Web Authorized Pmt Charge: Identify, Dispute, and Stop It

A “web authorized pmt” line on your bank statement is an electronic debit that someone pulled from your account using an authorization you gave through a website or mobile app. In ACH banking, “WEB” is the three-letter Standard Entry Class code for an Internet- or mobile-initiated payment, and “pmt” is just shorthand for payment.¹ These entries typically come from online bill pay, subscriptions, memberships, e-commerce checkouts, and recurring charges like rent or utilities. The transaction should carry a company name alongside the descriptor, though it may be truncated or show a parent company or payment processor rather than the brand you remember dealing with.

What the Descriptor Is Telling You

The WEB code is defined by Nacha, which governs the ACH network.² For a company to debit your account this way, Nacha’s rules require authorization that is “in writing and signed, or similarly authenticated” — which in practice is the “I agree” button or checkbox you clicked on a payment screen. That authorization has to spell out the amount (or how a variable amount is calculated), the date or frequency, your account details, and how to revoke it.³

Banks don’t format these entries the same way. One institution may show “WEB” prominently; another folds the SEC code into a longer string with the company name and a short entry description.⁴ That’s why the same subscription can look different across your checking account and a friend’s.

How to Figure Out Who Charged You

Start inside your online banking portal. Click the transaction itself; the detail view usually shows more than the summary line, including the originating company name, an ACH trace number, and sometimes a company ID.⁵

If the name is cut off or looks like a corporate parent you don’t recognize, search it along with the exact dollar amount. A charge that repeats at the same amount each month is almost always a subscription or membership. Check your email around the posting date for a receipt or renewal notice.

If nothing matches, call your bank. The bank can see the full ACH record, including the originator’s identification number and trace ID, and can tell you who initiated the debit.⁵

If You Recognize the Charge but Want It to Stop

For a subscription, autopay, or membership you no longer want, contact the company directly to cancel the authorization. The Consumer Financial Protection Bureau recommends doing this by phone and in writing so you have a record.⁶ Canceling the payment is not the same as canceling the underlying contract or debt. If you still owe money, you need to pay another way.

Then tell your bank you’ve revoked the authorization. Your bank can place a stop payment order to block future debits from that company, usually for a fee. The CFPB publishes free sample letters for notifying both the company and your bank.⁶ Submit a stop payment request at least three business days before the next scheduled debit so it takes effect in time.

If You Didn’t Authorize the Charge

If you did not approve the transaction, or the amount, date, or frequency doesn’t match what you agreed to, notify your bank right away. Under the Electronic Fund Transfer Act and Regulation E, the bank must investigate, and the process is the same whether the entry was a WEB debit or any other electronic transfer.⁷

The bank may ask you to complete a Written Statement of Unauthorized Debit describing the transaction. It does not need to be notarized. Inside the ACH system, the debit gets returned to the originator with a code: R10 if you don’t recognize the company at all, R11 if you have a relationship with the company but the charge doesn’t match what you authorized — wrong amount, wrong date, or a charge after you canceled.⁸

How Fast You Report Controls How Much You Can Lose

Your liability for unauthorized electronic debits depends on timing:

Report within two business days of learning of the loss or theft, and your liability is capped at $50 or the amount of unauthorized transfers before you gave notice, whichever is less.⁹
Report after two business days but within 60 days of the statement, and your liability can climb to $500.¹⁰
Report after 60 days, and you could be on the hook for the full amount of unauthorized transfers that happened after that window closed, if the bank can show earlier notice would have prevented them.⁹

If the charge is unauthorized because your information was stolen in a phishing scam or data breach, these protections still apply. Regulation E does not let a bank deny your claim or raise your liability on the ground that you were careless, such as by falling for a scam or writing down a PIN.¹¹

How Long the Bank Has to Resolve It

Once you report the error, your bank generally has 10 business days to investigate, or 20 if the account has been open less than 30 days. If it needs more time, it must provisionally credit your account for the disputed amount (minus up to $50) while it finishes. Final resolution has to come within 45 days, or 90 days for foreign transactions, new accounts, or point-of-sale purchases.¹² A bank cannot require you to file a police report or contact the merchant before it will investigate.¹¹

If the Charge Was on a Credit Card Instead

Different rules apply if the unfamiliar charge hit a credit card rather than a bank account. Under the Fair Credit Billing Act and the Truth in Lending Act, your liability for unauthorized credit card charges is capped at $50, and many issuers go further with zero-liability policies. To dispute a billing error, send a written notice to the issuer’s billing inquiry address within 60 days of the statement date. The issuer must acknowledge the dispute within 30 days and resolve it within 90, and you can withhold payment on the disputed amount during the investigation without being reported as delinquent.¹³

Where to Escalate

If a company keeps charging after you revoked authorization, or your bank isn’t following the dispute timelines above, you can take it to a federal regulator. The CFPB accepts complaints about bank accounts and electronic transfers at consumerfinance.gov/complaint, and companies generally respond within 15 days.¹⁴ For deceptive billing by a merchant, the FTC takes reports at reportfraud.ftc.gov. If the charge looks like identity theft, IdentityTheft.gov walks you through a recovery plan.¹⁵

1
Modern Treasury. SEC Codes
2
Modern Treasury. WEB SEC Code
3
Nacha. WEB Proof of Authorization Industry Practices
4
Modern Treasury. Bank Statements Descriptors and How Do You Change Them
5
Helcim. How to Trace an ACH Transaction
6
Consumer Financial Protection Bureau. How Do I Stop Automatic Payments From My Bank Account
7
Consumer Financial Protection Bureau. Regulation E Section 1005.11
8
Nacha. Differentiating Unauthorized Return Reasons
9
Consumer Financial Protection Bureau. Regulation E Section 1005.6
10
FDIC. Are You a Victim of a Payment Card Fraud
11
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
12
Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction
13
Federal Trade Commission. Using Credit Cards and Disputing Charges
14
Consumer Financial Protection Bureau. Submit a Complaint
15
Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud