Stripe ACH Disputes: Why You Can't Fight a Bank Debit Chargeback — and What Protects You Instead

By now you know the drill. The dispute email lands, your stomach drops, and then your training takes over: pull the signed agreement, the login history, the delivery confirmation, the thread where the customer said everything looked great. You open your Stripe dashboard ready to build your case — and there is nothing to build it in. No evidence form. No deadline counting down in red. Just a notice that the money has already left your balance, along with a fee, and that the decision is final.

It feels like a bug. It isn't. What you've just discovered, the expensive way, is that an ACH dispute is not a chargeback. It only dresses like one. Everything you've learned about fighting disputes — the rebuttal letters, the compelling evidence, the win rates — belongs to a rulebook that governs cards. Bank debits answer to a different authority entirely, and that authority never planned to hear your side.

Two payment rails, two rulebooks

A card payment and an ACH debit can settle into the same Stripe balance, fund the same payroll, and look identical on your revenue chart. Underneath, they run on separate systems governed by separate rules.

Card disputes live under the card networks — Visa and Mastercard's private operating rules. Those rules are famously tilted toward cardholders, but they contain something precious: representment. When a cardholder disputes a charge, the network's own process obligates someone to collect the merchant's evidence and weigh it. The fight is built in. You can lose it, but you are guaranteed the chance to have it.

ACH debits are governed by the Nacha operating rules and, for consumer bank accounts, by a piece of federal law called Regulation E. Regulation E is consumer-protection law, and it recognizes exactly two parties: the account holder and their bank. When a consumer tells their bank a debit was unauthorized, the bank has them sign a Written Statement of Unauthorized Debit and returns the money. Read that sequence again and notice who's missing. The merchant is not a party to the process. No one reads your evidence because the process has no chapter in which your evidence exists.

The 60-day window — and the two-day one

For consumer accounts, the exposure window is long. Under the Nacha rules, a bank can return a debit its customer says was unauthorized for up to 60 days after settlement, and Regulation E gives consumers 60 days from the bank statement showing the transaction to report a problem. In practice, every consumer ACH payment you accept carries roughly two months of quiet risk after the money arrives. It can be spent, reconciled, and counted as revenue — and still come back.

Business accounts are the mirror image. Corporate ACH returns for unauthorized debits must generally happen within two banking days of settlement. After that, a business customer's bank can't simply claw the money back through the network; disagreements get handled between the parties, like any other commercial dispute. This is a big part of why B2B ACH is so much calmer than consumer ACH — the window slams shut almost immediately.

The return code on a dispute matters more than most merchants realize. R10 means the customer claims they don't know you or never authorized the debit at all. R11 means an authorization exists, but the debit didn't match its terms — wrong amount, wrong date. That distinction isn't academic: under the Nacha rules, an R11 return lets you correct the error and re-originate the debit within 60 days without collecting a new authorization. One code means the money is simply gone; the other means it's recoverable if you fix your mistake.

What "final" actually means

On Stripe, an ACH Direct Debit dispute works like this: the customer's bank returns the payment, Stripe debits the disputed amount from your balance immediately, adds a $15 dispute fee, and marks the dispute lost. There is no submission process, because there is nothing to submit to. Stripe isn't withholding an appeal from you; the ACH network never built one.

The customer's bank, for its part, takes the signed statement at face value. That is exactly what the law expects of it — Regulation E instructs banks to protect their account holders, not to arbitrate commerce.

Your authorization records still matter, just not where you'd expect. If the debit really was authorized, the debt didn't vanish when the payment did. The customer still owes you, and your mandate, your terms, and your delivery records are the foundation for pursuing it directly — an invoice, a demand letter, small claims court if the amount justifies the afternoon. The recourse is real. It just lives entirely outside the payment rails.

Here is the mental model worth keeping: with cards, your protection is downstream — you fight after the dispute happens. With ACH, there is no downstream. Every ounce of protection has to move upstream, to before the debit is ever pulled.

Moving the fight upstream

Since you can't win an ACH dispute, the job is to make one unlikely, and the levers are specific.

Start with verification. Stripe requires bank accounts to be verified before you can debit them — instantly through Financial Connections, or slowly through microdeposits. Instant verification means the customer logged into their actual bank to connect the account, which makes "I don't know this merchant" a much harder story to sign your name to.

Then the mandate. Your authorization language should say plainly what will be debited, how the amount is determined, and when it happens. Stripe records mandate acceptance when the customer agrees; keep your own timestamped copy of the exact text they saw.

Then recognition. Most "unauthorized" claims are really recognition failures — the same mechanism behind friendly fraud on cards. Sixty days after the fact, a customer scanning their statement sees a cryptic descriptor, feels a flash of alarm, and calls their bank in good faith. A descriptor that names your business the way the customer knows it defuses that moment before it starts.

And then advance notice. Regulation E requires at least ten days' written notice before a preauthorized debit that varies in amount. Even when notice isn't legally required, a plain email — this amount, this date, this name on your statement — removes the surprise that fuels most disputes.

Finally, choose your rail deliberately. ACH's lower fees are priced against that 60-day, no-appeal tail. For a customer you've billed for two years, the trade is excellent. For a stranger's first payment, it often isn't.

Your next moves

• Read your statement descriptor the way a stranger would. If a customer glancing at their bank statement 45 days from now couldn't name your business from it, change it in your Stripe settings today.
• Turn on instant bank verification and stop accepting accounts that haven't completed it. Manually keyed account numbers with no verification are an open invitation for R10 returns.
• Send a pre-debit notice for every ACH pull: one templated email with the amount, the date, and the exact descriptor they'll see, sent a few days ahead.
• Rewrite your mandate language so a first-time reader could say exactly what they're authorizing, then archive every acceptance with a timestamp and the text as shown.
• Set a rail threshold. Pick the dollar amount or customer tenure below which you take cards only, and route new or unproven customers there — the higher card fee buys you the right to fight.

The fight you can actually win

Here's the sharp irony in all of this: while ACH disputes can't be contested, card disputes — the ones with a real evidence process and a real chance of winning — go unanswered by merchants every single day. The default outcome of a Stripe card dispute isn't losing a fight; it's forfeiting one, because the evidence window closed while the email sat unread. If bank debits teach anything, it's how brutal a process you can't participate in feels — which makes it strange how often merchants skip the one they can. That's the side of the ledger Argeback was built for: it ingests your Stripe disputes, drafts an evidence-backed response, and files it before the seven-day deadline, right from your phone. You can't argue with an ACH return. Everything else, you can — and should. See how it works at argeback.lumenlabs.works.