Chargeback vs ACH return: why they are not the same thing

Two systems, two rulebooks

If your platform offers both card and bank payments, your customers will sooner or later see money pulled back on both. On a card, that is a chargeback. On a bank payment, it is an ACH return. People often call both “disputes,” and some say “ACH chargeback,” but the two run on separate systems.

A chargeback happens under card network rules, such as the Visa Core Rules and Mastercard’s chargeback rules. An ACH return happens under the Nacha Operating Rules. The two rulebooks set different time limits, different ways to respond and different monitoring thresholds.

So, can you dispute an ACH payment? An account holder can, by asking their bank to return a debit. What people call an ACH dispute is a return under Nacha rules, not a chargeback, and your platform needs to plan for it separately.

How a card chargeback works

A chargeback usually starts when a cardholder disputes a charge with their card issuer, which raises it through the card network with the merchant’s acquirer. Formally, the dispute runs between the issuer and the acquirer, which brings in the merchant; the merchant agreement sets how much of the loss the merchant carries.

1. Cardholder
2. Card issuer
3. Card network
4. Acquirer
5. Merchant

Visa and Mastercard each sort disputes into categories and run their own clocks. The Visa figures come from the April 18, 2026 edition of the Visa Core Rules; the Mastercard figures come from secondary summaries, so confirm them with your acquirer.

Acquirers often set shorter internal deadlines, so the merchant may get less time than these windows. At Visa, fraud and authorization disputes run in the allocation workflow, where liability is assigned without a merchant response first (pre-arbitration is still possible), while processing-error and consumer disputes run in the collaboration workflow, where the merchant can answer with evidence through the acquirer.

Evidence and 3-D Secure

For certain fraud disputes, Visa’s Compelling Evidence 3.0 (CE3.0) criteria let a merchant answer with the cardholder’s own earlier purchases: ones that settled 120 to 365 days before the dispute and that the issuer did not report as fraud (in a TC40 report). They must match on device ID, device fingerprint or IP address, plus at least one more element, such as an account or login ID or a full delivery address.

For disputes processed on or after October 24, 2026, the April 2026 Visa Core Rules add CE3.0 criteria: the earlier transactions can be on the same card or on a credential tied to it, such as a token. Login IDs from an Agentic Payment Provider also count as a matching element.

3-D Secure works differently: it shifts liability for fraud-related disputes only, not for consumer disputes or processing errors. Under Visa Secure, whether the merchant is protected depends on the authentication result.

Two limits apply: the rules can vary by region, and merchants identified in Visa’s fraud monitoring can lose the protection.

Card monitoring programs

Card networks also watch each merchant’s dispute levels over time. Visa merged its earlier dispute and fraud monitoring programs (VDMP and VFMP) into the Visa Acquirer Monitoring Program (VAMP), and Mastercard runs its own Excessive Chargeback Program.

VAMP uses one count-based ratio for card-not-present transactions: fraud reports (TC40) plus disputes (TC15), divided by settled transactions (TC05). Fraud reports count even when the cardholder never files a dispute, while disputes resolved through pre-dispute solutions and fraud reports that qualify for CE3.0 are left out.

Mastercard’s chargeback-to-transaction ratio (CTR) divides this month’s chargebacks by the previous month’s sales transactions. Each level below applies when a merchant reaches both the ratio and the monthly count.

The VAMP level shown is for merchants in the U.S., Canada, the EU or Asia Pacific and has applied since April 1, 2026; for U.S. merchants the ratio was 2.2% until March 31, 2026. Acquirers are measured across their whole portfolio: Above Standard at 0.5% and Excessive at 0.7%.

Visa does not publish the fees for excessive merchants, and acquirers pass them through; figures you see quoted come from third parties, so confirm the amounts with your acquirer.

Mastercard fines begin in the second consecutive month in the program and escalate from there, and leaving the program takes three consecutive months below the threshold. These Mastercard thresholds and fine rules come from a J.P. Morgan guide to the program (revised December 2019) rather than from Mastercard directly, so confirm them with your acquirer.

How an ACH return works

An ACH return starts at the payer’s bank, the receiving bank or RDFI. Under the Nacha Operating Rules, it sends the entry back through the ACH Network to the bank that sent it, the originating bank or ODFI, with a return reason code. Sometimes the account holder starts it by telling their bank a debit was not authorized. Sometimes the bank returns the entry on its own, for example because of an account data error.

1. Account holder
2. Payer’s bank (RDFI)
3. ACH Network
4. Originating bank (ODFI)
5. Originator

As of October 2026, most returns are due within two banking days. The main exception is a consumer’s unauthorized debit. If the consumer signs a Written Statement of Unauthorized Debit (WSUD), the bank can return the debit using R05, R07, R10 or R11 for 60 calendar days after settlement. The exact cutoff is the opening of business on the banking day after the 60th calendar day. Unauthorized debits to business accounts are returned with R29 and follow the two-banking-day limit.

The bigger difference from cards is what happens next. ACH has no card-style representment: you cannot send evidence through the network to reverse a valid return the way a merchant answers a chargeback. Recovery generally happens outside the network, between the business that was paid and its payer. For what each code means and what to do when one arrives, see our guide to ACH return codes and the next step for each.

Proof of authorization and the Unauthorized Entry Fee

On the ACH side, your best evidence is the authorization itself. Originators must be able to produce proof of authorization quickly: when it is requested, the ODFI has 10 banking days to provide it. Since Nacha’s Meaningful Modernization rules took effect on September 17, 2021, the ODFI may instead agree to accept the return.

Those rules also set minimum standards for consumer debit authorizations. They must be readily identifiable and use clear, readily understandable terms.

Unauthorized returns also carry a fee set by Nacha’s rules. For each debit returned as unauthorized (R05, R07, R10, R11, R29 or R51), the ODFI pays the RDFI an Unauthorized Entry Fee, and the ODFI usually passes it on to the Originator or platform. Ask your provider how that fee, and any other return fees, reach you.

ACH return-rate limits

Nacha monitors debit return rates over the preceding 60 days or two calendar months. As of October 2026, three numbers matter:

• Unauthorized, 0.5%: returns coded R05, R07, R10, R11, R29 and R51. This is a threshold. Going over it can trigger Nacha enforcement against the ODFI, which passes the obligation on to the Originator or Third-Party Sender.
• Administrative, 3.0%: account data errors, returned as R02, R03 or R04.
• Overall, 15.0%: all debit returns except RCK.

The 3.0% and 15.0% figures are levels, not automatic violations. Going over one triggers a preliminary inquiry into the Originator’s or Third-Party Sender’s practices, which can lead to a directive to bring the rate down. Card programs count disputes month by month; Nacha looks back over that 60-day or two-month window.

Consumer law runs on separate clocks

Network and Nacha deadlines are not the only time limits. Federal consumer law gives cardholders and account holders their own rights, on their own clocks.

For credit cards, the Fair Credit Billing Act and Regulation Z give a consumer 60 days after the statement showing the charge to send a written billing-error notice. The card issuer must resolve it within two complete billing cycles and no more than 90 days.

For electronic transfers from a consumer’s bank account, Regulation E gives the consumer 60 days to report an error, counted from when the bank sends the statement. That is a different clock from Nacha’s 60 calendar days for unauthorized returns, which count from the debit’s settlement date. This is general information, not legal advice.

Chargebacks vs ACH returns side by side

Time limits vary by reason code, so read these as the usual cases, not exact deadlines. The Mastercard figures come from secondary sources; confirm them with your acquirer.

How to prevent both

Most of what prevents chargebacks also prevents returns. The common thread is a payer who recognizes the payment, agreed to it and can get help without calling their bank.

• Use statement descriptors payers recognize. The business name that appears on card and bank statements should match the one the payer knows. A charge from an unfamiliar name is easy to dispute or report as unauthorized.
• Keep authorization records you can produce fast. For ACH, the ODFI has 10 banking days to provide proof. For cards, order, delivery and login details support a response in the collaboration workflow or under CE3.0.
• Use 3-D Secure on card-not-present payments where it fits. It covers fraud-related disputes only. Ask any provider whether and how it supports 3-D Secure.
• Validate bank accounts for WEB debits. Checking the account before the first online-authorized debit reduces the account data errors (R02, R03, R04) that count toward the 3.0% administrative level.
• Refund promptly when a payer asks. A quick refund heads off disputes such as 13.6 Credit Not Processed and gives an unhappy payer less reason to call their bank. Proof that a credit was already issued can also answer a fraud dispute.
• Track dispute and return ratios every month. Watch VAMP ratios and counts, Mastercard chargeback counts and CTR, and Nacha’s unauthorized, administrative and overall return rates for each of your customers, so you see a problem before a network or bank does.

Sources

1. Visa, Dispute management guidelines for merchants
2. Visa, Visa Core Rules (public edition)
3. Visa, Visa Acquirer Monitoring Program fact sheet
4. Mastercard, Chargeback guide
5. Consumer Financial Protection Bureau, Regulation Z, 12 CFR 1026.13
6. Consumer Financial Protection Bureau, How do I dispute a charge on my credit card bill?
7. Nacha, ACH Network risk and enforcement topics
8. Nacha, Differentiating unauthorized return reasons
9. Nacha, Reversals and enforcement
10. Nacha, Meaningful Modernization
11. Nacha, Improving ACH Network quality: Unauthorized Entry Fee
12. J.P. Morgan, Mastercard Excessive Chargeback Program guide (secondary source)