An ACH debit is not an authorisation. Nothing is checked in real time, no balance is confirmed, and no approval code comes back. The transaction looks successful for two to five business days, and then either the money stays or a return code arrives explaining why it went away.
That delay is the whole risk model of bank payments, and the return code is the only information you get.
How the timing works
You submit a debit. It settles overnight through the network. The receiving bank has until the end of the second business day to return it for most reasons. Unauthorised returns from a consumer account have a much longer window, sixty calendar days. That last number is why ACH suits repeat customers and subscriptions, and suits one off orders from strangers rather badly.
The codes you will actually see
| Code | Meaning | What to do |
|---|---|---|
| R01 | Insufficient funds | Retry, up to two more times, ideally after payday |
| R02 | Account closed | Stop. Ask for new details |
| R03 | No account or unable to locate | Stop. Details are wrong |
| R04 | Invalid account number | Stop. Check the digits and the routing number |
| R05 | Unauthorised debit to a consumer account | Stop, and check your authorisation records |
| R07 | Authorisation revoked | Stop and cancel the mandate |
| R08 | Payment stopped | Contact the customer before retrying |
| R09 | Uncollected funds | Retry later, funds are in the account but not cleared |
| R10 and R11 | Customer says it was not authorised, or was not as agreed | Stop. Treat like a dispute and produce your authorisation |
| R16 | Account frozen | Stop |
| R20 | Non transaction account | Stop, usually a savings account with debit restrictions |
| R29 | Corporate customer says the debit was not authorised | Stop. Business accounts have a short window and use it |
Administrative returns, and why they matter more than they look
R02, R03 and R04 are administrative. They mean the details are wrong, not that the money is missing. The network watches your ratio of these and expects it under three percent. Repeatedly submitting a debit to a closed account is the fastest way to attract attention from your processor.
Unauthorised returns, R05, R07, R10, R11 and R29, carry a stricter threshold, half a percent. Exceeding it can cost you the ability to take bank payments at all. Both ratios are worth putting on a dashboard.
Retry rules that stay inside the lines
For an R01, you may resubmit twice after the original attempt, and only within a reasonable period. Retrying an unauthorised return is not permitted at all. A sensible routine looks like this:
- R01 or R09: retry once after three business days, once more after a week, then stop and email the customer.
- Any administrative return: mark the mandate invalid, email for new details, never retry the same numbers.
- Any unauthorised return: pause the subscription, keep the authorisation record, and contact the customer directly.
The authorisation record is your only defence
For every mandate, keep the date and time, the IP address, the exact wording the customer agreed to, the amount or the range, the frequency, and how they can cancel. When an R10 arrives, that record is the difference between recovering the money and writing it off. Store it for two years after the last debit.
When ACH is worth the wait
A flat fee against a percentage means bank payments win above a break even point, usually somewhere between two and four hundred, depending on your card rate. Below that, cards are cheaper once you count the extra handling of returns. Above it, the saving is large enough that many B2B sellers simply offer a discount for paying by bank.
The practical setup is to offer both, put card first for small orders and bank first for large ones, and hold fulfilment on bank payments until the return window for administrative codes has passed. The ACH page covers how that looks inside WooCommerce.