Can You Reverse an ACH Payment? What NACHA's Rules Actually Allow
A fraudulent wire transfer has a well-known recovery process — the FBI's Financial Fraud Kill Chain. ACH doesn't work the same way. There's no equivalent federal program, and the rules governing whether you can get money back are set by NACHA, the private body that operates the ACH network — with dramatically different windows depending on whether you're a consumer or a business. Here's what those rules actually say, and why speed matters even more for a business account than a personal one.
Reversal vs. Return — They're Not the Same Thing
NACHA's rules use two different terms that get conflated constantly, and the difference determines your actual timeline.
Initiated by the originator (the party who sent the payment) to pull back an entry they sent by mistake. Must happen within 5 banking days, and only for specific permitted reasons — a duplicate entry, wrong amount, or payment to the wrong account. Not a general "I want my money back" tool.
Initiated by the receiving bank to send an entry back — for reasons like insufficient funds, a closed account, or an unauthorized transaction. Timelines vary sharply: about 2 banking days for most commercial errors, but up to 60 calendar days for an unauthorized debit on a consumer account.
NACHA explicitly restricts reversals to correcting genuine errors — not for taking back a payment because you changed your mind, or because you later regretted sending it. Using a reversal request improperly is itself a rules violation, and repeated misuse can lead to penalties for the originating bank. If your situation isn't a duplicate/wrong-amount/wrong-account error, a reversal likely isn't the right tool — you're in return or dispute territory instead.
Why Business Accounts Have Weaker Protection
This is the part that catches AP teams off guard. Regulation E — the federal rule that gives consumers up to 60 calendar days to dispute an unauthorized debit — specifically covers consumer accounts. Business and commercial accounts fall outside Reg E entirely. That means a business's actual protection comes down to NACHA's operating rules and whatever agreement is in place with its bank, not a federal consumer-protection floor.
In practice, this means a business error or unauthorized debit typically needs to be caught and reported far faster — commonly within about 2 banking days for a return to go through cleanly — compared to the 60-day window an individual consumer would get for the same kind of unauthorized transaction. The 2026 NACHA rule updates are pushing more fraud-monitoring responsibility onto businesses themselves for exactly this reason: the existing safety net was never built with business accounts in mind the way it was for consumers.
What to Do the Moment You Spot a Bad ACH Payment
A phone call gets a reversal or return request moving today. Every hour inside the 2–5 banking day windows above matters — this isn't a process that rewards waiting to "gather more information" first.
If you sent the payment and it was a genuine error on your end (duplicate, wrong amount, wrong account), your bank can request a reversal within 5 banking days. If the payment was unauthorized or fraudulent, you're asking the receiving bank to process a return instead — a different process with a shorter window on a business account.
If the payment was authorized under false pretenses — a fake vendor bank-detail change, a BEC email, a spoofed invoice — file a report at ic3.gov. This doesn't replace calling your bank first, but it creates a federal record and can support recovery efforts beyond what NACHA's own return process covers.
Document the error or fraud in writing to your bank as soon as you've made the call. Written documentation matters if the situation escalates into a dispute your bank has to formally process or defend.
Preventing the Problem Before the Payment Sends
Given how much shorter and less forgiving the business-account timelines are compared to consumer protections, catching a bad ACH payment before it sends is worth far more than being fast about reversing it afterward.
Open the Transaction tab in the app and paste in the routing number, amount, and any notes about the request. PaySentinel checks the routing number's checksum validity, flags round or just-under-threshold amounts, and screens for urgency/pressure language commonly used in ACH fraud — free, no account required. There's also a local-only check option that runs entirely in your browser if you'd rather nothing leave your device.
Check a payment before it sends
Paste in the routing number, amount, and any request details — PaySentinel checks for known fraud signals and gives you a risk score in under a minute. Free for small businesses.
Check it free →Frequently Asked Questions
Yes, but only under narrow conditions. The originator can request a reversal within 5 banking days, and only for specific NACHA-permitted reasons such as a duplicate entry or an incorrect amount — not simply because you changed your mind or discovered fraud after the fact. Reversals used for any other reason are considered improper under NACHA's rules.
It depends heavily on whether the account is a consumer or business account. Consumer accounts get up to 60 calendar days to dispute an unauthorized debit under Regulation E. Business accounts generally do not get this same protection — commercial errors typically must be caught and returned within about 2 banking days, a dramatically shorter window.
Regulation E, which provides the 60-day consumer dispute window, specifically covers consumer accounts. Business and commercial accounts fall outside that protection, so banks and NACHA's own operating rules — not federal consumer protection law — govern how fast a business must act, and those windows are much shorter.
Call your bank immediately and ask them to initiate an ACH reversal or return request with the receiving bank — speed matters, since the windows involved are measured in days, not weeks. Document everything in writing, and if the payment was authorized under false pretenses, also file a report with the FBI's IC3 at ic3.gov.