If I asked whether your money is safer in a box on your back porch or in the bank, you would say the bank and give me an eye roll.
I would push back and say the porch. Not because banks are careless, but because of what happens after the money is gone, and how little time you get to react.
I have never had anything stolen from my house, my yard or my car. Last month our company had money taken out of our business bank account, and there was nothing we could do. We knew who did it. Even then, getting it back meant taking them to court. If they had taken it off the porch, we could have called the police.
And they know the arithmetic. Take a thousand dollars, or two or three thousand, and it costs more to chase than to write off.
This is the part that surprises people, and it is written into the ACH rules rather than being any one bank’s policy.
When an unauthorized debit hits a corporate account, the return is made under reason code R29, and it has to be returned within 24 hours of settlement. That is one banking day. Published bank ACH return guides put it in exactly those terms, and note that the return has to reach the originating bank by the opening of business on the second banking day after settlement.
Now compare that with a consumer account. The same unauthorized debit is returned under R10, and the customer has 60 days, with a written statement.
Sixty days against one. That is the whole difference between a personal account and your business account, and nobody sits you down and explains it when you open the account.
Twenty four hours assumes somebody is looking at the account every single banking day, recognises every legitimate debit on sight, and can tell an unfamiliar one from a vendor you set up on autopay eight months ago.
In most companies, the person with time to look at the bank feed daily is not the person who knows which debits are supposed to be there. By the time the bank reconciliation runs at month end, the window closed weeks ago. After that you are not disputing a debit, you are pursuing someone for a debt.
Since you cannot realistically win the 24 hour race, the answer is to not be in it. Every one of these is a standard service your bank already sells, and most businesses have never been offered them.
The bank refuses ACH debits against the account by default. Nothing can be pulled out unless you have specifically permitted it. This is the blunt option and it is the strongest one. It works well on accounts that should only ever receive money.
Instead of blocking everything, the bank only lets through debits from originators on a list you approve, and you can cap the dollar amount each one is allowed to take. Anything outside the list is rejected or held for you to decide. This is what most operating accounts actually need.
You tell the bank what you have issued, the bank holds anything that does not match, and you approve or reject it. Most people have heard of this for checks. Ask your bank about their ACH version.
If every vendor, every processor and every service debits the same account, that account cannot be locked down without breaking something. Splitting deposits from the account that gets debited is what makes a block or a filter practical instead of theoretical.
Your merchant processor debits that same account every month, which is the other reason it is worth knowing exactly what is supposed to come out of it. If you are not sure what those debits are, our statement decoder covers what processors charge and what they call it.
One banking day. Under the Nacha rules an unauthorized debit to a corporate account is returned with reason code R29, and that return has to be made within 24 hours of settlement. A consumer disputing the same kind of debit uses R10 and has 60 days.
Consumer accounts carry protections that commercial accounts do not. The ACH network reflects that split in its return windows: 60 days with a written statement for a consumer, one banking day for a corporate account.
A service from your bank that refuses ACH debits against an account by default. Nothing can be pulled unless you have specifically allowed it, which removes the need to spot the debit inside 24 hours.
A softer version of a block. Instead of refusing everything, the bank only allows debits from a list of originators you approve, and optionally only up to set dollar limits. Anything else is rejected or held for your decision.
A service where you tell the bank which payments you have actually issued, and the bank holds anything that does not match for you to approve or reject. It is most commonly discussed for checks, and most banks offer an ACH equivalent.
Get Your Free Audit | Schedule A Free Consultation
Subscribe to insights | Read more Insights | Submit an article idea
Ok, now you think this never happens. Wrong – according to our bank, it happens all the time!
I got into banking to make my mother proud;
I got out of banking because I could no longer
tell my mother what I did.
Read More Check out our other insights here.
Do you have a “Risk Fee” on your credit card processing statement?
No? Good. You are luckier than a lot of merchants, and you should keep reading anyway.
You might find this an odd topic coming from me, given that I run an auditing firm specialising in credit card processing fees. But the only thing worse than being overbilled by your processor is being duped by someone claiming to be an expert in this industry, and then sued by them for non-payment once you stop paying and realise what
