TEL SEC Code: Oral Authorization, Returns, and Recordkeeping

The TEL SEC code is the NACHA Standard Entry Class classification for ACH debits authorized orally by a consumer over the telephone. It applies only to consumer bank accounts, never to business-to-business transfers, and because the consumer never signs anything, TEL entries carry stricter eligibility, disclosure, verification, and record-keeping rules than most other SEC codes. Get any of those pieces wrong and you face forced reversals, ODFI monitoring inquiries, and fines that scale into six figures for the worst violations.

When You Can Originate a TEL Entry

NACHA permits TEL entries in only two situations: the merchant already has an existing relationship with the consumer, or the consumer initiates the call.¹

An existing relationship means either a written agreement between the parties or a purchase of goods or services by the consumer from the merchant within the preceding two years. If neither is true, the consumer has to be the one who dialed. Outbound cold calls to collect banking information for ACH debits are prohibited.

This trips up merchants who call a customer to upsell and take payment on the same call. Without a qualifying prior relationship, that transaction cannot be a valid TEL entry.

What the Oral Authorization Must Include

A valid TEL authorization is not a casual verbal “yes.” The representative has to walk the consumer through a defined set of disclosures and secure clear consent. The authorization must state:

The consumer’s name.
The exact transaction amount.
The date on or after which the account will be debited.
A contact phone number the consumer can call during normal business hours.
The date of the oral authorization.
An explicit statement that the authorization will be used to originate an ACH debit against the consumer’s account.

Routing and account numbers still have to be captured, but those are operational, not disclosure items. Missing any single required disclosure can invalidate the authorization and leave the merchant exposed to a forced return.

Recurring TEL Entries

If the debit is not a one-time charge, the authorization also has to spell out the frequency of payments, the start and end dates, and the total number of debits.² Recurring TEL entries are subject to Regulation E’s preauthorized transfer rules, which means the consumer must receive a copy of the authorization.³ Merchants often capture a good recording but never send the written confirmation, which violates federal law even when the NACHA piece is clean.

Verifying and Preserving the Authorization

Saying the right words is only half the requirement. NACHA requires the merchant to preserve the authorization in one of two ways:

A complete audio recording of the consumer’s authorization capturing every required disclosure and the consumer’s affirmative consent.
A written notice sent to the consumer before settlement that summarizes all authorization details and explains how to cancel. It can go by mail or email.

For a single entry, either method works on its own. For recurring entries, the merchant must record the authorization and also send a copy to satisfy Regulation E.² Recording is generally the safer default because it creates unambiguous evidence. A written notice that reaches the consumer even a day after settlement fails the requirement.

TEL vs. WEB

The most common classification mistake is confusing TEL with WEB. TEL covers authorizations given orally over a phone call. WEB covers authorizations captured through the internet or a mobile device.⁴ A consumer tapping “authorize” in a mobile app is a WEB entry, even though the device is a phone.

WEB entries rely on a written authorization “similarly authenticated” electronically — the consumer sees the terms on a screen and affirmatively agrees. TEL entries have no screen, so that path is unavailable; everything must happen verbally. Coding a WEB transaction as TEL or vice versa creates an authorization defect that can trigger forced returns and monitoring flags.

Processing Basics

After verification, the merchant formats the entry into an ACH file and submits it to its Originating Depository Financial Institution, which transmits it to the ACH Network. TEL entries do not permit addenda records, so any supplemental information has to move outside the ACH file.⁴

Return Codes TEL Originators Should Know

Because no signature exists, TEL entries are particularly exposed to unauthorized-return codes. The ones that matter most:

R07 — Authorization Revoked. The consumer previously authorized the debit but has since revoked that authorization.⁵
R10 — Customer Advises Not Authorized. The consumer says they never authorized the debit at all. This is the more serious code, because it signals no valid authorization existed.
R01 — Insufficient Funds. Not an authorization problem, but it still counts toward overall return metrics.
R05, R11, R29, and R51 — additional codes that feed the unauthorized return rate calculation. R29 concerns corporate accounts and would not normally hit a TEL entry, but R05 and R11 can.⁶

The practical line between R07 and R10 is who has the burden. R07 means the merchant had a valid authorization the consumer later cancelled. R10 puts the burden on the merchant to produce proof or accept the reversal.

Return Rate Thresholds

NACHA monitors three separate return rates, each measured over the preceding 60 calendar days of originated debits. Exceeding any one of them triggers an ODFI-conducted inquiry:

Overall return rate: 15.0%, covering all reason codes.⁷
Administrative return rate: 3.0%, covering R02, R03, and R04.
Unauthorized return rate: 0.5%, covering R05, R07, R10, R11, R29, and R51.⁶

The 0.5% unauthorized threshold is the one that catches TEL-heavy merchants. On 10,000 debits over 60 days, only 50 unauthorized returns will trigger a review. TEL transactions, resting entirely on verbal consent, tend to generate unauthorized returns at a higher rate than WEB or PPD. A merchant that consistently exceeds any threshold risks losing ACH origination privileges.

Consumer Stop-Payment and Unauthorized Transfer Rights

Consumers have strong protections against telephone-authorized debits, and merchants need to build processes around those rights.

