1

How can I setup a bank account in the US that can receive ACH credits but block all ACH debits?

I have a bank account for my business that has an ACH routing and account number, so that my customers can pay me over ACH transfers. Unfortunately, unlike cryptocurrencies like bitcion, the security model of ACH is fundamentally flawed and backwards in that it's a pull-based transfer, not push-based. That means, unless you setup safeguards with your bank otherwise, anyone with you bank's routing number and your account number has all the technical credentials required to withdrawal money from your account.

What I want is a push-only (bitcoin-like) US bank account. One where nobody but me has the credentials to withdrawal money from the account. One where the only way for money to leave the bank account is by me pushing it out. And I don't want this protection to be provided by "policy" or "legal" means. I want a technical solution that locks the funds with a private key that I never share with anyone.

inb4: Oh but ACH is secure

The FTC reports that consumers reported losing more than $5.8 billion to fraud in 2021. Millions of that was ACH fraud.

Of course the US federal government mandates that consumers have the legal right to fight the charges and get them rolled-back, but only if you report them within 60 days. So if someone maliciously uses your payment information to steal money from your account and you don't notice it for a few months, good luck.

Those legal protections don't help for idle accounts that you just want to leave in cold storage for a few years--where you only check on their balance and accrued interest once every 12-36 months.

I'd rather just eliminate the risk by blocking all Direct Debits.

The US government gives consumers of financial products some legal rights. I have a few questions:

  1. Does the US give bank customers the right to issue a formal ACH instruction: Block Account to all Direct Debit Payments that forces the bank to block all direct debits?
  2. If not, which banks allow me to setup a bank account with "ACH credit-only" account details?
  3. And, better, is there any bank that will allow me to mint a new "ACH credit-only" account number for every transaction, like how bitcoin public keys work?
3
  • "So if someone maliciously uses your payment information to steal money from your account and you don't notice it for a few months, good luck." How is that wven possible? Are there people who are so unintersted in money that they don't look at it for months?
    – glglgl
    Nov 29, 2022 at 12:26
  • @glglgl I know we're on the "money" SE, but of course there's people who are uninterested in money lol. But there's also people with US bank accounts that don't live in the US and of-course they don't check it for months. Like US Americans who live/work overseas and leave their old accounts open for obvious reasons, but only check their balances once or every few years. Or people from other countries that worked in the US for some time but no longer do. I'd argue that banks should be designed to be secure, so you can trust them not to loose your money. Unfortunately, they're not :( Nov 29, 2022 at 18:26

2 Answers 2

4

Business accounts

Positive Pay

Several banks offer a service called "Positive Pay" for business accounts, which basically offers the ability to create a list of checks you have issued and a list of merchants who are permitted to make ACH debits against the account.

Anytime someone attempts to cash a check against the account or make an ACH debit against the account, and the check or ACH debit is not on the list of authorized transactions, this will be considered an "exception item."

Whenever there is an exception item you will have the opportunity to review the transaction and either approve or return it. If you do not review the transaction by the deadline, most banks will automatically return the transaction.

A few things to keep in mind:

  • Some banks advertise that they offer "Positive Pay" but they actually only offer Check Positive Pay and not ACH Positive Pay. When looking for banks offering Positive Pay, ensure that they also offer ACH Positive Pay

  • Some banks will refer to ACH Positive Pay as "ACH Debit Filters"

  • Some banks will pay exception items by default instead of returning them if no decision is made. I would suggest using a bank that returns items by default.

  • For most banks, this service is offered as part of their "treasury management" or "cash management" services

ACH Debit Block

This is not as common as Positive Pay, but several banks do offer a service called "ACH Debit Block" which blanketly blocks all ACH debits.

Like Positive Pay, this is typically only offered on commercial accounts.

Note that simply using this will not block checks from cashing. You'll need to either place a "Check Block" (if offered) or enroll in Check Positive Pay to block checks from cashing.


Personal accounts

Account restrictions

Some banks offer consumers the ability to place a restriction on their accounts which blocks all withdrawals but still allows deposits. Some banks offer a similar option but the restriction blocks deposits as well.

