An EFT authorization form is a document you sign to give a specific person, employer, or agency legal permission to move money electronically into or out of your bank account. You’ll fill one out to set up direct deposit of a paycheck, arrange automatic bill payments, or receive federal benefits. The form is short, but the details on it carry real weight: banks route electronic transfers by account number rather than by name, so a single wrong digit can send your money to a stranger, and the federal protections that apply depend on how the form is used and how quickly you act if something goes wrong.1Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose
What the Form Contains
Most EFT authorization forms follow the same three-part layout. The top collects identifying information: full legal name, address, and contact details. The middle collects your banking data: the bank’s routing number, your account number, and whether the account is checking or savings. The bottom is the authorization statement, where your signature grants a named party permission to deposit into or withdraw from that account.2Centers for Medicare and Medicaid Services. CMS-588 Electronic Funds Transfer EFT Authorization Agreement
The signature line is more than a formality. Federal regulations require that recurring transfers from a consumer’s account be authorized in writing or through an equivalent electronic authentication, and the party collecting the form must give you a copy of what you signed.3eCFR. 12 CFR 1005.10 – Preauthorized Transfers Without that written authorization on file, a transfer is legally unauthorized, which gives you far stronger footing in any later dispute.
One-Time Versus Recurring Authorizations
A one-time authorization covers a single transfer and expires once the payment clears. A recurring authorization sets up ongoing transfers on a schedule, such as biweekly paycheck deposits or a monthly loan payment. Recurring transfers carry an extra rule: if the amount will change from one payment to the next, the company must notify you at least 10 days before the scheduled transfer with the new amount.3eCFR. 12 CFR 1005.10 – Preauthorized Transfers That matters for variable bills like utilities.
The Information You Need to Fill It Out
Two numbers do the heavy lifting on any EFT form. The routing number is a nine-digit code that identifies your bank, assigned by the American Bankers Association to every federally or state-chartered institution. On a paper check, it’s the leftmost number along the bottom, followed by your account number and then the check number.4American Bankers Association. ABA Routing Number If you don’t use paper checks, your bank’s app or website will list both in the account details. Many banks also generate a “direct deposit letter” that packages everything you need in one document.
You also have to specify whether the account is checking or savings. Selecting the wrong type can cause the deposit to bounce back.
Voided Checks and Alternatives
Many organizations ask for a voided check as backup verification. To void one, write “VOID” in large letters across the face without covering the numbers along the bottom. If you don’t have paper checks, most organizations accept a bank-issued letter on official letterhead confirming your name, routing number, and account number, or a screenshot from online banking showing the same details. Your branch can usually produce a verification letter on the spot.
Why the Account Number Matters More Than Your Name
When a bank receives an electronic transfer, it routes the money by the account number, not the name on the form. Under the Uniform Commercial Code, if a payment order lists both a name and an account number and they belong to different people, the bank can rely on the account number alone. It has no duty to check whether the two match.5Legal Information Institute. UCC 4A-207 – Misdescription of Beneficiary
So a transposed digit can send your money to someone else’s account, and recovering it is neither quick nor guaranteed. Check every digit against an official bank statement or your banking app before you submit the form. That one habit prevents the most common and most painful EFT errors.
Submitting the Form and Timing
Submit the completed form through whatever secure channel the receiving organization provides. Encrypted web portals and secure upload tools are standard; physical mail works but adds transit time. Before your first live deposit arrives, most payroll systems send a “prenote,” a zero-dollar test transaction routed through the ACH network to confirm that your routing number, account number, and account type are valid. The receiving bank has a short window to flag errors, which typically adds a few business days to the initial setup.
From submission to first live deposit, expect one to two pay cycles. Your employer may issue a paper check during that transition. Once the prenote clears, deposits arrive automatically on the scheduled date. Standard ACH transactions settle on the next business day by 8:30 a.m. Eastern Time, and same-day ACH settles within the current business day through three processing windows in the afternoon and evening.6Federal Reserve Financial Services. FedACH Processing Schedule
How to Stop or Cancel an EFT
Signing an authorization is not permanent. Federal law gives you two separate tools for controlling recurring transfers, and the difference matters.
Stopping a Single Payment
A stop payment order blocks one specific upcoming transfer. Contact your bank at least three business days before the scheduled transfer date, by phone or in writing.7Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers Your bank may ask you to follow an oral request with written confirmation within 14 days; if you don’t provide it, the oral order expires. Banks generally charge a fee for the service, commonly in the $15 to $36 range.
Revoking the Authorization Entirely
Revocation is broader. It tells both the company and your bank that you’re withdrawing permission for all future transfers, not just the next one. Notify both parties: tell the company in writing that you’re canceling authorization, and separately instruct your bank to block all future debits from that specific payee.8Consumer Financial Protection Bureau. How Can I Stop a Payday Lender From Electronically Taking Money Out of My Bank or Credit Union Account Revocation does not cancel the underlying debt or contract. You still owe what you owe; the creditor simply can’t pull it directly anymore.
Your Liability If Something Goes Wrong
The Electronic Fund Transfer Act caps how much you can lose to unauthorized transfers, but the cap depends on how quickly you report the problem.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within two business days of discovering the problem, and your liability is capped at $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.
- Report after two business days but within 60 days of receiving your statement, and the cap rises to $500.
- Miss the 60-day window, and you could be liable for the full amount of any unauthorized transfers that occurred after day 60, with no cap, as long as the bank can show those later transfers wouldn’t have happened had you reported sooner.
The 60-day clock starts when the bank sends the statement, not when you open it. Reviewing statements every month is the single most effective habit for protecting yourself.
Business Accounts Are Treated Differently
The liability caps and stop payment rights described above apply to consumer accounts. Business-to-business transfers and wire transfers between financial institutions are explicitly excluded from the Electronic Fund Transfer Act.10Office of the Law Revision Counsel. 15 USC 1693a – Definitions If you’re setting up an EFT authorization on a business account, the $50 and $500 caps don’t apply, and error resolution is governed by the Uniform Commercial Code and your bank’s commercial account agreement instead of federal consumer law.
That distinction catches small business owners off guard. If an unauthorized withdrawal hits a business checking account, the bank’s obligation to reimburse depends on your contract, not a statute. Negotiating favorable error resolution terms and adding internal controls, such as dual authorization for larger transfers, helps close the gap.
How Your Banking Data Should Be Protected
An EFT form carries everything someone would need to pull money from your account, so how the receiving organization handles the form matters. Financial institutions that collect this data are required to maintain a written information security program that encrypts customer information in transit and at rest, restricts access to authorized personnel, and securely disposes of records no later than two years after the last date the information was used to serve the customer.11eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
When you submit the form, use the encrypted portal or secure channel the organization provides rather than sending banking details through regular email. If physical mail is the only option, certified mail or hand delivery is safer than dropping it in a mailbox. Once the setup is confirmed, you don’t need to keep a voided check on hand; a securely stored copy of the signed form itself is enough.