ACH debit blocks and filters: stopping unauthorised pulls

Anyone with your account and routing number can try to pull money by ACH debit. A debit block stops all of them; a filter allows only the companies you authorise.

Alexia M.Comparisons and market guides editor

Published: 8 October 2026
Reading time: 1 min read

Account and routing numbers are printed on every check and invoice. Anyone with them can try an ACH debit. Businesses have little time to object.

The tools

Tool	What it does
Debit block	Rejects all ACH debits
Debit filter	Allows only listed company IDs
ACH positive pay	Shows each debit for approval
Separate account for debits	Limits exposure to one balance

Return windows

Consumers can dispute unauthorised ACH debits for 60 days. Businesses generally have two banking days after settlement under Nacha rules. After that, recovery depends on the other party.

Who to allow

Payroll provider.
IRS EFTPS and state tax agencies.
Insurance and loan servicers.
Key SaaS vendors that bill by ACH.

Nacha's 2026 rules

Phased in from March 2026, Nacha's rules require risk-based fraud monitoring by originators and receiving banks, aimed at credit-push fraud. See NACHA 2026 ACH rules.

A simple setup

Keep one account for receiving customer payments with debits blocked, and a separate account for vendors that need to debit you.

Paying into the United States: the local rail

What	Detail
Local rail	ACH for batch payments; RTP and FedNow for instant transfers
Run by	Nacha for ACH; The Clearing House for RTP; the Federal Reserve for FedNow
Settlement	Same-day ACH within the business day, standard ACH the next; RTP and FedNow in seconds, 24/7, where both banks take part

Source: Nacha: Same Day ACH. Checked when this guide was last updated; the scheme's own page has the current figures.

Where Rivet fits

Rivet balances are used for receiving and sending payments, with payouts approved by your team on Growth. Ask us about debit handling on your USD details. Rivet is not a bank; regulated partner institutions hold the funds. See ACH return codes.

Questions people ask

What is an ACH debit block?

A setting on a business account that rejects all incoming ACH debits.

What is an ACH filter?

A list of company IDs allowed to debit the account. Others are rejected or held for review.

How long do I have to return an unauthorised ACH debit?

For business accounts, generally two banking days after settlement under Nacha rules. Consumers have 60 days.

What changed in 2026?

Nacha rules phased in from March 2026 require risk-based monitoring of credit-push fraud by originators and receiving institutions.

Sources

Written by

Alexia M.

Comparisons and market guides editor

Alexia compares the accounts, cards and payment tools companies weigh before they switch, and writes Rivet's market guides for founders in a specific country. Prices in Alexia's comparisons come from each provider's own pricing page on the date given in the article, rules come from the regulator or tax authority that sets them, and every source is listed at the end.