An ACH debit pulls money from your bank account using routing and account numbers (bill pay, payroll reverse, “pay by bank,” subscription renewals). When you did not authorize the pull, treat it as an unauthorized electronic fund transfer, not a polite merchant disagreement. A check or deposit that posts then reverses unpaid is a different fix path: Returned deposit items.
Card disputes follow network and Fair Credit Billing Act paths (Unauthorized card charges). ACH disputes usually ride Regulation E through your bank or credit union (Chase, Bank of America, Wells Fargo, Capital One, Ally, Navy Federal, and similar). The paperwork and clocks differ. Broader EFT error notice and written dispute steps: Dispute a bank error within Regulation E.
Unauthorized ACH vs a bill you forgot
| Situation | Likely path | First move |
|---|---|---|
| Debit you never set up; unknown company name | Unauthorized EFT / Reg E | Call bank fraud line; revoke ACH authorization |
| Old gym or streaming trial you forgot to cancel | Often authorized until you revoke | Cancel with merchant; stop future ACH at bank |
| Phishing led you to “confirm” bank details | Unauthorized + account takeover | Change passwords; see Phishing and ATO |
| Fake bank text pushed you to “verify” | Social engineering | Ignore the text; use the app (Fake bank security alerts) |
| Payroll or tax refund ACH you expected | Usually legitimate | Confirm employer or IRS/state source |
Authorization can be written, electronic, or sometimes by phone depending on the rules that apply. Keep statements, emails, and screenshots. If a collector claims you owe after a disputed ACH, verify contacts the same way you would for fake collectors.
First 48 hours
- Call the number on your debit card or statement, not a number in a text or pop-up. Say you are reporting an unauthorized ACH debit.
- Ask the bank to block future ACH from that originator (company ID / SEC code if they can see it) and to open a Reg E dispute.
- Change online banking and email passwords if phishing or ATO is possible. Turn on MFA.
- Monitor the account daily for follow-on pulls while the investigation runs.
- Document everything: date of debit, amount, originator name, confirmation numbers, and who you spoke with.
If the account feels compromised, some people open a new checking account and move direct deposit carefully (Switching banks without missed payments) while the old account is locked down.
Worked example
Alex sees a $189.00 ACH debit labeled “FLEXBILL SVC” on an Ally checking statement. Alex never signed up. Same day Alex calls Ally’s fraud line, freezes Zelle and external transfers in the app, and files a Reg E dispute. Ally provisionally credits the $189 within the timeline they quote while they investigate.
Alex also places a credit freeze at Equifax, Experian, and TransUnion in case the thief tries cards next (Credit freezes and fraud alerts). Two weeks later the debit is confirmed unauthorized and the provisional credit becomes permanent. A second attempt from the same originator is blocked.
Reg E clocks (educational overview)
Consumer Reg E rules generally require prompt notice after you learn of an unauthorized EFT. Liability can rise if you wait past common notice windows, and banks have investigation deadlines that differ for provisional credit vs final resolution. Exact days depend on how you access the account and when you discovered the error. Read your deposit account agreement and the CFPB’s electronic fund transfer materials; do not rely on a blog memory of “60 days” alone.
Ask your bank in writing (secure message or letter):
- Is this coded as an unauthorized ACH under Reg E?
- When will provisional credit post if applicable?
- Can you stop payment / block this company ID going forward?
- Do I need a written affidavit?
ACH stop vs card chargeback
- Cards: often dispute in the issuer app; temporary credit is common; merchant fight may follow.
- ACH: bank investigates the debit; you may need a written unauthorized-ACH statement; stopping future entries is separate from reclaiming a past debit.
- Same thief, both rails: dispute the card charges and the ACH pulls. One path does not cover the other.
After cleanup, review connected billers so legitimate rent, utilities, and loans are re-authorized on purpose when you switch accounts.
Checklist
- Contact the bank using a verified number the same day you spot the debit.
- Open a Reg E unauthorized-EFT dispute and request a block on the originator.
- Change passwords / MFA if phishing or ATO is possible.
- Save statements, chat transcripts, and provisional-credit notices.
- Watch for repeat ACH and related card fraud for at least 30–60 days.
- Consider a freeze and a clean account migration if the compromise looks wide.
Educational only. Not legal, banking, or fraud-recovery advice. Reg E and bank procedures have details and exceptions; confirm with your institution and CFPB resources.