Unauthorized ACH Debit From Your Bank Account? Start With This Evidence File

If an unauthorized ACH debit appears in your bank account, do not start by guessing whether it is fraud, a forgotten subscription, or a billing mistake. Start by preserving the facts, then tell your bank or credit union that you believe the electronic fund transfer was unauthorized or in error. Contact the merchant only when that is safe and useful to identify the charge or stop future billing. A merchant call is not a substitute for giving your bank a clear error notice.

This guide is for an ACH debit, electronic fund transfer, or bank-account withdrawal that you do not recognize or did not authorize. It is not legal advice, it does not promise reimbursement, and it does not decide whether a merchant contract is valid. The goal is a clean evidence file that helps you report the problem without losing dates, details, or proof.

The first 20 minutes: preserve the transaction

Before you call anyone, capture the transaction as it appears today. Bank screens can change after a pending item posts, a merchant descriptor updates, or a reversal appears.

Evidence field	What to save	Why it matters
Posted or pending status	Screenshot or PDF of the transaction line	Pending and posted entries can show different descriptors or dates
Date shown by the bank	Transaction date, posted date, and statement period if visible	Your bank may ask when you first noticed the transfer
Amount	Exact dollars and cents	Similar merchants or retries can be separated by amount
Descriptor	Merchant name, ACH company name, trace ID, phone number, or memo text	The descriptor may identify a processor or biller, not the brand you expected
Account affected	Last four digits or account nickname, not your full account number in notes you might share	Keeps the file useful without spreading sensitive data
Your first reaction	“I do not recognize this,” “I canceled,” “I never authorized ACH,” or “amount differs”	Separates an unauthorized-transfer claim from an ordinary refund or price dispute

Do not annotate screenshots with guesses such as “fraud” unless you already know that. Use neutral labels: “unrecognized ACH debit,” “authorization not found,” or “possible unauthorized EFT.” That keeps the file factual if you later learn the charge came from a processor, trial conversion, or household member.

Decide what kind of problem you are reporting

Use this split before choosing your next move.

What happened	Best label for your notes	First reporting path
You never gave this company permission to pull from your bank account	Possible unauthorized electronic fund transfer	Notify the bank or credit union and ask how to submit the error report
You recognize the company but not the amount or date	Billing error or authorization dispute	Preserve proof, contact the merchant if useful, and ask the bank what documentation it needs
You canceled or revoked authorization but the company pulled again	Revoked authorization / recurring debit problem	Save cancellation or revocation proof, notify the bank, and use the stop-automatic-payments workflow for future pulls
A free trial or subscription converted and you missed the notice	Recurring billing or cancellation problem	Check account notices and cancellation terms; do not call it unauthorized until the facts support that
The debit is connected to a scam or account takeover	Suspected fraud	Contact the bank quickly and consider FTC reporting routes for the scam evidence

The CFPB's Regulation E error-resolution page is the official source to use for electronic fund transfer error concepts, including unauthorized electronic fund transfers. The CFPB's preauthorized-transfer and automatic-debit pages are also useful when the same merchant might pull again. FTC recurring-billing guidance is useful when the surprise charge may be a free trial, auto-renewal, or negative-option subscription rather than a stolen-account problem.

The ACH debit evidence checklist

Create one note or folder with these fields. Keep it boring and complete.

Transaction details

• Bank or credit union name.
• Account nickname or last four digits.
• Transaction date, posted date, and date you first noticed it.
• Exact amount.
• Descriptor exactly as shown.
• ACH company name, trace number, payment ID, or phone number if visible.
• Screenshot or statement PDF.
• Whether the transaction is pending, posted, reversed, or still changing.

Authorization trail

• Do you recognize the merchant, processor, or parent company?
• Did you ever give routing and account information to this company?
• Was there an online checkout, paper form, phone authorization, rent portal, utility account, gym membership, lender, insurer, or app connection?
• Do you have a cancellation confirmation, revocation notice, email, chat transcript, or account screenshot?
• Did anyone else with account access authorize it?
• Is there a free-trial, subscription, membership, or loan/payment agreement that could explain the debit?

Merchant contact record

Only contact the merchant if it is safe and useful. If the charge looks connected to account takeover, phishing, or a scam, ask the bank how to proceed before calling a suspicious number from the descriptor.

If you do contact the merchant, record:

• Date and time.
• Phone number, chat link, or email used.
• Name or ID of the representative if provided.
• What you asked: “Please identify this ACH debit and provide the authorization record.”
• What they said caused the debit.
• Whether they offered a refund, cancellation, reversal, or proof of authorization.
• Any confirmation number or follow-up deadline.

Do not rely on a verbal promise. Ask for written confirmation or save the chat transcript.

Bank contact record

When you contact the bank or credit union, be clear that you are reporting an unauthorized or unrecognized electronic fund transfer, not merely asking for general advice.

Record:

• Date and time of the notice.
• Channel: phone, secure message, branch, dispute form, or mail.
• Exact wording you used.
• Case number, claim number, or reference number.
• Whether the bank asks for a written statement or form.
• Whether a new account, account block, stop payment, or merchant-specific control is recommended.
• Any follow-up date the bank gives you.

A useful sentence is: “I am reporting an ACH debit from my bank account that I do not recognize and did not authorize. Please tell me how to submit the electronic fund transfer error information and what documentation you need.”

Message template for your bank

Use this as a starting point. Replace brackets with your details and do not include full account numbers in an insecure message.

Subject: Possible unauthorized ACH debit / electronic fund transfer error

I am reporting a bank-account debit that I do not recognize or did not authorize.

Transaction date: [date]
Posted date, if different: [date]
Amount: [$]
Descriptor / company name shown: [exact text]
Account affected: [account nickname or last four digits]
Date I first noticed it: [date]

What I know so far: [I do not recognize the merchant / I recognize the merchant but did not authorize ACH / I canceled or revoked authorization on date / other factual detail]

Please tell me how to submit the required error information, whether you need a signed statement, and what steps are available to prevent additional debits from the same source while this is reviewed.

I can provide screenshots, statements, cancellation records, merchant messages, or other documentation if needed.

If the same merchant may debit again

A posted unauthorized-debit report and a future-payment stop are related, but they are not the same task. For the future-payment side, the CFPB's automatic-debit guidance says consumers can contact the company and their bank or credit union when stopping automatic payments from a bank account. Regulation E's preauthorized-transfer section is the official reference for preauthorized EFT concepts.

Your evidence file should therefore have two lanes:

Lane	Question	Proof to save
Past debit	Was this posted debit unauthorized, incorrect, or otherwise an error?	Transaction screenshot, authorization search, bank error notice, merchant response
Future debits	Can the same company pull again next cycle?	Revocation notice, bank stop-payment or block instructions, next due date, confirmation numbers

If you need the future-debit workflow, use the related Bill Cleanup guide on stopping automatic payments from your bank account after you finish the evidence file for the posted debit.

What not to say or do

• Do not say every unrecognized ACH debit is fraud. A descriptor may belong to a legitimate merchant, processor, landlord portal, insurer, lender, gym, or subscription platform.
• Do not wait for the merchant to call back before notifying the bank if you believe the transfer was unauthorized or an error.
• Do not send your full account number, online-banking password, one-time codes, or debit-card PIN to a merchant or anyone who contacts you.
• Do not assume a refund promise, a reversal, or a provisional credit is guaranteed. Outcomes depend on facts, timing, bank procedures, and applicable rules.
• Do not use a charge dispute to avoid a valid bill. If the bill is valid but the payment method was wrong, separate the payment-method issue from the amount owed.

Follow-up tracker

Follow-up item	Due date	Owner	Status	Proof saved
Bank error notice submitted		You / bank
Written statement or form returned		You
Merchant authorization requested		Merchant
Future ACH authorization revoked, if needed		You / merchant
Bank stop-payment or account-control option confirmed, if needed		Bank
Next statement checked		You
Final bank response reviewed		Bank

Put reminders on your calendar. The evidence file is only useful if you use it to follow up.

Example: how the file prevents confusion

Suppose a $42.18 ACH debit posts with a descriptor you do not recognize. You screenshot it while it is pending, then again after it posts. The posted descriptor adds a company name that looks like a billing processor. You search email and find a canceled gym membership that used bank-account billing, but you do not find the cancellation confirmation. You message the gym asking for the authorization record and cancellation status, and you also notify the bank that you do not recognize the ACH debit and need the electronic fund transfer error process.

That file does not prove the outcome. It does something more practical: it keeps the merchant-identification work, the bank notice, the cancellation search, and the future-debit prevention steps separate. You are no longer trying to reconstruct the story from memory a week later.

FAQ

Is every unauthorized ACH debit fraud?

No. Treat it as unrecognized or possibly unauthorized until the facts are clearer. It may be fraud, but it may also be a confusing descriptor, a processor name, a household authorization, a trial conversion, or a merchant billing error. Preserve the evidence and report accurately.

Should I call the merchant first or the bank first?

If you believe the bank-account transfer was unauthorized or an electronic fund transfer error, notify the bank or credit union. You can also contact the merchant when it is safe and useful, especially to identify the charge or request authorization proof, but a merchant call should not replace the bank notice.

What if I authorized the merchant before but canceled?

Save the cancellation or revocation proof, ask the merchant for its authorization and billing record, and tell the bank what changed. Then handle the future-payment lane separately so the same merchant does not keep pulling while the posted debit is reviewed.

Can I get my money back?

Maybe, but do not build the file around a guaranteed result. The bank or credit union will review the facts under its process and applicable electronic fund transfer rules. Your job is to give a timely, factual notice and keep proof of every step.

What if the debit is tied to a scam?

Contact your bank quickly and preserve any scam evidence: messages, fake invoices, phone numbers, emails, websites, and payment details. The FTC scam guidance can help you decide what to report and what records to keep.

Claim ledger

Claim	Source	Checked	Confidence
A consumer who believes an electronic fund transfer was unauthorized or otherwise an error should notify the financial institution through its error-resolution process; this article does not guarantee an outcome.	CFPB Regulation E, 12 CFR 1005.11	2026-09-04	High
Preauthorized electronic fund transfer guidance supports treating authorization, revocation, and future stop-payment controls as a separate lane from the already-posted debit report.	CFPB Regulation E, 12 CFR 1005.10	2026-09-04	High
CFPB automatic-debit guidance supports contacting both the company and the bank or credit union when stopping automatic debits from a bank account.	CFPB Ask CFPB automatic debit guidance	2026-09-04	High
FTC recurring-billing guidance supports checking free-trial, auto-renewal, and negative-option records before assuming every surprise recurring charge is fraud.	FTC Consumer Advice on free trials, auto-renewals, and negative-option subscriptions	2026-09-04	High

Sources

• CFPB, “How do I stop automatic payments from my bank account?” HTTP 200 observed 2026-09-04. Used for company-and-bank automatic debit stop guidance.
• CFPB Regulation E, 12 CFR 1005.11, error resolution. HTTP 200 observed 2026-09-04. Used for electronic fund transfer error and unauthorized-transfer framing.
• CFPB Regulation E, 12 CFR 1005.10, preauthorized transfers. HTTP 200 observed 2026-09-04. Used for preauthorized electronic transfer and stop-payment concepts.
• FTC Consumer Advice, “Getting in and out of free trials, auto-renewals, and negative option subscriptions.” HTTP 200 observed 2026-09-04. Used for recurring-billing and authorization-record context.
• FTC Consumer Advice, “What to do if you were scammed.” HTTP 200 observed 2026-09-04. Used for scam-documentation and reporting context.