Unauthorized ACH debits · FloridaA company pulled money from your account by ACH without your permission. The rules differ from a stolen card.

Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney

Short answer: An ACH debit you never authorized, or one that continued after you revoked permission, is an unauthorized electronic fund transfer. Because no card, PIN, or login was lost or stolen, the $50 and $500 caps don't apply; if you report within 60 days after the statement was sent, you're protected for all of it, and your bank must investigate.

What is an ACH debit, and how did a company pull money from my account?

ACH stands for Automated Clearing House, the network banks use to move money between accounts electronically. An ACH debit is a pull: a company sends an instruction through the network to take a set amount from your account using your routing and account numbers. Payroll deposits, autopay, and many app transfers travel the same way.

The two numbers that make an ACH debit possible are printed on every check you have written and sit in the files of your employer, landlord, utility, gym, and every website where you once typed them. A breach at any of them is enough. Anyone holding the pair can attempt a debit, and the network does not check whether you agreed.

On your statement the debit may appear as "ACH debit," "electronic withdrawal," or "EFT," followed by a company name and a short code, and the name may be a billing service rather than the business itself. Write down the exact descriptor; the bank will need it.

Watch for one early warning sign. Two tiny deposits you don't recognize, a few cents each, usually mean someone has linked your account to an outside app or payment service, which confirms control of an account by sending micro-deposits and asking the user to type in the amounts. If you didn't link anything, someone else did, and a larger debit tends to follow. Report the deposits to your bank before anything leaves.

The Electronic Fund Transfer Act (EFTA) is the federal law covering electronic movements of money out of a consumer's account, and Regulation E turns it into specific duties for your bank; ACH debits are squarely inside both. Paper checks and wires follow other rules. If the pull was set up by someone who logged into your online banking, the stolen-login rules on my denied fraud claim page apply instead.

Why is an unauthorized ACH debit treated differently from a stolen debit card?

Regulation E ties the $50 and $500 liability caps to a lost or stolen access device, meaning a card, PIN, or login. An ACH debit by routing and account number involves no access device, so those tiers never come into play. The only timing rule that can affect your liability is the 60-day statement rule.

Start with the definition. A transfer is unauthorized when a person other than you initiates it without actual authority and you receive no benefit from it (12 C.F.R. § 1005.2(m)). A company you never dealt with has no authority from you. A company whose permission you revoked has none either, because a revoked authorization is no authorization.

Now the liability rules. The regulation makes a consumer liable for a lost or stolen access device only when certain conditions are met, and the $50 and $500 tiers are built on that premise (§ 1005.6(a), (b)(1), (b)(2)). When no access device was involved at all, as with a debit by account number, the only provision left is the statement rule: if an unauthorized transfer appears on a periodic statement and you don't report it within 60 days after the bank sent that statement, you can be liable for transfers that happen after the 60 days and before you report, if the bank shows a timely report would have prevented them (§ 1005.6(b)(3)).

Banks sometimes describe that as "unlimited liability after 60 days." It is not. Everything on the statement you were sent remains protected; late reporting exposes only later debits the bank can prove it would have stopped. There is no reporting deadline for the first unauthorized debits, apart from the one-year limit to sue.

Missing the 60 days frees the bank from the formal error-resolution timetable for that report, but it does not change your liability for debits that already appeared, and the bank still has to prove any amount it wants to leave with you (15 U.S.C. § 1693g(b)). If a hospital stay or long trip kept you from your statements, the bank must extend the 60 days to a reasonable period (12 C.F.R. § 1005.6(b)(4)).

Your own carelessness is irrelevant under the regulation's commentary (comment 6(b)-2). Giving your account number to a legitimate company years ago does not make a different company's debit authorized. And your account agreement cannot increase your liability beyond what Regulation E allows (§ 1005.6(b)(6)).

What if it's a recurring debit I canceled or never signed up for?

A recurring debit you never set up is unauthorized from the first pull. A recurring debit you did authorize becomes unauthorized once you revoke permission, because a revoked authorization is no authorization at all. Federal law also gives you the right to tell your bank to stop a preauthorized transfer, and the bank can be liable when it fails to.

A "preauthorized electronic fund transfer" is one you agreed in advance would recur, like a monthly subscription, insurance premium, or loan payment. Two separate rights apply when one goes wrong.

The first is the error-resolution right covered throughout this page: debits you never agreed to, debits that continued after you canceled, and debits for more than the agreed amount are all errors you can report, because the regulation lists an "incorrect electronic fund transfer" alongside an unauthorized one in its definition of error (12 C.F.R. § 1005.11(a)(1)).

The second is the stop-payment right. You can instruct your bank to stop a preauthorized transfer, and the EFTA makes the bank liable for all damages proximately caused by its failure to stop one that you properly told it to stop (15 U.S.C. § 1693h(a)). The bank has limited defenses, and a bona fide error limits what you can recover to the actual damages you prove. Give the stop instruction in the way and within the time the bank specifies, confirm it in writing if asked, and keep a copy.

Tell the company too: revoke the authorization in writing and keep the confirmation. The bank's duty does not depend on the company's cooperation, but your paper trail matters if the bank claims the authorization was still in force.

What does my bank have to do when I report an unauthorized ACH debit?

Once you report within 60 days after the statement was sent, your bank must investigate and decide within 10 business days, or give you provisional credit and take up to 45 days. It can't require a police report or affidavit, can't charge a fee, and must explain any denial in writing and tell you about your right to the documents.

Your notice can be oral or written. It must let the bank identify your name and account and say why you believe there is an error, with the type, date, and amount to the extent you know them (12 C.F.R. § 1005.11(b)(1)). A federal court in North Florida held that a notice must identify the transaction, so list each debit by date, amount, and descriptor. You do not have to prove anything to trigger the bank's duty.

If you report by phone, the bank may require written confirmation within 10 business days and must tell you where to send it. It may not delay starting or finishing the investigation while it waits. If you don't send the confirmation, the bank may skip provisional credit, so send it.

A provisional credit is the bank's temporary refund of the amount in dispute. If it wants more than 10 business days, it must post that credit within the 10 business days, tell you the amount and date, give you full use of the money, and then finish within 45 days (§ 1005.11(c)(2)). The deadlines are 20 business days and 90 days for a new account, one whose first deposit came within 30 days before the debit, and 90 days for a debit started outside the United States (§ 1005.11(c)(3)). The 90-day extension for point-of-sale debit card purchases does not apply to an ACH debit.

The bank may rely only on its own records when it has no agreement with a third party for that kind of transfer; where it does, its review must reach that information (§ 1005.11(c)(4)). It may not make you contact the company first, file a police report, sign a notarized affidavit, or visit a branch as a condition of investigating, and it may not charge a fee.

If the bank finds an error, it must correct it within 1 business day, refunding any fees and interest the debit caused (§ 1005.11(c)(1)). If it finds no error, it must report that within 3 business days of finishing, with a written explanation of its findings and notice of your right to request the documents it relied on, which it must then provide promptly (§ 1005.11(d)(1)).

Why do banks deny ACH disputes?

Common reasons include that you had a relationship with the company, that the debit matched a prior authorization, that you missed a 60-day window the bank miscounted, or that the company says you agreed. None of these settle the question by itself, and the bank, not you, must prove the debit was authorized.

• "You've paid this company before." A past payment does not authorize a new one, and it certainly does not authorize debits after you canceled. Federal supervisory reports have criticized denials that rest on prior dealings.
• "The company has an authorization on file." Ask to see it. The bank must give you the documents it relied on. A checkbox clicked by someone who stole your account number is not actual authority from you.
• "Take it up with the company." The bank cannot require you to contact the company before it investigates. Your claim is against your bank under Regulation E, whatever the company did.
• "You reported too late." Count the 60 days from when the bank sent the statement showing the debit, not from the debit itself. And late reporting only shifts later debits the bank can prove it would have stopped.
• "Your written confirmation never arrived." That can excuse provisional credit. It does not excuse the investigation, the written explanation, or the bank's burden of proof.
• "The item can no longer be returned through the network." Whatever time limits apply between banks, your liability to your own bank is set by Regulation E, and no agreement can push it above what the regulation allows.

In each case the question is the same: did the bank actually determine that you authorized this debit, or did it find a reason to stop looking?

What are my rights in Florida?

The federal EFTA is the main law for an unauthorized ACH debit in Florida. Florida's deceptive practices statute exempts banks and credit unions, and the state has no electronic transfer law. You can sue in state or federal court, and Florida federal courts have ruled on what a valid error notice must contain and when the one-year clock starts.

My office is in Tampa. Everything in the case review happens by phone, email, or video, so I represent people with these claims from the Panhandle to the Keys.

