McMillan Law's office is in Tampa. I represent people in Clearwater and everywhere else in Florida, and the free case review happens by phone or online, so you don't have to drive anywhere to get started.
Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney
Where mystery debits come from
An ACH debit is an electronic pull from your checking account through the same system that pays a power bill or insurance premium automatically. A company that gets hold of your account and routing numbers, which are printed on every paper check, can try to start one. No card has to be stolen and no one has to log into your bank app.
The debits can look harmless: a "membership" or "protection plan" you never agreed to, or payments on a loan someone opened in your name. A charge of $29.99 or $49.99 repeated month after month is easy to miss, especially when statements go into a drawer or an email folder you rarely open. By the time anyone notices, the total can be real money for a Tampa Bay retiree living on a fixed income.
Why a debit you never set up is unauthorized
ACH debits fall squarely inside the Electronic Fund Transfer Act, a federal statute guarding electronic transfers into and out of consumer bank accounts. Regulation E, the set of rules that puts the law into practice, defines an unauthorized transfer as one started by someone other than you, without actual authority from you, that gives you no benefit. A company pulling money you never agreed to let it take fits that definition.
ACH cases have a feature that usually helps you: no card, PIN, or login was lost or stolen. The $50 and $500 limits that apply to stolen cards never come into play. If you report within 60 days after the bank sends the statement that first shows a debit, you owe nothing for it. And the bank, not you, carries the burden of proving a debit was authorized.
One honest limit: if a scammer talked you into sending a payment yourself, through your banking app or Zelle, that payment generally falls outside the federal definition of an unauthorized transfer. A debit that a company started on its own is a different animal. Who started each debit, and whether you ever agreed to it, decides which side of the line it lands on.
Found them months later? What the 60-day rule really does
This is the part that trips people up. The 60-day window is not a deadline for the earliest debits. Late notice matters only for later ones: debits taken after the 60 days following the statement that first showed the problem, and before you told the bank. Even for those, you're responsible only if the bank shows that a timely report would have stopped them.
Suppose the first unauthorized debit showed up on a statement your bank sent on April 1, and you didn't report until September. The debits taken through the end of May are still protected. The ones from June until the day you reported are the ones the bank can try to put on you, and only with proof. The one-year deadline to sue is the practical outer limit on all of this, which is why reporting today matters more than worrying about how long it took.
Late reporting can also release the bank from the formal investigation timeline that applies to timely reports. A hospital stay or extended travel that kept you from reporting can count as an extenuating circumstance, and the rules then require the bank to stretch its time limits to a reasonable period, so tell it what happened.
Even if the debits go back many months, send me the statements and anything the bank has told you so I can sort out which ones are still protected.
What the bank must do after you report
You can report by phone or in writing. A bank may require written confirmation of a phone report within 10 business days. Send it, because a bank that asked for confirmation and didn't receive it on time can hold back provisional credit.
- 10 business days
For reports made inside the 60-day window, the bank must investigate and decide within 10 business days, or provisionally credit the disputed amount so it can take up to 45 days.
- 1 business day
Once it finds an error, the bank has 1 business day to correct it, including fees and interest tied to the error.
- 3 business days
After finishing, the bank must report the result. A "no error" decision has to be explained in writing, along with your right to request the documents behind it.
The bank can't charge you a fee for investigating. My step-by-step guide to disputing an unauthorized transaction includes a sample letter you can adapt for ACH debits, and my page on bank fraud claim denials explains what to do if the answer is no.
Clearwater and Pinellas County: how I help
I take cases from Clearwater, across Pinellas County, and throughout Tampa Bay, including Countryside, Dunedin, Largo, Safety Harbor, and Clearwater Beach. Whether you're retired or still working, the first step is the same: the statements.
I go back to the first unauthorized debit, mark which ones fall inside the protected period, identify the company that started each one, and compare the bank's response with the deadlines it had to meet. If the bank already denied the claim, I request the documents it relied on. Pinellas County's state courts are part of the Sixth Judicial Circuit, which also covers Pasco County, and the federal law allows a lawsuit in state or federal court. All of it can happen by phone, video, and online uploads.
Two related problems are worth ruling out. If a loan someone opened in your name is behind the debits, check your credit too, using my guide to credit report errors in Clearwater. And if Helene or Milton forced you out of a Pinellas rental and the landlord kept your money, here's how Clearwater renters get a security deposit back.
What the bank may owe you
Under the Electronic Fund Transfer Act, a consumer can recover actual damages, starting with the money taken, plus statutory damages of $100 to $1,000. Tripled actual damages become possible when the bank gave no provisional recredit within 10 days and, on top of that, did not investigate in good faith or had no reasonable grounds for its denial. The same applies to a knowing and willful no-error finding that the evidence couldn't reasonably back up.
Monthly debits of $30 or $50 can feel too small for a lawsuit. The law answers that by shifting a winning consumer's reasonable attorney's fees and costs onto the bank. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.
Checklist: what to do today
- Call the bank and report every debit you never authorized, starting with the oldest one you can find.
- Follow up in writing to the bank's error-dispute address, list each debit by date and amount, and keep proof of mailing.
- Ask the bank to block further debits from the company and to tell you, in writing, how it will handle the older ones.
- Pull every statement back to the first unauthorized debit. Download them from online banking or ask the bank for copies.
- Check your credit reports if the debits are tied to an account you never opened.
- Send it to me. Open a free case review and include the statements and any bank letters. I'll tell you which debits are protected and what the bank may owe you.