Unauthorized ACH Debit: Dispute Deadlines and Next Steps
Unauthorized ACH debit? Learn when Regulation E applies, what to report, investigation timeframes and how to protect your account.
An unexpected ACH debit from a checking account is more than an inconvenience if it reduces money needed for rent or payroll. The key questions are whether the debit was authorized, when the customer learned about it, and whether the payment is governed by consumer electronic-transfer protections. An unauthorized consumer ACH debit normally deserves an immediate error report to the bank, not just a request that the merchant stop future payments.
Identify the type of debit before making the claim
ACH debits can cover utilities, memberships, loan payments and online transactions authorized by account and routing information. Some errors involve the wrong amount or a duplicate debit; others involve a company charging after permission was revoked or a stranger using account details without authorization. A charge the customer recognizes but dislikes is not automatically unauthorized. The bank needs the underlying facts to investigate the correct category of error.
Download the statement or transaction record and note the merchant or originator name, amount, posting date and any available ACH company identifier. Compare the debit against written authorizations and earlier bills. If it resembles a subscription you canceled, preserve the cancellation confirmation. If it is wholly unfamiliar, contact the bank using its official number and consider whether account credentials or routing information have been exposed.
Regulation E provides a formal error-resolution route
The Electronic Fund Transfer Act and Regulation E generally cover electronic debits from consumer accounts and require investigation of timely reported errors. A useful reporting benchmark is 60 days after the financial institution sends the first statement showing the disputed electronic transfer. Reporting sooner is safer, both because notice rules can affect consumer liability and because additional unauthorized debits could occur while the first remains unresolved.
Under the usual Regulation E process, a bank investigates promptly and ordinarily has ten business days to determine whether an error occurred. Certain rules permit a longer investigation if provisional credit is given, subject to conditions and exceptions. New accounts and some transaction categories can have different timelines. Do not treat provisional credit as a final victory: the bank may reverse it after a supported determination that the transfer was authorized.
Give a complete but focused error notice
Say clearly that the transaction was unauthorized or identify the precise error: wrong amount, duplicate transfer, transaction after revocation or a payment never agreed to. Provide account identification through the bank's secure process, amount, date, originator and a concise explanation. For example: 'A $185 ACH debit posted June 12 from Vendor X. I terminated authorization May 28, as shown in the attached confirmation, and made no later approval.'
If first reported by telephone, the bank may request written confirmation within a specified period, and that can affect eligibility for provisional credit. Ask where to submit it and keep proof of delivery. Record the claim reference number and every conversation. A generic request to 'reverse this' does not substitute for confirming the bank has recorded a formal error claim under the appropriate consumer-account process.
Stop future debits without confusing the existing dispute
Disputing a debit that already posted and preventing future scheduled debits are separate tasks. Contact the merchant to revoke authorization where appropriate and notify the bank of that revocation. A stop-payment instruction may also be available for preauthorized transfers; it has its own lead-time and possible fee rules. None of these actions necessarily cancels the underlying service contract or debt, so review what you still owe a legitimate biller.
Consider a gym collecting $90 monthly after cancellation. Correcting June's debit does not automatically block July's payment, and blocking payment does not automatically settle a membership dispute. Keep written cancellation proof, request an appropriate stop on future entries and monitor the account. If a fraudster may know the account number, ask the bank whether an account change or additional safeguards are warranted instead of trying to block only one company name.
Understand the investigation and escalation stages
If the bank rejects the claim, request its written explanation and the documents or information used to make the determination, as available under Regulation E. Compare those records to your authorization evidence. A bank's assertion that a payment used correct account numbers may not, by itself, resolve who actually authorized it. Conversely, a consumer may have given valid permission under a contract even if they later regret the charge.
For unresolved consumer errors, a CFPB complaint can supplement the bank's dispute process after the necessary initial notice. Keep all correspondence together and avoid sending full banking credentials by ordinary email. A business checking account may have different legal and contractual protections than a consumer account, so do not automatically apply these consumer Reg E deadlines to every commercial ACH dispute.
MyBankAnswers Editorial Verdict
Report a suspicious ACH debit as a specific transaction error immediately and handle future authorization separately. We would never advise waiting for a merchant to 'look into it' while the bank's formal notice clock continues to run. A well-documented claim with amounts, dates and the original authorization history is stronger than a vague fraud allegation.
The decisive distinction is between an unauthorized debit, an incorrect debit and a legitimate charge arising from a separate contract dispute. Each needs different evidence. Preserve the first statement, make the bank's error-reporting deadline, confirm any required written follow-up and monitor for repeat entries. If the bank denies the claim, inspect its reasoning before escalating. Speed and documentation matter more than using the word 'fraud' repeatedly.
Official sources and verification
Research review: October 10, 2026. Sources were checked for relevance to the key legal and operational claims; this does not certify all external URLs or every bank-specific procedure. The article is an editorial draft for publication integration, not individualized legal or financial advice.