To verify an eCheck, the merchant or its payment processor confirms that the bank account you entered is real, currently open, and able to receive an ACH debit, using one of three methods: a real-time database query, a micro-deposit test, or an instant login to your online banking. The check happens before any money moves, and under Nacha’s WEB Debit Account Validation Rule it is mandatory for consumer payments initiated over the internet.1Nacha. Supplementing Fraud Detection Standards for WEB Debits
What Gets Checked, and What You Hand Over
An eCheck payment asks you for four things: your full name as it appears on bank records, the nine-digit routing number on the left side of a paper check, the account number in the center, and whether the account is checking or savings. That is everything a merchant needs to pull funds from your account through the ACH network.
Verification is a separate step from the payment itself. Nacha requires a business pulling money from a consumer’s account over the internet to validate the account number before the first transaction, and again any time the account number changes. The validation has to use a commercially reasonable method that confirms the account is legitimate, open, and capable of receiving ACH entries. Nacha lists micro-deposits, prenotes, third-party validation services, and API-based verification as qualifying methods, and lets merchants weigh transaction risk, their return history, and other fraud controls when picking one.1Nacha. Supplementing Fraud Detection Standards for WEB Debits
One boundary worth knowing. The account validation rule targets consumer WEB debits. Business-to-business eChecks run on different ACH entry codes (CCD or CTX) and are not covered by this specific requirement, though other Nacha rules apply.
The Three Methods You’ll Encounter at Checkout
Which method a merchant uses determines how long you wait and how many extra steps you take.
Database Query
Real-time verification services query nationwide banking databases maintained by companies such as Early Warning Services, which collects activity data from thousands of financial institutions.2Early Warning. Consumer Report When the merchant submits your routing and account number, the service reports back within seconds whether the account is open, has a history of returned items, or carries fraud flags. From your side, there is no extra step beyond entering your account details. The payment either goes through or is declined on the spot.
Micro-Deposits
The micro-deposit method sends two small credits, each under $1.00, into your bank account. You log in to your bank, find those two amounts, and type them back into the merchant’s site to prove you control the account. Nacha calls these “micro-entries” and requires the statement descriptor to read “ACCTVERIFY” so you can spot them.3Nacha. Micro-Entries Phase 1 Any offsetting debits must be sent at the same time and cannot exceed the total of the credits, so you never lose money in the process. The trade-off is time: the deposits take one to two business days to land, and your payment waits until you confirm them.
Instant Account Verification
Services such as Plaid open a window inside the merchant’s checkout where you log in to your bank directly. The system reads your account and routing numbers from the bank, confirms the name on the account matches yours, and can check available balance.4Plaid. Auth – Instant Bank Account Verification API You never type an account number. Most modern payment platforms prefer this method because it proves account ownership instantly, which micro-deposits also do but with a two-day delay.
Why Verification or the Payment Itself Can Fail
When something goes wrong, the ACH network reports the problem through standardized return reason codes. The merchant sees the code; you usually just see a declined payment or a reversed charge. The codes fall into two groups.
Account-data problems:
- R01 Insufficient Funds — the account exists but doesn’t hold enough to cover the debit.
- R02 Account Closed — the account was valid at some point but has since been closed.
- R03 No Account — the bank cannot locate any account matching the number.
- R04 Invalid Account Number — the number format is wrong, so the bank can’t even search for it.
Nacha groups R02, R03, and R04 as “administrative” returns, and a merchant whose administrative return rate exceeds 3% faces enforcement action.5Nacha. ACH Network Risk and Enforcement Topics That penalty is why merchants invest in upfront verification rather than letting bad account data surface later.
Authorization problems:
- R07 Authorization Revoked — you previously authorized the merchant to debit the account and have since pulled that permission. The return must be submitted within 60 days of the settlement date.
- R10 Not Authorized — you tell your bank you don’t recognize the company or never gave permission for the charge.6Nacha. Differentiating Unauthorized Return Reasons
A stop-payment order on your account can also block an incoming debit. Under the Uniform Commercial Code, a stop-payment order stays effective for six months, and an oral order lapses after 14 days unless you confirm it in writing.7Legal Information Institute. Uniform Commercial Code 4-403 – Customer’s Right to Stop Payment; Burden of Proof of Loss Accounts frozen by court order or legal action will also reject debits, though the specific return code depends on the bank’s reason.
What to Do If an Unauthorized eCheck Hits Your Account
Verification is meant to stop bad transactions before they happen. When one slips through anyway, federal Regulation E, which implements the Electronic Fund Transfer Act, sets the rules for how fast you have to act and what your bank must do.
Your Liability Depends on How Fast You Report
Report an unauthorized electronic transfer within two business days of learning about it, and your maximum liability is $50. Wait longer than two business days but report within 60 days of the statement that shows the charge, and your exposure rises to $500. Miss the 60-day window and you can be liable for the full amount of any unauthorized transfers that occur after it closes.8eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The clock runs from when the statement is sent, not from when you read it, so skipping statements is expensive.
Error Resolution and Provisional Credit
Once you notify the bank of an unauthorized eCheck or any account error, the bank must investigate within 10 business days. If it needs more time, it can take up to 45 days total, but it must provisionally credit your account within those first 10 business days so you aren’t left without the money.9eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors The bank may hold back up to $50 of the provisional credit if it has a reasonable basis to believe an unauthorized transfer actually happened. When the investigation ends, the bank has one business day to correct any confirmed error and three business days to tell you the result.
Stopping Future Debits
If you authorized a company to pull recurring eCheck payments and want them to stop, contact your bank at least three business days before the next scheduled debit. The order can be oral or written, but the bank may require written confirmation within 14 days, and an unconfirmed oral order lapses.10Consumer Financial Protection Bureau. Regulation E 1005.10 – Preauthorized Transfers Once you revoke a company’s authorization altogether, your bank is required to block all future debits from that company. It cannot simply wait for the merchant to stop sending them.