What Is an ACH Transfer? How It Works, Simply Explained

If you have ever been paid by direct deposit, or had a mortgage or utility bill paid automatically from your bank account, you have already used an ACH transfer — probably without ever hearing the name.

ACH is not a company or an app. It is the network underneath a lot of everyday money movement, and understanding it helps you understand when money will move, how to stop a payment you no longer want, and what rights you have if money leaves your account without your permission.

Watch: the idea in video form

What ACH means

The Consumer Financial Protection Bureau (CFPB) defines an ACH transaction as an electronic money transfer made between banks and credit unions across a network called the Automated Clearing House (ACH).

The Federal Reserve describes the system in a similar way: the ACH system is a nationwide network through which depository institutions send each other batches of electronic credit and debit transfers.

Three plain-English points follow from those definitions:

• ACH moves money electronically between accounts at banks and credit unions.
• It is used for many kinds of transfers, including direct deposit of paychecks and monthly debits for routine payments.
• Businesses often let consumers pay bills by ACH by providing an account number and a bank routing number. Many online bill-pay services also run on ACH.

If you are still deciding where to hold the account that money moves into and out of, our comparison of a bank vs. credit union explains how those two kinds of institutions differ. Either kind can send and receive ACH transfers.

The two everyday uses: Direct Deposit and Direct Payment

Nacha, the body that governs the ACH Network, sums up the two everyday uses this way: your mortgage and utility payments get paid by Direct Payment, and your pay and tax refunds arrive by Direct Deposit.

• Direct Deposit is an ACH credit — money pushed into your account. The Federal Reserve gives the direct deposit of payroll, Social Security benefits, and tax refunds as typical ACH credit transfers.
• Direct Payment is an ACH debit — money pulled from your account with your permission. The Federal Reserve gives the direct debiting of mortgages and utility bills as typical ACH debit transfers.

So “credit” and “debit” here are about direction. A credit adds money to the receiver’s account. A debit takes money from the receiver’s account, under an authorization the receiver gave.

That paycheck example is worth following, because it shows the moving parts. If you are planning around a new paycheck, see what to do with your first paycheck.

How a Direct Deposit travels, step by step

Nacha’s walk-through of a Direct Deposit goes like this:

1. The employee gives the employer their banking information.
2. Before each payday, the employer sends that information, the amount owed, and the pay date to its bank. In ACH language, the employer is the Originator and its bank is the ODFI.
3. The payments then travel through an ACH Operator to the employee’s bank. The employee’s bank is the RDFI.
4. That bank places the money in the employee’s account. The employee is the Receiver.

The same combine, sort, and deliver flow is used for debits as well as credits: the Originator’s bank combines payment instructions from many customers into an ACH file, sends it to an ACH Operator, the Operator sorts each instruction to its destination bank, and that bank posts it to the Receiver’s account.

Why ACH is not instant: batch processing

ACH payments do not move one by one the moment you press a button. They move as files.

The Federal Reserve explains that the two national ACH operators — the Reserve Banks and the Electronic Payments Network (EPN) — receive files of ACH payments from originating institutions, edit and sort the payments, deliver them to receiving institutions, and settle by crediting and debiting the institutions’ settlement accounts.

That batch design is the main reason ACH feels slower than people expect.

The CFPB puts the timing plainly: it is possible for an ACH payment to clear the same day it is entered, on business days during business hours — but that does not mean a given transaction completes the same day. Because of how ACH transactions are processed, and because the network must guard against fraud and money laundering, payments can take days to complete.

What the settlement ranges actually say

Nacha states settlement in ranges, not as a promise for any single payment:

• Nacha estimates that about 80% of ACH payments settle in one banking day or less.
• Credits can settle the same day, the next banking day, or in two banking days, with the substantial majority settling in one banking day or less.
• Debits settle the same day or the next banking day, and by Nacha Rule a debit’s settlement date cannot be more than one banking day in the future.

Treat those as network-level estimates and rules, not a guarantee about when money will appear in your particular account. This post does not promise a posting time for any bank, because banks’ own posting practices vary and were not part of the sourced research for this post.