The notice decision is Rallis v. First Gulf Bank (N.D. Fla. 2008), which is why I tell everyone to list each disputed debit specifically. The timing decision is Katz v. JPMorgan Chase (S.D. Fla. 2015), which held that a claim for a bank's error-resolution failure accrues when the bank missed its deadline, not when the debit posted.

Because Florida's Deceptive and Unfair Trade Practices Act leaves out banks, credit unions, and savings associations (Fla. Stat. § 501.212), a state-law unfair-practices claim against your bank is usually off the table. The EFTA's fee shifting and statutory damages are what make an individual ACH claim practical to bring.

Courts require a concrete injury; losing the use of money taken from your account, even temporarily, generally qualifies.

What is an unauthorized ACH claim worth?

A consumer whose bank violated the EFTA can seek actual damages, statutory damages of $100 to $1,000, and reasonable attorney's fees and costs. Actual damages start with the debits themselves and can include fees they triggered. If the bank withheld provisional credit and didn't investigate in good faith, the law allows three times your actual damages.

Statutory damages are available even when the debits were small, and the court sets the amount by considering the frequency and persistence of the bank's noncompliance, the nature of it, and whether it was intentional (15 U.S.C. § 1693m(a), (b)). Fee shifting is what makes a claim over a few hundred dollars of debits worth pursuing.

Treble damages apply in two situations: the bank failed to provisionally recredit within the 10-business-day period and either did not investigate in good faith or lacked a reasonable basis for believing there was no error, or the bank knowingly and willfully concluded there was no error when the evidence could not reasonably support that (§ 1693f(e)). The tripling applies to your actual damages, the money you actually lost, not to the statutory range.

A separate provision covers the stop-payment failure described above: all damages proximately caused by the bank's failure to stop a preauthorized transfer you properly instructed it to stop, subject to the bank's limited defenses (§ 1693h). You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.

How long do I have?

Three clocks matter. Report each debit within 60 days after the statement showing it was sent to keep your liability at zero. The bank then has 10 business days, or 45 days with provisional credit. And you have one year from the bank's violation to sue, which for a mishandled dispute runs from the bank's failure, not the debit.

Recurring debits complicate the count. Each month's pull appears on a new statement with its own 60-day window, so even if you are late on the early ones, report the recent ones now and protect what you can. Courts are divided on whether a series of recurring debits can be treated as one continuing violation for the one-year limit, so I treat each debit's date as its own deadline.

The one-year rule comes from the statute (15 U.S.C. § 1693m(g)), and Katz is the Florida decision that starts it at the bank's failure in error-resolution cases. A few courts have paused the clock for fairness reasons; don't plan on it.

What to do today

• Call your bank, report each debit by date, amount, and descriptor, get a claim number, and ask it to block further debits from that company. Follow up in writing to the error-resolution address and keep proof.
• If the debit is recurring, give the bank a stop-payment instruction and send the company a written revocation of authorization. Keep both.
• Scan your statements for micro-deposits, other unfamiliar descriptors, and earlier pulls from the same company you may have missed.
• Gather the documents: statements with every disputed debit marked; the exact descriptor and any company contact information shown; proof of any prior relationship and its end, such as sign-up emails and cancellation confirmations; your stop-payment request; your written notice and delivery proof; the bank's claim number, letters, and any denial; and fee or returned-item notices the debits caused.
• Don't let the bank send you to the company instead of opening a claim. Report to the company too if you like, but the bank's investigation does not wait for that.
• If the bank denied the claim, request in writing every document it relied on and note the date of your request.
• Send it to me. Request a free case review and attach the statements and letters. I'll tell you whether the bank applied the right rules and what your options are.

Sources: 15 U.S.C. §§ 1693a(12), 1693f(e), 1693g(b), 1693h, 1693m(a), (b), (c), (f), (g); 12 C.F.R. §§ 1005.2(m), 1005.6(a), (b)(1) to (6), 1005.11(a)(1), (b), (c)(1) to (4), (d)(1); Official Interpretations to Regulation E, comments 6(b)-2, 11(b)(1)-2, 11(c)-2, 11(c)-3, 11(c)(4)-5; CFPB, Electronic Fund Transfers FAQs, Error Resolution, Questions 3 and 4; Rallis v. First Gulf Bank, 2008 WL 4724745 (N.D. Fla. Oct. 24, 2008); Katz v. JPMorgan Chase, S.D. Fla., Feb. 10, 2015, 2015 WL 11251764; Fla. Stat. § 501.212. Last reviewed October 8, 2026.