ACH debit vs ACH credit: what is the difference?

In an ACH credit, the payer's bank pushes money to the payee, as in payroll. In an ACH debit, the payee pulls money from the payer's account under an authorisation, as in a subscription. The difference decides who controls the timing and how long the payment can be returned.

Rashidatou K.Payments editor

Published: 7 August 2026
Updated: 9 October 2026
Reading time: 2 min read

Every ACH payment is either a credit or a debit. The money moves the same way at the end, from one US bank account to another. What differs is who starts it, and that decides who controls the timing, what authorisation is needed and how long the payment can be returned.

What is the difference?

	ACH credit	ACH debit
Who starts it	The payer, through their bank	The payee, through its bank
Direction	Push	Pull
Authorisation	The payer instructs its own bank	The payer authorises the payee in advance
Examples	Payroll, supplier payments, tax refunds	Subscriptions, loan payments, utility bills
Main risk	Sending to the wrong account	Unauthorised pulls, insufficient funds returns

What are SEC codes?

Every ACH entry has a Standard Entry Class (SEC) code that says what kind of payment it is and which rules apply.

Code	Use
PPD	Prearranged payment to or from a consumer account, such as payroll or a subscription
CCD	Corporate credit or debit between business accounts
CTX	Corporate trade exchange, with detailed remittance data
WEB	Consumer debit authorised online
TEL	Consumer debit authorised by phone
IAT	Part of an international payment; see international ACH

Using the wrong code matters. A debit to a consumer account sent with a corporate code can be returned as R05 for up to 60 days.

How long can each be returned?

Credits are returned mostly for account problems: closed, invalid, frozen. Debits can be returned for those reasons, for insufficient funds, and as unauthorised. For consumer accounts, unauthorised debit returns can come up to 60 calendar days after settlement. For business accounts, the window is normally two banking days. See ACH return codes for the full list.

How do you protect a business account from ACH debits?

Most US business banks offer:

ACH debit block, which refuses every ACH debit.
ACH debit filter, which only allows debits from originators you have approved, sometimes with amount limits.
ACH positive pay, which shows you each incoming debit to approve or return.

Accounts used only for receiving client payments or paying suppliers rarely need to accept debits. Turning on a block is a simple fraud control. Our guide to check fraud and Positive Pay covers the paper side.

Which should you use to collect from customers?

ACH debit suits recurring charges where you need to control timing, such as monthly subscriptions or instalments. Get clear authorisation, use a recognisable company name on the entry, and notify customers before amounts change. For one-off invoices to business clients, giving them your account details and letting them send an ACH credit avoids the authorisation work and the return risk.

How Rivet uses ACH

Rivet gives registered companies USD account details with an ACH routing number. Clients send ACH credits to pay invoices, and the company sends ACH credits to pay US suppliers and contractors from the same balance.

Questions people ask

Is direct deposit an ACH credit or debit?

A credit. The employer's bank pushes the salary into the employee's account.

Is paying a bill online an ACH debit?

Often. When you enter your account details on a biller's site, the biller usually pulls the money by ACH debit. When you pay through your own bank's bill pay, the bank usually sends a credit.

Which is safer for a business, ACH debit or credit?

For paying suppliers, ACH credit, because you control when money leaves and nobody else can pull from your account. For collecting from customers, ACH debit gives you control of timing but carries return risk.

How long can an ACH debit be reversed?

Consumers can dispute an unauthorised debit for up to 60 days after the statement. Business accounts usually have two banking days to return an unauthorised debit, using code R29.

Sources

Written by

Rashidatou K.

Payments editor

Rashidatou writes Rivet's guides to how money moves between countries: the payment rails, what each one costs, and the account details a company needs to get paid in another currency. Every figure in Rashidatou's articles is traced to the scheme rulebook, the regulator or the provider's published price list, and those sources are listed at the end.