Nacha also notes that some banks advance their own funds to employees before settlement, producing early availability. That is a choice an individual bank makes. It is not a promise the ACH Network itself makes.

One more practical point from the CFPB: an ACH transaction can “bounce,” or be returned for nonpayment, if there is not enough money in the account. A bank or credit union might also set a transfer limit, and might charge a fee per transaction. This post gives no fee amount and no limit figure, because the sources support only that fees and limits can exist — not what any particular bank charges or allows.

ACH vs. a wire transfer

ACH and wire transfers both move money electronically, but they work very differently.

• ACH is batch processing. Payments are collected, sorted, and delivered as files, as described above.
• A wire runs over Fedwire, which settles each transfer individually, immediately, finally, and irrevocably.
• ACH carries both credits and debits. Money can be pushed in as a credit or pulled out as a debit.
• Fedwire is credit-only. It pushes money; it does not pull it.

The consumer-rights difference follows from that design. An ACH authorization can be revoked by the consumer, and unauthorized ACH debits carry federal error-resolution rights, both explained below. No equivalent revoke-after-the-fact concept exists for a completed wire.

ACH vs. paying by paper check

Paying by ACH uses the same two numbers printed on a paper check — your account number and your bank routing number — and lets the transfer move electronically instead of on paper.

A paper check can itself become an ACH debit. The Federal Reserve notes that the ACH network, originally used mostly for recurring payments, is now used extensively for one-time debit transfers such as converted check payments and payments made over the telephone and Internet.

That conversion matters for your rights. The CFPB tells consumers that if a check was processed as an electronic transfer, such as an ACH payment, additional federal protections apply. In the situation the CFPB describes — a payment you never authorized — the CFPB says to tell the bank you never authorized the payment and ask it to reverse the debit.

The permission slip: ACH authorization

Before a company can pull money from your account by ACH on a recurring basis, it needs your permission.

The CFPB defines an ACH authorization as a payment authorization that gives the company or lender permission to electronically take money from your bank, credit union, or prepaid card account when a payment is due.

The CFPB’s closing line on that definition is the important part: “You can revoke this authorization.”

How to revoke an authorization

The CFPB gives two steps:

1. Call and write the company and tell it you are taking away your permission for it to take automatic payments from your account. This is called revoking authorization.
2. Call and write your bank or credit union and say you have revoked authorization for that company.

After both contacts, any additional payments initiated by that company would be errors, and you can contact your bank for a refund.

Two cautions come with that right, and both matter:

• Cancelling an automatic payment does not cancel your contract with the company or the amount you owe. Revoking changes how you pay, not whether you owe.
• Banks or credit unions might also recommend a stop payment order, explained in the next section. They generally charge a fee for a stop payment order. This post gives no amount, because no amount was sourced.

If stopping a recurring debit is part of getting your spending back under control, the budgeting side matters too. Our guide to how to budget a biweekly paycheck shows one way people line up regular expenses with regular paydays.

How to stop one scheduled ACH debit

Separate from revoking authorization for the future, Regulation E gives you a stop-payment right for a preauthorized electronic fund transfer that is already scheduled.

As the CFPB publishes the rule at 12 CFR 1005.10(c):

• You may stop payment by notifying your financial institution orally or in writing at least three business days before the scheduled date of the transfer.
• The institution may require written confirmation of an oral stop-payment order within 14 days.
• If it does require that confirmation, it must tell you of that requirement and give you the address at the time of the oral notification.
• An oral order ceases to be binding after 14 days if the confirmation is not provided.

The CFPB’s consumer-facing restatement says the same thing in everyday terms: to stop the next scheduled payment, give the bank the stop payment order at least three business days before the payment is scheduled — in person, by phone, or in writing. To stop future payments you might have to send the order in writing, within 14 days of the oral notification if the bank asks. Including a copy of your revocation to the company helps.

The CFPB’s official interpretation adds what the institution must then do:

• It must honor a timely oral stop-payment order.
• If the debit item is resubmitted, it must continue to honor the order.
• Once it has been notified that your authorization is no longer valid, it must block all future payments for that debit from the designated payee-originator. It may not wait for the payee-originator to stop on its own.

