Under U.S. Regulation E (12 CFR Part 1005), an unauthorized ACH debit from your bank account qualifies as an electronic fund transfer (EFT). To limit your liability, notify your bank--the Receiving Depository Financial Institution (RDFI)--within two business days after learning of the loss or theft of your access device. Your liability then caps at the lesser of $50 or the amount of unauthorized transfers before notice. If you notify after two business days, liability may reach the lesser of $500 or the sum of unauthorized transfers before notice plus amounts within 60 days after the first notice (confirm details with your bank).
Regulation E Controls Unauthorized ACH Debit Liability
Regulation E § 1005.6 sets U.S. federal liability limits for unauthorized EFTs, including ACH debits. If you notify your RDFI within two business days after learning of the loss or theft of your access device (such as account credentials), your maximum loss is the lesser of $50 or the unauthorized transfers made before notice.
A business day under Regulation E ends at 11:59 p.m. For example, if Saturday counts as a business day for your bank and you learn of the issue on Saturday, the two-business-day notice period expires at 11:59 p.m. on the following Monday. See the official interpretations for timing details. These limits apply only to unauthorized transfers; authorized but erroneous debits follow separate error resolution procedures under Regulation E § 1005.11 (notify within 60 days of statement availability, but confirm bank-specific process).
| Notification Timing | Liability Cap |
|---|---|
| Within 2 business days of learning of access device loss/theft | Lesser of $50 or unauthorized amount before notice |
| After 2 business days | Lesser of $500 or sum of unauthorized amounts before notice plus amounts in next 60 days (bank confirms full details) |
What Does Not Control ACH Debit Disputes
ACH debit disputes differ from credit card chargebacks, which fall under the Fair Credit Billing Act (FCBA) with separate timelines and evidence rules. NACHA Operating Rules primarily direct banks and originators (ODFIs), not consumer rights, which stem from Regulation E. Wire transfers, P2P apps, or non-ACH EFTs follow different policies.
Practical Next Steps to Dispute an ACH Debit
Notify your bank by phone, app, or in person as soon as you spot the unauthorized ACH debit. Provide transaction details from your statement, including date, amount, and originator name. Request written confirmation of your notice.
Your bank investigates under Regulation E. Gather evidence like account statements and notification records. If unresolved after the bank's process, submit a complaint to the CFPB.
Evidence Checklist:
- Bank statement showing ACH debit (date, amount, originator)
- Proof of notification time (call log, email, chat transcript)
- Access device details (if loss/theft involved)
FAQ
What counts as an "unauthorized" ACH debit under Regulation E?
Transfers you did not authorize, such as those using compromised account details without your consent. Confirm with your bank, as it distinguishes from billing errors.
How soon must I notify my bank after discovering an ACH debit error?
Within two business days after learning of access device loss/theft to cap liability at $50; later notice raises potential liability to $500 maximum.
Does my bank have to reverse an unauthorized ACH debit automatically?
No--banks investigate under Regulation E. Prompt notice limits your liability, but reversal depends on their findings.
Can I dispute an ACH debit directly with the merchant or payer?
No--start with your bank (RDFI). Merchant contact handles refunds separately, not ACH disputes.
What if my bank doesn't resolve my ACH dispute?
File a CFPB complaint with your evidence and bank's response. Track statements for any provisional credit.