Written Statement of Unauthorized Debit (WSUD): Reasons and 60-Day Deadline

To fill out a Written Statement of Unauthorized Debit, pull the disputed transaction off your bank statement, enter the account and transaction details at the top of your bank’s form, check the single box that best describes why the debit was unauthorized, sign and date the attestation, and return the form to your bank through a channel that gives you a dated receipt. The form is almost always one page, modeled on a sample published by Nacha, and signing it starts the federal error-resolution clock under Regulation E.¹

Each bank uses its own layout, but the content is the same everywhere: who you are, what the charge was, why it shouldn’t have happened, and your signed attestation that you’re telling the truth. Work through it in that order.

Information to Pull From Your Statement First

Open the statement that shows the disputed charge before you start writing. You’ll need four things from it:

Your full account number for the account that was debited.
The exact dollar-and-cent amount of the debit.
The settlement or posting date shown on the statement, not the date you noticed the charge.
The name of the company or person that initiated the debit, as it appears in the transaction description. Many statements also list a 10-digit ACH Company ID next to the name; some bank forms have a field for it, so copy it down.

Check the dollar amount twice against the statement. A typo in the amount field is one of the most common reasons a claim gets routed back for correction and loses days off the response window.

While you have the statement open, note any overdraft or non-sufficient-funds fees the debit triggered. If the bank ultimately confirms the debit was unauthorized, Regulation E requires it to refund fees imposed as a result of the error, though fees that would have hit the account anyway are not covered.²

Choosing the Reason That Matches Your Dispute

The middle of the form is where most people get stuck. The Nacha sample groups the possible reasons into three categories, and your bank’s version will mirror them:¹

Never authorized. You did not know the company, did not give it permission to debit your account, or the signature on an electronically processed check isn’t yours. This covers identity theft and outright fraud.
Authorized but the debit does not match the agreement. The company pulled a different amount than you approved, took the money earlier than agreed, failed to apply it as instructed, improperly converted a check to an electronic debit, reinitiated a debit that had already been returned, or processed an improper reversal.
Authorized but revoked. You canceled the authorization before the debit was initiated, and the company charged you anyway.

Check one box, and pick the one that most precisely describes what happened. If a company charged you $200 after you agreed to $100, that’s “amount different than authorized,” not “never authorized” — you did approve a debit, just not that debit. If someone you’ve never done business with pulled money from your account, that’s “did not authorize the party to debit my account.” Picking the wrong box won’t necessarily sink your claim, but it can send the file to the wrong queue and cost you days.

If none of the boxes fit, the form includes an “Other” field where you can describe the problem in your own words. Keep that description short and factual: what the company did, what you had agreed to, and how the two differ.

Signing the Attestation

The last section is a sworn statement. By signing, you are confirming that you are an authorized signer on the account, that the debit was not originated with your own fraudulent intent, and that everything you’ve entered on the form is true and correct. The Nacha sample does not use “penalty of perjury” wording, but it does carry a warning that intentionally misrepresenting whether a transaction was authorized can carry fines up to $1,000,000 or imprisonment up to 30 years under the federal bank fraud statute, 18 U.S.C. §1344.¹ Some banks add a penalty-of-perjury certification of their own on top of that language.

Read the attestation before you sign. The warning is there because a WSUD is treated as a legal declaration, not a complaint form. If you aren’t certain a charge was unauthorized — say, you forgot about a subscription you signed up for — resolve that uncertainty with the merchant first.

Date the form on or after the settlement date of the debit you’re disputing. A WSUD cannot be dated earlier than the transaction it covers.

Submitting the Form

Nacha’s rules do not require the WSUD to be notarized. A signature alone is enough, and a bank cannot delay the process by demanding a notary unless its own account agreement specifically requires it, which is uncommon. When a bank accepts the form through its online banking portal, the account-holder login handles verification.

Submit through a channel that creates a dated record:

Secure upload through online banking or the mobile app, which produces an instant digital receipt.
In person at a branch, with a date-stamped copy for your records.
Certified mail with return receipt if you have to mail it.

You can report the error first by phone or in person, and the bank must begin investigating right away. But the bank is allowed to require a signed written confirmation within 10 business days of your oral notice. If you don’t get the written form in within that window, the bank is no longer required to provisionally credit your account while it investigates.³ So if you call the bank, send the form the same week.

The 60-Day Deadline That Governs Everything

You have to notify your bank of the unauthorized debit within 60 days of the date it sent or made available the periodic statement that first shows the charge.² Miss that window and you lose Regulation E protection for any additional unauthorized transfers that occur after day 60.⁴

The clock starts when the bank transmits the statement, not when the debit posted and not when you opened the envelope or the PDF. This is the single most common way people lose the right to recover money.

One related point: a WSUD only reverses debits that have already posted or are settling. It is not a stop-payment order, which blocks a future scheduled payment and must be submitted at least three banking days before that payment is set to hit.⁵ If a company has already taken money you didn’t authorize and you want to prevent it from doing it again, you may need to file both.

What Happens After the Bank Has the Form

Once your written notice is in, Regulation E locks the bank into a fixed timeline:³

Within 10 business days, the bank must investigate and determine whether an error occurred. If it resolves the claim in your favor within that window, it corrects the error within one business day and reports the result within three business days.
If it cannot finish in 10 business days, it must provisionally credit your account for the full disputed amount within those same 10 business days, and it then has up to 45 calendar days from the date it received your notice to complete the investigation. You get full use of the credited funds in the meantime.
The investigation window stretches to 90 calendar days if the disputed transfer was a point-of-sale debit card transaction, was initiated outside a state, or occurred within 30 days of the first deposit to a new account.

When the investigation closes, the bank sends you a written result within three business days. If it confirms the debit was unauthorized, the provisional credit becomes permanent and any fees caused by the error are refunded. If it decides no error occurred, it must explain its findings in writing and tell you that you can request copies of the documents it relied on.

If the Account Is a Business Account, Stop

Everything above applies to consumer accounts. Business and commercial accounts are not covered by Regulation E, and the ACH timelines are much tighter: under Nacha’s rules, a business generally has only until the opening of business on the second banking day following the settlement date to return an unauthorized corporate ACH debit.⁶ Liability for unauthorized commercial transfers is governed by UCC Article 4A and the account agreement, not by the 60-day consumer rule. If the disputed debit hit a business account, call the bank immediately rather than relying on the consumer WSUD process.

1
Nacha. ACH Operations Bulletin 1-2023 – Update to Sample WSUD
2
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
3
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
4
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
5
EPCOR. Ask Mary: What’s the 411 on Stop Payments?
6
Nacha. ACH Network Rules – Reversals and Enforcement