After a revocation, watch the account. A payment taken after you revoked authorization is an error — tell the bank right away.

If money leaves without your permission: error rights

Regulation E’s error-resolution rule, at 12 CFR 1005.11, covers more than theft. As the regulation lists it, an “error” includes:

• an unauthorized electronic fund transfer;
• an incorrect electronic fund transfer to or from your account;
• an electronic fund transfer missing from a periodic statement;
• a computational or bookkeeping error by the financial institution; and
• a transfer that was not properly identified.

Your deadline to report an error

Stated exactly as the regulation states it: the institution’s error-resolution duties attach to an oral or written notice of error received no later than 60 days after the institution sends the periodic statement on which the alleged error is first reflected.

Your notice must let the institution identify your name and account number, and indicate why you believe an error exists, including the type, date, and amount where possible.

Do not treat that window as time you can safely use up. Reporting sooner protects you better, as the liability section below shows, and the CFPB’s general advice for an unauthorized debit is to contact the bank or credit union immediately.

What the bank must do, and how fast

Under 12 CFR 1005.11(c):

• The institution must investigate promptly and determine whether an error occurred within 10 business days of receiving the notice.
• It must report the results to you within three business days after completing the investigation.
• It must correct the error within one business day after determining that one occurred.
• If it cannot finish within 10 business days, it may take up to 45 days, provided it provisionally credits your account, with interest where applicable, within 10 business days.

Two protections in the CFPB’s official interpretation are worth knowing before you call:

• The institution must begin its investigation promptly upon an oral notice. It may not delay until written confirmation arrives.
• If a billing error occurred, the institution may not charge you for any part of the error-resolution process.

A debit you never agreed to

The CFPB works through a concrete version of this problem: a telemarketer took money from a checking account even though the consumer did not agree to buy anything.

The CFPB’s advice is direct: contact the bank or credit union immediately, say you never authorized the payment, and ask the bank to reverse the debit.

The FTC notes, separately, that its Telemarketing Sales Rule requires a seller’s verifiable authorization for such debits.

How much could you be liable for? The tiers, kept separate

This is the section where a single simple number would be wrong, so this post will not give you one.

Regulation E at 12 CFR 1005.6 sets liability by how promptly you report. The CFPB’s official commentary warns that three tiers exist, that more than one tier can apply to a single situation, and that consumer negligence cannot be used to impose liability beyond what Regulation E allows.

Tier 1 — report fast, after learning of a lost or stolen access device

If you notify the institution within two business days after learning of the loss or theft of an access device, such as a debit card, your liability is capped at the lesser of $50 or the amount of unauthorized transfers that occurred before notice.

Tier 2 — report late, but within the statement window

If you do not notify within two business days, your liability is capped at the lesser of $500 or a defined sum, and only for transfers the institution establishes would not have occurred had timely notice been given.

Tier 3 — after 60 days

Unauthorized transfers occurring after the close of the 60-day period following transmittal of the statement showing them can carry unlimited liability, if you failed to report and the institution establishes the transfers would have been prevented by timely notice.

The ACH-specific rule you must not miss

The first two tiers above do not apply to unauthorized transfers made without an access device — which is exactly the situation of a debit created from routing and account numbers alone.

For those transfers, per the CFPB’s official commentary:

• If you notify the institution within 60 calendar days of the statement’s transmittal, you have no liability.
• Liability can attach only to transfers occurring after the close of that 60 days and before notice.

That distinction is why this post keeps the tiers separate. Quoting only “$50 or $500” would misdescribe the most common unauthorized-ACH situation: someone using your account and routing numbers, with no card lost or stolen at all.

The practical lesson does not change, though: check your statements, and report anything you do not recognize as soon as you see it. If a new job or a new payroll setup is part of your picture right now, our 401(k) new job checklist covers the other paperwork that tends to arrive at the same time.

Protecting the two numbers that matter

An ACH debit needs only an account number and a routing number — the same numbers printed on every paper check. Anyone holding them can attempt a debit, authorized or not. Your protection if that happens is the error and liability framework above, which is one more reason to guard the numbers in the first place.

