A WEB ACH payment is an electronic debit, or in some cases a credit, that you authorize through a website or mobile app and that moves through the Automated Clearing House network. Nacha, the organization that writes the ACH rulebook, assigns every transaction a Standard Entry Class code, and the WEB code tells every bank in the chain that your authorization was collected online rather than on paper or by phone. That label is not cosmetic. It activates specific authorization, account-validation, and data-security duties for the business taking your payment, and it triggers federal protections under Regulation E that cap your liability if something is debited without your permission.
When the WEB Code Applies
Nacha defines a WEB entry as an ACH transaction authorized through the internet or a wireless network, excluding authorizations given orally during a phone call. Any time you type a routing number and account number into a checkout page, a bill-pay portal, or an app and tap “pay,” the business is supposed to tag that transaction with the WEB code before releasing it into the network.1Nacha. ACH File Details
WEB sits in the “corporate to consumer” category, meaning a business is moving money to or from a personal bank account. When two businesses move funds between corporate accounts, the correct code is CCD, not WEB. Using the wrong code is a compliance problem because each code carries its own authorization and security requirements.1Nacha. ACH File Details
Since June 2024, the WEB code also covers consumer-to-consumer credit transfers that run across the ACH network, regardless of how the sender authorized them. If you use a peer-to-peer payment app that settles through ACH rather than a card network, the sending bank is required to apply the WEB code to that credit.2Nacha. Minor Rules Topics
Single Entry vs. Recurring Entry
A WEB transaction is either a one-time single entry or a recurring entry on a schedule. A single entry is authorized once, debited once, and done. A recurring entry covers repeated debits — a monthly subscription, a quarterly insurance premium, that kind of arrangement.1Nacha. ACH File Details
Recurring entries carry extra duties. The authorization has to spell out how you can revoke it, and the business must honor a cancellation before the next scheduled payment. Single entries don’t need revocation instructions because there is nothing to cancel after the debit clears.3Nacha. WEB Proof of Authorization Industry Practices
What a Valid Online Authorization Must Include
A business cannot collect your account details and start pulling money on that alone. Nacha rules require the authorization to contain several specific pieces of information:
- Express authorization language, something along the lines of “I authorize Company X to debit my account.” You have to affirmatively agree, not simply fail to opt out.
- Your bank account number and the nine-digit routing transit number for your financial institution.
- The transaction amount, either as a fixed figure or, for recurring payments that vary, a description of how the amount is calculated.
- The specific debit date for a one-time payment, or the schedule for a recurring one.
- Revocation instructions for any recurring or future-dated payment.
These elements come from Nacha’s operating rules for WEB entries.3Nacha. WEB Proof of Authorization Industry Practices The consent language has to be clear and easy to find on the page. Burying it in fine print or behind a hyperlink most people will never open doesn’t meet the standard.
The business also has to keep a retrievable copy of every authorization so it can produce proof if you later dispute the charge. Federal law separately requires that you receive a copy of any preauthorized transfer authorization at the time you grant it.4Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers Most companies satisfy this by showing the full terms on screen and sending a confirmation email.
Account Validation and Fraud Screening
Before processing the first WEB debit against a new account number, the originator must verify that the account is real and able to receive ACH entries. This has been a firm requirement since the WEB Debit Account Validation Rule took full effect in March 2021. A fraud detection system without an account validation step is noncompliant from the very first transaction.5Nacha. Supplementing Fraud Detection Standards for WEB Debits
The rule confirms the account exists and is open. It does not require verifying who owns it.5Nacha. Supplementing Fraud Detection Standards for WEB Debits Three methods are commonly used:
- Micro-deposits. The business sends one or two tiny deposits, typically between one cent and ninety-nine cents, and asks you to confirm the exact amounts. This proves the account exists and that you can see its history.
- Prenotification, or prenote. A zero-dollar entry formatted like a real ACH transaction is sent to the receiving bank. If it comes back without an error, the account is treated as valid. Prenotes take a couple of business days to clear.
- Instant account verification. A third-party service connects to your bank through a secure interface, often by having you log in to online banking through a widget, and confirms the account in real time.
How Your Banking Data Must Be Protected
Nacha applies security rules at two stages: when banking data moves across the internet, and when it sits on a company’s servers.
In transit, the originator must use commercially reasonable security technology that provides protection equivalent to at least 128-bit encryption before any routing number, account number, or PIN leaves your device.6Worldpay. Direct Debit – NACHA Requirements In practice, the payment page should run on HTTPS with current TLS encryption.
In storage, the rules are deliberately technology-neutral. Encryption, truncation, tokenization, or having your bank hold the data on the originator’s behalf all qualify, so long as account numbers are unreadable to anyone who gains unauthorized access to the files.7Nacha. Supplementing Data Security Requirements If a company’s database is breached, raw account numbers shouldn’t be legible to the attackers.
Stopping a Recurring WEB Debit
If you have authorized recurring WEB debits and want them to stop, you have two paths. You can revoke the authorization directly with the business using whatever method the authorization described. You can also tell your bank to stop the payment at least three business days before the next scheduled debit, and the bank is legally required to block it.8eCFR. 12 CFR 1005.10 – Preauthorized Transfers
Your bank can ask you to follow up an oral stop-payment request with written confirmation within 14 days. If the bank required written confirmation and you don’t provide it, the oral stop order expires. Once you tell the bank you’ve revoked the authorization altogether, it must block all future debits from that originator rather than wait for the company to stop sending them.9Consumer Financial Protection Bureau. Comment for 1005.10 – Preauthorized Transfers
Disputing an Unauthorized Debit
When money leaves your account through a WEB debit you never authorized, Regulation E caps your liability according to how quickly you report it:
- Report within two business days of learning about the unauthorized transfer, and your liability is capped at $50.
- Report after two business days but within 60 days of the bank sending the statement showing the transfer, and liability can reach $500.
- Report after 60 days, and you may be responsible for the full amount of any unauthorized transfers that occur after the 60-day window closes.
These tiers come from Regulation E.10Consumer Financial Protection Bureau. Section 1005.6 – Liability of Consumer for Unauthorized Transfers The 60-day clock starts when the bank sends or makes available the periodic statement reflecting the transaction, not when the debit hits your account.11Consumer Financial Protection Bureau. Procedures for Resolving Errors
On the ACH network side, your bank can return an unauthorized WEB debit using return reason code R10, which means you say the originator was never authorized to debit the account, or R11, which means an authorization existed but the debit didn’t match its terms, such as a wrong amount or wrong date. Both carry a 60-day return window.12Nacha. Differentiating Unauthorized Return Reasons Filing a false claim of unauthorized activity is serious. Nacha’s sample dispute form now includes a disclosure warning that fraudulent claims can result in fines up to $1,000,000 or imprisonment up to 30 years under federal bank fraud statutes.13Nacha. ACH Operations Bulletin 1-2023 – Update to Sample Written Statement of Unauthorized Debit