PayeeGuard

ACH fraud · checked 24 October 2026

Unauthorized ACH debit on a business account

Consumers get a long time to dispute an ACH debit they didn't authorize. Businesses don't. Under the ACH network rules, your bank has to send an unauthorized debit back within 2 banking days, so speed decides whether you get the money back easily.

Why business accounts are different

When a business tells its bank a debit wasn't authorized, the bank returns it with code R29 ("corporate customer advises not authorized"). The receiving bank must send that return within 2 banking days. After that, getting the money back usually means chasing the company that took it, or court.

What to do today

  1. Call your bank's business fraud line the day you spot it. Say it's an unauthorized ACH debit and ask them to return it as unauthorized.
  2. Give them the details: amount, date, the company name and ID shown on your statement.
  3. Stop it repeating. If it's recurring, ask the bank to block that company, and revoke any authorization you did give.
  4. Work out how they got your account number. A cheque you sent, an invoice footer, or a supplier's leaked records are common sources. Consider moving to a new account number if it keeps happening.

Stop it happening again

  • ACH debit block: no ACH debits allowed on the account. Good for accounts that only receive money.
  • ACH debit filter (ACH Positive Pay): only approved companies can debit you, and anything else is held for you to approve or return. Positive Pay explained.
  • Check activity every banking day, or set up alerts for every debit. With a 2-day window, a weekly check is too late.
  • Use a separate account for paying suppliers, so the number on your invoices isn't the one holding your cash.

Sent money the wrong way instead? ACH payment to the wrong account. Supplier asked you to pay new bank details? Verify the account first.

Sources: Modern Treasury, R29 return code (non-consumer accounts; RDFI must return within 2 banking days), consistent with Nacha's rules. Read 24 October 2026. Ask your bank for its own cut-off times.

Check a suspicious email free Set up call-backs and approvals