At my primary bank, I keep one of my accounts with such a restriction in place and use this account to receive direct deposits. Because of the restriction, the direct deposits (ACH credits) go through but any ACH debits would be blocked.

Once I receive the direct deposit, I call the bank to temporarily lift the restriction, make an internal transfer to my other accounts, and then ask them to reinstate the restriction.

I also keep such a restriction in place with my "long term savings" account so that any attempt to withdraw money would fail until I call the bank to remove the restriction.

Some things to keep in mind:

  • Most banks do not offer this, but there are a sizable amount of banks which do

  • Make sure that you keep the account active, as inactive accounts can sometimes be automatically closed, and in some cases, they can be turned over to the state

  • Some banks will allow you to keep this restriction for as long as you want with no caveats (as long as the account remains active). However, other banks might automatically close the account if the restriction remains in place long enough

  • Of the banks that offer this, most banks allow you to place lift the restriction without delay by calling the bank. However, a few of the banks that offer this are not able to place or lift the restriction immediately and you may need to wait a few days for it to take effect

CD accounts

Most CD accounts are not able to accept ACH debits (or credits). Therefore, I would consider a CD account to be much more secure than a regular savings account.

Some banks offer "No Penalty CDs" which allow you to withdraw from the CD at any time without penalty.

Having multiple non-overdraftable accounts at the same bank

I would suggest having at least two accounts: one to make transactions, and one to hold money. When I am not expecting an ACH debit to come through, I keep the transactional account empty. I virtually never share the account number for the account which holds the money

Personally, I go beyond two accounts and have distinct accounts for different roles: one for credit card payments, one for external transfers, one for pushing money, one for debit card use, etc.

Therefore, if one of the account numbers is compromised, the worst case scenario is that only one of the accounts is drained and I keep most of my money.

However, it is important to note that this only works if the bank doesn't allow the accounts to be overdrafted. If the accounts do allow overdrafts, one of these accounts can go in the negative, which defeats the purpose of doing this.


ACH fraud is a valid concern. Contrary to popular belief, you do NOT need to be a reputable business to initiate an ACH debit.

Most major Banks even offer a service called "ACH Debit Origination" (the ability to post ACH debits) as part of their treasury management solutions, which they will provide to almost any business willing to pay the fees needed to utilize this service.

It is my belief that the entire concept of "ACH debits" is extremely dumb. It makes zero sense to allow anyone with the account number to withdraw money, and then say "dOn'T wOrRy aBoUt fRaUd, yOu cAn DiSpUtE iT" (not to mention that there is no guarantee that they will rule in your favor, even if the transaction was actual fraud).

That's like saying "don't bother keeping a fire extinguisher in your house, home insurance will buy you a new house if your's burns down."

In any case, I have done significant research on the topic and these are the only solutions that I have been able to find.

8
  • "Of the banks that offer this, most banks allow you to place lift the restriction without delay by calling the bank." Ugh, what good is a security measure if an attacker can simply call the bank, and socially engineer the customer support representative to bypass the block (of course "proving" they're you by supplying them with "private" information about you that's trivial to buy online). Point is: only requests that are cryptographically signed by your private keys should be sufficient to change the account's security settings. Nov 28, 2022 at 13:52
  • Fantastic answer, especially the tip to use no-penalty CDs. But all this begs the question: where can I find a list of banks that offer ACH Check Block and ACH Debit Block for personal accounts? Nov 28, 2022 at 13:59
  • @MichaelAltfield sadly, I have searched extensively and was unable to find even a single bank in the US that offers this for personal accounts. I would suggest either using a business account or finding a bank that offers account restrictions that also offers verbal passwords to prevent callers from pretending to be you. Some banks will require a photo ID and an in-branch visit to reset a verbal password, and this is the best security you're going to get from a bank. This is the beautiful thing about crypto: if they don't have the keys, they CANNOT steal the crypto. Nov 28, 2022 at 15:22
  • @MichaelAltfield I should also note that CDs typically won't accept ACH credits either, so they should be seen as a way of "holding money" and not as a way of "collecting money." Nov 28, 2022 at 15:26
  • Verbal passwords are not passwords. Passwords don't get stored in cleartext, and there's a very high chance that US banks are storing your "verbal password" on their system in plaintext. Also, this concept is vulnerable to replay attack. Once you use it once over the phone, it's definitely no longer secure. The name "verbal password" itself is misleading. They should just be called "insecure, emergency, one-time-use, backdoor phrase". Personally, I'd rather not have any backdoors into my bank account. Nov 28, 2022 at 15:32
4

TL;DR:

No, you can't easily get what you want in the US (but you can in most of the rest of the world).