Stopping a Preauthorized Transfer

Under Regulation E, a consumer can stop any preauthorized electronic fund transfer by notifying their bank at least three business days before the scheduled debit date. The notice can be oral or written, but the bank may require written confirmation within 14 days of an oral stop-payment request; if the consumer does not follow up in writing, the oral order expires.⁸ The merchant’s authorization agreement must describe how the consumer can revoke, and omitting revocation instructions can invalidate the agreement.

Unauthorized Transfer Liability

A consumer who reports an unauthorized debit within two business days of learning about it faces liability capped at $50. Past that window, liability can rise to $500. If the consumer fails to report an unauthorized transfer that appears on a periodic statement within 60 days of the statement being sent, they can be liable for the full amount of any further unauthorized transfers occurring after that 60-day window.⁹

The CFPB has stated that a financial institution cannot factor consumer negligence into liability for unauthorized transfers. Even if a consumer was tricked into disclosing account information by phone, the transfer is still unauthorized and Regulation E protections still apply. Account agreements that try to waive those protections violate the Electronic Fund Transfer Act.¹⁰

Record Retention and Proof Requests

Proof of authorization must be kept for every TEL entry. For single entries, the recording or written notice has to be retained for two years from the date of the authorization.² For recurring entries, the two-year clock does not start until the authorization is terminated or revoked, which can extend the obligation significantly for long-running arrangements.

When an RDFI questions an entry and requests proof, the ODFI has 10 banking days to produce the proof or agree to accept a return. If the ODFI agrees to accept the return, the RDFI then has 10 banking days to make it. A merchant who cannot quickly locate authorization records will almost certainly eat the reversal, and chronic failures can push the ODFI to terminate the relationship.

Federal Rules That Overlap With NACHA

NACHA’s rules are not the only ones in play. Two federal frameworks apply on top, and satisfying NACHA alone is not enough.

The Telemarketing Sales Rule

The FTC’s Telemarketing Sales Rule requires “express verifiable authorization” for any payment resulting from a telemarketing call. For oral authorizations, the TSR requires an audio recording that clearly shows the consumer authorized the payment and received disclosures about the goods or services, the number and dates of the charges, the amounts, the consumer’s name and billing information, a contact phone number, and the date of authorization. The alternative is a first-class-mail written confirmation sent before the charge is submitted, clearly identified on the envelope, with a statement of refund procedures.¹¹

The TSR mostly parallels NACHA but adds elements NACHA does not explicitly require, including a description of the goods or services and a refund procedure on the written confirmation. A merchant that passes the NACHA checklist while ignoring the TSR can still face FTC enforcement.

Regulation E

Regulation E, administered by the CFPB, governs electronic fund transfers from consumer accounts. Preauthorized recurring transfers must be authorized in writing or through a similarly authenticated method, and the consumer must receive a copy of the authorization. Regulation E carves out single telephone-initiated transfers from the “electronic fund transfer” definition, so a genuinely one-time phone payment does not carry Regulation E’s full authorization weight.³ Recurring TEL entries do not get that exclusion. They are fully subject to Regulation E, including its error resolution and stop-payment provisions.

Enforcement and Penalties

NACHA sorts rule violations into three tiers. A Class 1 violation, the starting point for most infractions, can draw fines of up to $1,000 for a first occurrence, $2,500 for a second recurrence, and $5,000 for a third. Persistent problems escalate to Class 2, where the ACH Rules Enforcement Panel can impose fines of up to $100,000 per month until resolved. A Class 3 violation, reserved for egregious or willful conduct involving at least 500 entries or $500,000 in aggregate, carries fines of up to $500,000 per occurrence and can include a directive to the ODFI to suspend the originator entirely.¹² NACHA can also report Class 3 violations to ACH Operators and industry regulators.

For most merchants, the more immediate consequence is not a formal NACHA fine but an ODFI cutting off ACH access after repeated return-rate breaches. Banks have their own risk tolerances and often act well before NACHA’s process runs its course.

2026 Rule Changes Worth Watching

Several NACHA changes taking effect in 2026 touch TEL originators, though none rewrites the TEL authorization requirements themselves.¹³

Fraud Monitoring Phase 1, effective March 20, 2026, requires ACH participants to implement fraud monitoring practices as part of a broader package aimed at reducing fraud and improving recovery.
Also on March 20, 2026, two additional standardized Company Entry Description values become mandatory, giving receiving banks and consumers better visibility into ACH entries.
Fraud Monitoring Phase 2 takes effect June 22, 2026, expanding on the March obligations.

The fraud monitoring rules deserve the most attention from TEL originators. Merchants with borderline return rates or thin authorization practices should expect more scrutiny from their ODFIs as those monitoring duties expand.

1
Nacha. Voice Payments Guide to Nacha Operating Rules
2
Nacha. Nacha Operating Rules – Meaningful Modernization
3
eCFR. Electronic Fund Transfers (Regulation E)
4
Nacha. ACH File Details – ACH Guide for Developers
5
Nacha. Differentiating Unauthorized Return Reasons
6
Nacha. How to Calculate Unauthorized Return Rate
7
Nacha. Calculate Admin or Overall Return Rate
8
eCFR. 12 CFR 1005.10 – Preauthorized Transfers
9
eCFR. Liability of Consumer for Unauthorized Transfers
10
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
11
eCFR. 16 CFR Part 310 – Telemarketing Sales Rule
12
Nacha. Reversals and Enforcement
13
Nacha. Nacha Operating Rules – New Rules