Source: https://rivet.global/blog/ach-debit-blocks-and-filters-us
Published: 2026-10-08 · Updated: 2026-10-08 · By Alexia M.

# ACH debit blocks and filters: stopping unauthorised pulls

How ACH debit blocks and filters protect a business account: blocking debits, allowing named companies, ACH positive pay and the two-day return window.

## Key takeaways

- An ACH debit block rejects every ACH debit to the account; a filter allows only debits from authorised company IDs.
- ACH positive pay shows each incoming debit for approval before it posts.
- Businesses have far less time than consumers to return an unauthorised debit, often two banking days.
- Nacha's 2026 rules add fraud monitoring duties for originators and receiving banks.

Account and routing numbers are printed on every check and invoice. Anyone with them can try an ACH debit. Businesses have little time to object.

## The tools

| Tool | What it does |
|---|---|
| Debit block | Rejects all ACH debits |
| Debit filter | Allows only listed company IDs |
| ACH positive pay | Shows each debit for approval |
| Separate account for debits | Limits exposure to one balance |

## Return windows

Consumers can dispute unauthorised ACH debits for 60 days. Businesses generally have two banking days after settlement under Nacha rules. After that, recovery depends on the other party.

## Who to allow

- Payroll provider.
- IRS EFTPS and state tax agencies.
- Insurance and loan servicers.
- Key SaaS vendors that bill by ACH.

## Nacha's 2026 rules

Phased in from March 2026, Nacha's rules require risk-based fraud monitoring by originators and receiving banks, aimed at credit-push fraud. See [NACHA 2026 ACH rules](/blog/nacha-2026-ach-rules).

## A simple setup

Keep one account for receiving customer payments with debits blocked, and a separate account for vendors that need to debit you.

## Paying into the United States: the local rail

| What | Detail |
|---|---|
| Local rail | ACH for batch payments; RTP and FedNow for instant transfers |
| Run by | Nacha for ACH; The Clearing House for RTP; the Federal Reserve for FedNow |
| Settlement | Same-day ACH within the business day, standard ACH the next; RTP and FedNow in seconds, 24/7, where both banks take part |

Source: [Nacha: Same Day ACH](https://www.nacha.org/rules/same-day-ach-moving-payments-faster). Checked when this guide was last updated; the scheme's own page has the current figures.

## Where Rivet fits

Rivet balances are used for receiving and sending payments, with payouts approved by your team on Growth. Ask us about debit handling on your USD details. Rivet is not a bank; regulated partner institutions hold the funds. See [ACH return codes](/blog/ach-return-codes).

## Questions

### What is an ACH debit block?

A setting on a business account that rejects all incoming ACH debits.

### What is an ACH filter?

A list of company IDs allowed to debit the account. Others are rejected or held for review.

### How long do I have to return an unauthorised ACH debit?

For business accounts, generally two banking days after settlement under Nacha rules. Consumers have 60 days.

### What changed in 2026?

Nacha rules phased in from March 2026 require risk-based monitoring of credit-push fraud by originators and receiving institutions.