Background/Rant

I have written on multiple occasions on this site about the archaic and frail US banking system (example). You're describing the consequences.

Almost everywhere else in the world, your question wouldn't even make sense. Someone withdrawing money from my account? How? Why? In the US, however, that's exactly how it works. All the inter-account bank transfers are handled either through FedWire or through ACH. The FedWire is for wire transfers and is working using the "push" model you want. You cannot pull wire transfers. ACH, on the other hand, is for everything else and is much cheaper to use. It works both ways - you can push money using ACH and you can pull it as well.

The reason ACH works the way it works is because it was initially design to handle check clearing. You write someone a check, they deposit it and their bank pulls the money through ACH. Nowadays you don't have to give an actual paper check for that to work, you can just give your account details (account number and routing number) that are usually printed on every check - and the person can pull funds as if they had a check in their hands.

Answers

Back to your specific question - can you block the "pull" ACH mode? Let's cover some options:

Does the US give bank customers the right to issue a formal ACH instruction: Block Account to all Direct Debit Payments that forces the bank to block all direct debits?

It would probably depend on a bank, but I'm not familiar with any bank that would advertise any such feature.

If not, which banks allow me to setup a bank account with "ACH credit-only" account details?

Similarly, not familiar with any bank explicitly advertising such a feature.

And, better, is there any bank that will allow me to mint a new "ACH credit-only" account number for every transaction, like how bitcoin public keys work?

Highly unlikely. While technically possible, I don't see why any bank would agree to thrash their account databases in such a way.


Alternatives

Negotiate with the bank. While they may not be advertising features for general public, they may be able to enable/disable certain specific features for specific clients on an individual basis. If you're a large volume business account that provides revenue to the bank in fees, balances and loans - they may be more willing to tailor account specifically to your needs.

Dedicated accounts can help - use one specific account that you give out to others and leave only enough money to satisfy any potential obligations on it. Any extra money that arrives from your payers would be immediately transferred to your main account. Thus risk is limited to the minor ($0?) balance of the dedicated account.

18
  • 2
    @glibdud you can instruct your bank to not allow overdrafts. In fact, AFAIK overdraft rules were recently changed so that you must opt-in for banks to allow overdrafts.
    – littleadv
    Nov 5, 2022 at 19:11
  • 2
    Here's an example of a bank explicitly advertising declining charges for lack of funds as an account feature: personal.chase.com/personal/secure-banking
    – littleadv
    Nov 6, 2022 at 3:55
  • 2
    "Almost everywhere else in the world, your question wouldn't even make sense. Someone withdrawing money from my account? How?" Unfortunately, the same problem exists outside the US. SEPA also supports pull-based direct debits, and you only need the IBAN and account number to take money from someone else's account. Further restrictions vary country-to-country. One example: telegraph.co.uk/news/uknews/1574781/… Nov 6, 2022 at 19:12
  • 2
    @littleadv even N26 said they wouldn't be able to block all direct debits. Most EU banks will block a single recipient, but if you want to setup a "block all" or "block everyone except those on this allowlist", most EU banks won't do it (from my experience). If you know how to force an EU bank to block all SEPA direct debits, then please answer the linked question. Nov 6, 2022 at 20:14
  • 2
    Even in germany (where regulations are extremely strict), you can do a direct debit from anyone's bank account with just an IBAN and account number, and a document that authorizes them to do so. So in probably the most difficult country in the EU to do this, all you need is to forge a non-cryptographic signature. That's not hard. Nov 6, 2022 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .