---
title: "Unauthorized ACH debit on a business account: you may have only 2 banking days"
description: "Why unauthorized ACH debits on a US business account must be reported fast (the R29 return window is 2 banking days), what to tell your bank, and how ACH debit blocks and filters stop it happening again."
url: https://payeeguard.pages.dev/unauthorized-ach-debit-business-account
---

ACH fraud · checked 24 October 2026

# Unauthorized ACH debit on a business account

Consumers get a long time to dispute an ACH debit they didn't authorize. Businesses don't. Under the ACH network rules, your bank has to send an unauthorized debit back within **2 banking days**, so speed decides whether you get the money back easily.

## Why business accounts are different

When a business tells its bank a debit wasn't authorized, the bank returns it with code **R29** ("corporate customer advises not authorized"). The receiving bank must send that return within 2 banking days. After that, getting the money back usually means chasing the company that took it, or court.

## What to do today

- **Call your bank's business fraud line** the day you spot it. Say it's an unauthorized ACH debit and ask them to return it as unauthorized.
- **Give them the details:** amount, date, the company name and ID shown on your statement.
- **Stop it repeating.** If it's recurring, ask the bank to block that company, and revoke any authorization you did give.
- **Work out how they got your account number.** A cheque you sent, an invoice footer, or a supplier's leaked records are common sources. Consider moving to a new account number if it keeps happening.

## Stop it happening again

- **ACH debit block:** no ACH debits allowed on the account. Good for accounts that only receive money.
- **ACH debit filter (ACH Positive Pay):** only approved companies can debit you, and anything else is held for you to approve or return. [Positive Pay explained](https://payeeguard.pages.dev/positive-pay-small-business).
- **Check activity every banking day**, or set up alerts for every debit. With a 2-day window, a weekly check is too late.
- **Use a separate account** for paying suppliers, so the number on your invoices isn't the one holding your cash.

Sent money the wrong way instead? [ACH payment to the wrong account](https://payeeguard.pages.dev/ach-reversal-wrong-account). Supplier asked you to pay new bank details? [Verify the account first](https://payeeguard.pages.dev/vendor-bank-account-verification).

Sources: [Modern Treasury, R29 return code](https://moderntreasury.com/ach-return-codes/r29) (non-consumer accounts; RDFI must return within 2 banking days), consistent with [Nacha's rules](https://www.nacha.org/rules/reversals-and-enforcement). Read 24 October 2026. Ask your bank for its own cut-off times.

[Check a suspicious email free](https://payeeguard.pages.dev/#check) [Set up call-backs and approvals](https://payeeguard.pages.dev/app#/signup)