What Is an Electronic Debit? How It Works and Your Rights

An electronic debit is any transaction that pulls money directly from your bank account through a digital channel instead of a paper check. That includes a card swipe at the register, a tap-to-pay purchase, an online checkout, a bill paid through your banking app, and the monthly auto-pay that your gym or insurer runs against your account. The Electronic Fund Transfer Act and its implementing rule, Regulation E, set the federal ground rules for how these transactions can be authorized, how quickly you have to report problems, and how much you can be made to pay when something goes wrong.¹

How the Money Actually Moves

Most electronic debits travel through the Automated Clearing House (ACH) network. When you authorize a payment, the recipient’s bank sends a digital file with your account information to a central clearinghouse, which routes it to your bank. Your bank verifies the details and releases the funds.

Traditional ACH processing takes one to three business days because transactions are grouped and settled in scheduled windows. Same-Day ACH shortens that, allowing transfers of up to $1,000,000 per payment to settle within hours on the same business day.² For near-instant movement, the Federal Reserve’s FedNow Service settles payments within seconds, around the clock, every day of the year.³ Not every bank participates in FedNow yet, but adoption is growing.

One-Time Debits and Recurring Debits

Electronic debits break into two groups based on how often they repeat.

A one-time debit happens during a single event. You swipe or tap a card, enter a PIN, confirm a payment on-screen, or verbally approve a charge over the phone. Each transaction is authorized on its own, in the moment.

A preauthorized, or recurring, debit is one you set up in advance to repeat at regular intervals: a mortgage, an insurance premium, a streaming subscription. Federal law defines a preauthorized transfer as one authorized ahead of time to recur at substantially regular intervals.⁴

Both show up on your statement with a merchant description and a transaction code. Reviewing those lines regularly is the single most effective habit for keeping your legal protections intact, because almost every right described below runs on a clock that starts when the statement goes out.

How a Company Can Legally Pull Recurring Money From You

For a one-time charge, your real-time participation is the authorization. No written agreement is required.

Recurring charges work differently. A preauthorized transfer can only be set up through a writing that you sign or similarly authenticate, such as an electronic signature on a web form. The company must also give you a copy of that authorization for your records.⁵ Oral consent alone is not enough to establish a lawful recurring debit.⁶

When a recurring charge will come through at a different amount than before or than originally authorized, you are entitled to written notice of the new amount and date at least 10 days before the transfer.⁷ You can also ask to receive that notice only when a payment falls outside a range you specify, rather than before every varying debit.

Your Liability for an Unauthorized Debit

If someone debits your account without permission, how much of that loss sticks to you depends almost entirely on how fast you report it.

Report within two business days of learning your card or access information was lost or stolen, and your liability is capped at $50, or the amount of the unauthorized transfers if less.⁸
Report after two business days but within 60 days of the statement showing the unauthorized charge, and your liability can reach $500.⁸
Miss the 60-day window, and you can be held responsible for the full amount of any unauthorized transfers that happen after that window closes, with no cap.⁹

Extenuating circumstances such as hospitalization or extended travel can push these deadlines out to a reasonable period.⁹ Outside those situations, the only reliable protection is checking your statements often.

When a Scammer Tricked You Into Handing Over Access

If a scammer fools you into sharing your login, card number, or other access credentials and then uses them to move money, those transactions still count as unauthorized under federal law. The fraudulent inducement is what matters. A bank cannot cite your negligence to push your liability above the tiers above.¹⁰

Disputing an Error on Your Statement

When you see a charge you didn’t authorize, a wrong amount, or a missing transfer, you have 60 days from the date your bank sent the statement to notify them of the error.¹¹ Your notice can be oral or written and should include your name and account number, a description of the error, the dollar amount, and why you believe it is an error.

The bank then has 10 business days to investigate and report back.¹² If it confirms an error, it must correct the problem within one business day of that finding.

The bank can take up to 45 days to investigate, but only if it provisionally credits your account for the disputed amount within those first 10 business days and gives you full access to those funds during the investigation.¹² It must notify you of the provisional credit within two business days of applying it.

Two situations stretch those windows. For a disputed transfer that happened within 30 days of your first deposit, the bank gets 20 business days instead of 10. For international transfers and point-of-sale debit card transactions, the overall investigation window stretches to 90 days instead of 45.¹²

You can open a dispute by phone, but watch the follow-up rule. If the bank asks you to confirm your report in writing within 10 business days and you don’t, the bank is no longer required to provisionally credit your account during the investigation.¹¹ Send an email or letter after every call.

Stopping a Recurring Debit

You have the right to shut off any preauthorized recurring debit. There are two steps, and using both gives you the strongest protection.

First, tell the company. Contact the merchant in writing and revoke your authorization. Save every confirmation, screenshot, and email. That paper trail is what you’ll point to if a charge comes through anyway.

Second, place a stop payment order with your bank. You must give that order at least three business days before the next scheduled debit.⁶ The order can be oral or written, and your bank must honor it.¹³

If you give the order orally, the bank can require written confirmation within 14 days. If you don’t send it, the oral order expires and the bank is no longer bound by it.⁵ The bank is supposed to tell you about this requirement and where to send the confirmation when you make the oral request.

Banks typically charge a fee for a stop payment order, often in the range of $15 to $35. The order does not last forever. Most expire after six months to a year, after which the bank could process the debit if the merchant resubmits it. You may need to renew the order and pay the fee again.

Overdraft Rules on Debit Card and ATM Transactions

When a one-time debit card purchase or ATM withdrawal would overdraw your account, your bank cannot charge you an overdraft fee unless you specifically opted in to the bank’s overdraft service. That opt-in must be obtained separately from your other account agreements, and the bank must give you a clear written notice about the service before asking for your consent.¹⁴

If you haven’t opted in, the bank simply declines the transaction at the point of sale or ATM. You can revoke an existing opt-in at any time. This rule applies only to one-time debit card and ATM transactions. Recurring preauthorized debits and checks sit under separate rules and may still trigger overdraft or returned-item fees without a separate opt-in.

Which Accounts These Protections Cover

Every right described above comes from the Electronic Fund Transfer Act and Regulation E, and those rules apply only to accounts established primarily for personal, family, or household purposes.¹⁰ Business, organizational, and commercial accounts generally are not covered. Some banks voluntarily extend similar dispute and fraud-liability rights to business customers through their account agreements, but they aren’t required to. If you run a business account, read the deposit agreement closely and consider negotiating specific fraud-liability terms up front.

1
Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose
2
Federal Reserve Financial Services. Same Day ACH Frequently Asked Questions
3
Federal Reserve. What Is the FedNow Service
4
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E
5
eCFR. 12 CFR 1005.10 – Preauthorized Transfers
6
Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers
7
eCFR. 12 CFR 1005.10 – Preauthorized Transfers
8
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
9
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
10
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
11
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
12
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
13
Consumer Financial Protection Bureau. 12 CFR Part 1005, Regulation E – 1005.10 Preauthorized Transfers
14
Consumer Financial Protection Bureau. 12 CFR 1005.17 – Requirements for Overdraft Services