The FTC’s standing advice is:

• Do not give your account number over the phone unless you made the call and know why you are sharing it.
• Never leave account information out in the open.
• Use multi-factor authentication where it is available.
• Check account activity regularly, and report withdrawals you do not recognize immediately.
• Follow up reports in writing, and keep copies.

Watch for one pattern in particular. The FTC warns that scammers pose as a card company’s “security department” and claim they just need you to confirm your account number. That is a pretext to charge the account. Reputable financial companies do not contact consumers this way.

The short version

• ACH is the Automated Clearing House network. Banks and credit unions use it to send batches of electronic credits and debits to each other.
• Direct Deposit is an ACH credit: paychecks, Social Security benefits, and tax refunds arriving. Direct Payment is an ACH debit: mortgage and utility payments leaving, with your authorization.
• ACH moves in batches, not one payment at a time. Same-day completion is possible, but payments can take days, and no single timing promise applies to every transfer.
• A wire is different: Fedwire settles each transfer individually, immediately, finally, and irrevocably, and it is credit-only.
• You can revoke an ACH authorization by contacting both the company and your bank. Revoking does not cancel what you owe.
• You can stop a scheduled preauthorized debit by notifying your bank at least three business days before its scheduled date, with written confirmation within 14 days if the bank requires it.
• For an error, notify your bank no later than 60 days after it sends the statement where the error first appears. The bank generally has 10 business days to investigate, or up to 45 days if it provisionally credits you within 10 business days.
• Liability depends on how fast you report and on how the transfer was made. For an unauthorized debit made from your account and routing numbers alone, with no access device involved, notifying within 60 calendar days of the statement’s transmittal means no liability under the rule described above.

Understanding the rail your money travels on will not by itself fix a tight month. But it does tell you where to call, how much time you have, and which rights are yours when a payment goes wrong — and that is a real step toward stopping living paycheck to paycheck.

Sources

Primary sources used for this draft, as provided in the research brief:

• CFPB, “What is an ACH transaction?” — https://www.consumerfinance.gov/ask-cfpb/what-is-an-ach-transaction-en-1065/
• CFPB, “How do I stop automatic payments from my bank account?” — https://www.consumerfinance.gov/ask-cfpb/how-do-i-stop-automatic-payments-from-my-bank-account-en-2023/
• CFPB, telemarketer debit guidance — https://www.consumerfinance.gov/ask-cfpb/a-telemarketer-took-money-from-my-checking-account-even-though-i-did-not-agree-to-buy-anything-can-i-get-the-money-back-en-1073/
• CFPB, bank-account key terms (ACH authorization) — https://www.consumerfinance.gov/consumer-tools/bank-accounts/answers/key-terms/
• CFPB, money-transfer key terms — https://www.consumerfinance.gov/consumer-tools/money-transfers/answers/key-terms/
• CFPB, Regulation E, 12 CFR 1005.6 — https://www.consumerfinance.gov/rules-policy/regulations/1005/6/
• CFPB, Regulation E, 12 CFR 1005.10 — https://www.consumerfinance.gov/rules-policy/regulations/1005/10/
• CFPB, Regulation E, 12 CFR 1005.11 — https://www.consumerfinance.gov/rules-policy/regulations/1005/11/
• CFPB, protections for automatic debit payments — https://www.consumerfinance.gov/archive/blog/you-have-protections-when-it-comes-to-automatic-debit-payments-from-your-account/
• Federal Reserve, FedACH Services — https://www.federalreserve.gov/paymentsystems/fedach_about.htm
• Federal Reserve, Fedwire Funds Service — https://www.federalreserve.gov/paymentsystems/fedfunds_about.htm
• Nacha, “How ACH Payments Work” — https://www.nacha.org/content/how-ach-payments-work
• FTC, lost or stolen credit, ATM, and debit cards — https://consumer.ftc.gov/articles/lost-or-stolen-credit-atm-and-debit-cards

---

This post is educational information about how ACH transfers work and about the consumer rights described in the sources above. It is not financial or legal advice for a specific situation. For a disputed debit on your own account, contact your bank or credit union promptly.

No spam. Unsubscribe any time. Plain-English money tips only.