork.

Micro-Deposits

Some fintech apps and online payment services verify your account differently. Instead of a $0.00 pre-note, they deposit two small amounts, often just a few cents each, into your account. You then log back in and confirm the exact amounts to prove you have access. Micro-deposits usually appear within one to three business days. Most platforms give you a limited number of attempts before locking the verification process, so enter the amounts promptly.

If the Numbers Were Wrong

If the numbers don’t correspond to any real account, the ACH network returns the transaction with an error code, and you’ll need to resubmit with corrections. The worse case is when a transposed digit happens to match someone else’s real account. The sending bank can try to recover the money under the UCC’s erroneous payment order rules, but recovery depends on what happens at the receiving end.² This is the reason pre-notes exist and the reason organizations ask for a voided check. Take the verification step seriously.

Your Rights Once the EFT Is Live

The Electronic Fund Transfer Act and Regulation E give consumers automatic protections that cover most EFTs, including direct deposits, recurring bill payments, debit card transactions, and ATM transfers. Financial institutions must provide written disclosures about your rights, transfer timing, and how to report errors.⁶ You don’t need to opt in.

Liability for Unauthorized Transfers

If someone makes an unauthorized transfer from your account, speed decides what you lose. Notify your bank within two business days of learning about the problem, and your maximum loss is $50. Miss that window and the cap rises to $500. Let unauthorized transfers appear on your statement for more than 60 days without reporting them, and you can lose everything taken after that 60-day period.⁷ Review statements regularly and report anything suspicious immediately.

Error Resolution

If you spot an error, whether it’s a wrong amount, a duplicate charge, or an unauthorized transfer, you have 60 days from the date your bank sent the statement to report it.⁸ Your notice should include your name, account number, a description of the error, and the amount. You can report by phone or in writing.

The bank has 10 business days to investigate and resolve the issue once it receives your report. It can extend the investigation to 45 days, but only if it provisionally credits your account within those first 10 business days.⁹ You get full use of the provisional credit while the investigation runs. If the bank concludes no error occurred, it can reverse the credit, but it must give you five business days’ notice and honor any payments you’ve already scheduled during that window. One trap: if the bank asks for written confirmation of an oral report and you don’t provide it within 10 days, the bank isn’t required to post the provisional credit. Follow up a phone call with written confirmation the same day.

Stopping or Canceling a Recurring Transfer

You can stop a preauthorized recurring transfer by notifying your bank at least three business days before the next scheduled payment.³ You can do this by phone or in writing. If you call, your bank may require written confirmation within 14 days; without that follow-up, the stop-payment order expires and the bank can let the next debit through.¹⁰

Stopping one payment and revoking the whole authorization are different actions. To cancel a recurring arrangement for good, notify both your bank and the company debiting your account. Tell the bank in writing that the authorization is no longer valid, and the bank must then block all future debits from that payee. Tell the company directly so they stop submitting charges. If charges keep coming after you’ve revoked authorization, those are treated as unauthorized transfers, which brings the liability protections back into play. Most banks charge a stop-payment fee, often $15 to $36 depending on the institution and whether you file the request online or in person.

Variable-Amount Transfers

If you’ve authorized a recurring debit that changes in amount from one period to the next, federal law requires the company or your bank to notify you at least 10 days before each transfer with the amount and date.⁶ Utility bills and variable-rate loan payments are common examples. If the notice doesn’t arrive and the charge is far from what you expected, that can anchor an error dispute.

Business Accounts Are a Different Rulebook

The liability caps, error-resolution timelines, and stop-payment rights above apply only to consumer accounts, meaning accounts established primarily for personal, family, or household purposes.¹¹ Regulation E does not apply to business accounts. The setup mechanics are the same (routing number, account number, authorization), but your protections after setup come from your bank’s commercial account agreement rather than federal consumer law. If you’re setting up EFT for a business, read those terms and consider internal controls such as dual authorization for outgoing transfers.

1
eCFR. 16 CFR Part 314 Standards for Safeguarding Customer Information
2
Legal Information Institute. Uniform Commercial Code 4A-205 Erroneous Payment Orders
3
Office of the Law Revision Counsel. 15 USC 1693e Preauthorized Transfers
4
Office of the Law Revision Counsel. 15 USC 7001 General Rule of Validity
5
eCFR. 12 CFR Part 1005 Electronic Fund Transfers (Regulation E)
6
eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E)
7
Office of the Law Revision Counsel. 15 USC 1693g Consumer Liability
8
Office of the Law Revision Counsel. 15 USC 1693f Error Resolution
9
eCFR. 12 CFR 1005.11 Procedures for Resolving Errors
10
eCFR. 12 CFR 1005.10 Preauthorized Transfers
11
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs