ACH payments are generally safe, but the protection you get depends on whether you authorized the payment and how quickly you report a problem
ACH (Automated Clearing House) transfers move money directly between bank accounts through a federal system that has been running since 1974. The system itself is secure—your bank encrypts the data, and the Federal Reserve oversees the network. But safety also depends on you: whether you gave permission for the payment, whether you notice fraud quickly, and whether your bank acts on your report.
If you authorized an ACH payment and it went to the right account, you are protected by basic banking security. If someone else initiated an ACH payment from your account without permission, you have legal protection under the Electronic Funds Transfer Act (EFTA), but only if you report it within a specific window. If you authorized a payment to a scammer, the protection is much weaker.
Key Takeaways
- ACH transfers use encryption and Federal Reserve oversight, making the system itself secure against hackers intercepting your data in transit.
- Unauthorized ACH withdrawals from your account are covered under the Electronic Funds Transfer Act if you report them within 60 days; reporting within two business days limits your loss to $50.
- If you authorized an ACH payment to a scammer or gave your account details to someone fraudulently, the EFTA does not cover you, and recovery is difficult.
- ACH payments cannot be reversed once they settle (usually one to two business days), so confirming the recipient account number before you authorize is your main defense.
- Your bank's fraud monitoring may catch suspicious ACH activity and block it before it leaves your account, but this varies by bank and is not may provide.
How the ACH system protects your data
The ACH network itself does not store your full account number or routing number in a way that is exposed to the internet. When you authorize an ACH payment, your bank encrypts your account details and sends them through the Federal Reserve's secure network to the receiving bank. The data is not transmitted in plain text, and the network does not pass through the public internet the way a credit card payment might.
This means a hacker sitting on your home WiFi cannot intercept an ACH payment the way they might intercept an unencrypted email. The risk of someone stealing your ACH details during transmission is low. The larger risk is someone obtaining your account number and routing number through other means—a data breach at a company you do business with, a phishing email, or a scammer you gave the information to directly.
What the Electronic Funds Transfer Act covers and does not cover
The EFTA is a federal law that protects you if someone withdraws money from your account without your permission. If a thief or scammer initiates an ACH debit from your account, you are not liable for the full amount—your liability depends on how fast you report it.
If you report the unauthorized transfer within two business days of discovering it, your loss is capped at $50. If you report it between two business days and 60 days after your statement is sent, your loss is capped at $500. If you wait longer than 60 days, you may lose the entire amount, and your bank has no obligation to refund you.
The EFTA does not cover you if you authorized the payment. This is the critical distinction. If you gave your account number to someone, or if you authorized an ACH payment to an account you thought was legitimate but turned out to be controlled by a scammer, the EFTA does not apply. You authorized the transaction, even if you were deceived about who would receive it. In these cases, recovery depends on whether your bank's fraud team can reverse the payment or trace it to the receiving bank—and this is not may provide.
When ACH payments cannot be reversed
ACH transfers settle in one to two business days. Once the money reaches the receiving bank and the receiving account holder has access to it, reversing the payment becomes much harder. Your bank can attempt a reversal, but it requires the cooperation of the receiving bank, and the receiving bank is not required to reverse a completed transaction.
If you authorized a payment to a scammer and realize the mistake after the money has settled, your options are limited. You can ask your bank to attempt a reversal, but this often fails because the receiving account is controlled by the scammer or a money mule who has already moved the funds. You can report the fraud to your bank and to the Federal Trade Commission (FTC), but this is primarily for documentation and investigation—it does not may provide your money comes back.
This is why confirming the recipient account number before you authorize an ACH payment is so important. Once you click send, the money is essentially gone if the account is wrong or fraudulent.
How to spot ACH fraud before you authorize it
Most ACH fraud happens because someone tricks you into authorizing a payment to the wrong account. A common scam is a fake invoice or email that looks like it came from your landlord, utility company, or contractor, asking you to update your payment information or make an urgent payment to a new account. You authorize the ACH payment thinking you are paying the real company, but the account belongs to a scammer.
Before you authorize any ACH payment, verify the recipient through a method you know is legitimate. If an invoice asks you to pay to a new account, call the company using a phone number from their official website or a past bill—not a number in the email. If your landlord asks you to pay to a different account, call them directly. If a contractor sends an invoice with new banking details, confirm it by phone or in person.
Do not rely on the name on the receiving account. A scammer can open a bank account under a fake business name or someone else's name. The account name might say "ABC Plumbing" even though it belongs to a criminal. Your bank will not verify that the account name matches the actual business.
What your bank's fraud monitoring can and cannot do
Most banks run fraud detection software that flags unusual ACH activity—a payment to a new recipient, a payment much larger than your normal transfers, or a payment at an unusual time. If the software flags a transaction, your bank may block it and call you to confirm it is legitimate. This is helpful, but it is not foolproof.
Fraud monitoring is based on patterns. If you normally make large ACH transfers, the software may not flag a fraudulent one. If a scammer has been slowly building up your account activity over weeks, the next large transfer may not look unusual. Some banks have more sophisticated monitoring than others, and the threshold for flagging a transaction varies.
You should not rely on your bank to catch fraud for you. Your own verification before you authorize a payment is the strongest defense.
Steps to take if you discover unauthorized ACH activity
If you see an ACH withdrawal from your account that you did not authorize, act immediately. Call your bank's fraud line (the number is on the back of your debit card or in your online banking portal) and report the transaction. Do not use a phone number from an email or text message claiming to be from your bank.
Tell your bank the date you discovered the unauthorized transfer and the date it was initiated. Your bank will ask you to confirm that you did not authorize it. Document everything in writing—send an email to your bank's fraud department summarizing the call, the transaction amount, the date, and the receiving account if you know it. Keep a copy for your records.
Your bank will investigate and may issue a provisional credit while they work with the receiving bank. If the receiving bank confirms the transfer was unauthorized, your bank will make the credit permanent. If the receiving bank says the transfer was authorized on their end (which is common if the receiving account is controlled by the scammer), the investigation may stall. In that case, file a report with the Federal Trade Commission at reportfraud.ftc.gov and consider reporting the fraud to your state's attorney general or local police.
ACH safety compared to other payment methods
ACH is generally safer than wire transfers because ACH payments can sometimes be reversed, while wire transfers almost never can. ACH is also safer than giving someone a blank check or your debit card number, because the transaction goes through a regulated network with fraud protections built in.
ACH is less safe than a credit card payment because credit card fraud is covered by the Fair Credit Billing Act, which gives you stronger protections and a longer window to report fraud. With a credit card, you can dispute a charge and the credit card company investigates; with ACH, the burden is on you to report quickly and on your bank to recover the money.
ACH is safer than peer-to-peer payment apps like Venmo or Cash App because those platforms offer almost no fraud protection for unauthorized transfers. If someone gains access to your Venmo account and sends money, you have limited recourse.
Frequently Asked Questions
Can someone use my account number and routing number to withdraw money without my permission?
Yes, but you are protected by the EFTA if you report it quickly. If you report an unauthorized ACH withdrawal within two business days, your loss is capped at $50. Report it within 60 days and your loss is capped at $500. After 60 days, you may not be covered. This is why monitoring your bank statements is important.
Is it safe to give my account number and routing number to a company I trust?
Yes, if the company is legitimate and you initiated the request. Your routing number is public information (it identifies your bank), and your account number alone cannot be used to make a payment without authorization from your bank. The risk is if the company's database is breached or if you give the information to a scammer posing as a legitimate company. Verify the company through an official channel before you share your details.
What happens if I authorize an ACH payment to the wrong account by mistake?
Once the payment settles, reversing it is difficult. Your bank can attempt to contact the receiving bank and ask them to reverse it, but they are not required to do so. If the receiving account holder has already spent the money, recovery is unlikely. This is why double-checking the account number before you authorize is critical. Some banks allow you to cancel an ACH payment if you catch the mistake before it settles (usually within a few hours), so call immediately if you make a mistake.
Does my bank monitor ACH payments for fraud?
Most banks run fraud detection software that may flag unusual ACH activity, but this is not may provide to catch fraud. The software looks for patterns that deviate from your normal behavior. If a scammer has been gradually building up activity on your account or if your normal transfers are large, fraud monitoring may miss it. You should not rely on your bank to catch fraud; verify recipients yourself before you authorize any payment.
What should I do if I authorized an ACH payment to a scammer?
Call your bank immediately and explain that you were deceived. Your bank may attempt to reverse the payment, but this often fails if the receiving account is controlled by the scammer or the money has already been moved. File a report with the Federal Trade Commission at reportfraud.ftc.gov and with your state's attorney general. Document everything and keep records of all communication with your bank. Recovery is not may provide, but reporting creates an official record that may help law enforcement investigate.