An “Internet PMT to CCD” line on your bank statement is an online payment your bank pushed through the Automated Clearing House network using the Corporate Credit or Debit (CCD) transaction format. In most cases it’s a bill payment or transfer you set up yourself through a bank website or app. The label looks like a fraud alert, but it almost never is one.
What the Label Is Telling You
“PMT” is just payment. “CCD” is Corporate Credit or Debit, one of the Standard Entry Class codes the ACH network uses to tag electronic transactions. “Internet” means the payment was initiated online rather than on paper or in a branch. Put those pieces together and the entry describes an electronic payment submitted through a web portal or banking app and routed through ACH with the CCD classification.
Nacha, which writes the rules for the ACH network, defines CCD as a credit or debit originated to a corporate account, typically used to pay vendors, concentrate funds, or fund disbursement accounts.1ACH Guide for Developers. ACH File Details
Why a Corporate Code Appears on a Personal Account
This is the part that trips people up. CCD is a corporate-to-corporate format. The code built for corporate-to-consumer transfers like direct deposit and recurring bill pay is PPD.1ACH Guide for Developers. ACH File Details So why would CCD show up on your personal checking?
The usual reason is your bank’s own online bill-pay system. When you tell your bank to pay a credit card, utility, or loan, the bank picks the SEC code, and many banks route those outgoing payments as CCD entries because the bank itself is acting as the corporate originator on your behalf. The money still leaves your personal account, but the ACH entry carries a corporate tag.
Less often, a smaller company or payment processor debits a consumer account using CCD when it should have used PPD. That’s a miscoding, and it gives you an extra return option discussed below.
Tracking Down the Source
Start with the date and the exact amount, cents included. Tap or click the entry in your banking app; the expanded view often shows a truncated company name next to the CCD label, which is usually enough to recognize a payment you scheduled.
If the expanded view isn’t enough, two identifiers can pin down the originator. The ACH trace number is a 15-digit code that uniquely identifies the transaction as it moved through the clearing house.2ACH Guide for Developers. ACH File Overview The Company Identification number, also called the Originator ID, is a 10-digit code assigned to the business that initiated the debit. Not every app shows these; your bank’s customer service can pull them.
Before calling, scan your own records. Check online bill-pay history, autopay confirmation emails, and recurring subscriptions. Mystery charges often turn out to be something the account holder set up months earlier and forgot.
If You Didn’t Authorize the Charge
On a personal account used primarily for household purposes, the Electronic Fund Transfer Act and Regulation E protect you against unauthorized electronic debits.3National Credit Union Administration. Electronic Fund Transfer Act (Regulation E) Your liability depends on how fast you report:
- Report within two business days of learning about it, and your maximum liability is $50 or the amount of the transfer, whichever is less.
- Report after two business days but within 60 days of the statement, and the cap rises to $500.
- Wait past the 60-day mark from the statement date, and you can be on the hook for the full amount of unauthorized transfers that happened after the window closed, if the bank shows it could have stopped them had you reported sooner.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The 60-day clock runs from the date the bank sends the statement showing the charge, not the day you notice it. That date drives everything else.
How the Dispute Plays Out
Call your bank’s dispute line and report the entry. The bank must start investigating right away. It may ask you to confirm in writing within 10 business days, but it cannot stall the investigation waiting for that letter. If the bank can’t finish within 10 business days, it must provisionally credit your account for the disputed amount and then has up to 45 calendar days from the date it received your notice to complete the review.5Consumer Financial Protection Bureau. Procedures for Resolving Errors That provisional credit stays unless the bank concludes the transfer was authorized.
The CCD-Specific Return: Code R05
Because CCD is a corporate code, a CCD debit landing on a consumer account is already miscategorized. The ACH system has a return code for exactly this situation: R05, “Unauthorized Debit to a Consumer Account Using Corporate SEC Code.” Your bank can return the entry under R05, and the deadline for doing so stretches to 60 calendar days after the entry’s settlement date, far longer than the next-business-day window that applies when CCD moves between business accounts.6Nacha. Differentiating Unauthorized Return Reasons When you call the bank, it’s worth mentioning that the debit used a corporate SEC code on your consumer account.
Stopping a Recurring Debit You Once Approved
If you authorized the payment originally but want it to stop, say you canceled a service and the company keeps pulling funds, you have two independent moves.
Revoke authorization with the company directly. Put it in writing and keep a copy. Then place a stop payment order with your bank. Regulation E requires the bank to honor a stop payment request made at least three business days before the next scheduled debit. You can give the order orally, but the bank can require written confirmation within 14 days.7Consumer Financial Protection Bureau. Comment for 1005.10 – Preauthorized Transfers Once the order is in place, the bank must keep blocking debits from that originator, including resubmissions.
Banks commonly charge a fee for stop payment orders. Amounts vary. Ask whether one order covers resubmissions by the same company or whether each attempt triggers a new fee.
Business Accounts Are a Different Story
Everything above applies to personal accounts used primarily for household purposes. If “Internet PMT to CCD” appears on a business checking account and the charge is unauthorized, the Regulation E protections do not apply. Federal law does not protect business debit transactions from unauthorized charges the way it protects consumer accounts.8FDIC. Will I Be Liable for Unauthorized Transactions Made on Business Credit/Debit Cards Business disputes run on your account agreement, state commercial law (generally UCC Article 4A), and industry practice. Return windows are shorter, provisional credit isn’t guaranteed, and if the bank followed commercially reasonable security procedures it may carry no liability at all. On a business account, report fast and read your agreement.