ACH SEC Codes: WEB, PPD, CCD and TEL in Plain English

Answer three questions: who is paying, how they give permission, and whether the payment repeats. The picker shows the matching code, what Authorize.Net allows for it and what the authorization needs.

If you're new to eChecks, start with what an eCheck is and how it works. In short, an eCheck is a debit from a U.S. bank account sent over the ACH network, the system U.S. banks use to move money between accounts.

The rules behind these codes come from Nacha, the organization that writes the operating rules for the ACH network. Authorize.Net's developer guide, checked October 13, 2026, lists what each code allows on its eCheck service, eCheck.Net:

"Refunds" means a refund sent back through the gateway. Where the gateway can't refund a payment, you'll need another way to return money, such as mailing a check. Say so in your refund policy.

WEB: online and app payments

• Who pays: a consumer paying from a personal checking or savings account.
• How they authorize: Authorize.Net's guide says to use WEB "when the customer uses a website or smartphone app to authorize the transaction." Usually that's a checkbox with clear wording at checkout.
• On Authorize.Net: no refunds through the gateway; recurring billing allowed.
• Account validation: since March 19, 2021, Nacha has required that fraud screening for WEB debits, at a minimum, "validate the account to be debited" before its first use and before any change to the account number. Nacha doesn't prescribe a method. Authorize.Net's support article says that since March 18, 2022 it also checks the account number on WEB payments and on the first payment of an Automated Recurring Billing subscription. That catches typos and fake numbers; it isn't a balance check.
• What to keep: the exact wording the customer agreed to, the date and time, and the order details.

TEL: phone payments

• Who pays: a consumer who gives permission on a call.
• How they authorize: Authorize.Net's guide says to use TEL "when the merchant and the customer have a pre-existing business relationship," or when the customer calls you and consents.
• On Authorize.Net: no refunds through the gateway and no recurring billing. It's for one-time payments.
• What to keep: Nacha's rules for oral authorizations call for an audio recording of the customer's permission, or a written notice confirming it sent before the payment settles. Keep the recording or the notice.

PPD: signed consumer forms and payment plans

• Who pays: a consumer with a prearranged payment, such as a membership, tuition, rent or a payment plan.
• How they authorize: a written form, signed on paper or "similarly authenticated" online (Reg E's wording, covered below).
• On Authorize.Net: refunds and recurring billing both allowed. The guide says to use PPD "for recurring billing, customer payment profiles, and prearranged payments in general."
• What to keep: the signed form and proof that the customer got a copy.

CCD: business-to-business payments

• Who pays: another business, from a business checking account. Authorize.Net lists "businessChecking" as the only account type for CCD.
• How they authorize: an agreement with your business customer, often in your credit application or invoice terms. Reg E's consumer rules don't apply to business accounts, so ask your provider what your agreement must say.
• On Authorize.Net: refunds and recurring billing both allowed.
• What to keep: the signed agreement and any changes to it.

Which of these codes are switched on depends on how your eCheck account is set up. Ask your provider which ones you'll have before you build your checkout or forms.

Two other codes turn a paper check into an electronic payment:

• ARC: checks that arrive by mail or in a drop box.
• BOC: checks written at a point of sale and converted later in the back office.

Both read the numbers printed along the bottom of the check (the MICR line) with a check reader. Authorize.Net's developer guide still lists them, but its support article says they are "no longer offered" (checked September 27, 2026). If you take paper checks in the mail, deposit them with your bank as usual, or invite customers to pay online by eCheck instead.

Whatever the code, the customer's permission has to meet Nacha's standards. Since September 17, 2021, Nacha's rules have applied two tests to every ACH authorization. It must be:

• Readily identifiable as an authorization. It can't be hidden in general terms of service.
• Written in clear and readily understandable terms.

For debits from consumer accounts, the same 2021 update applied a set of minimum details, first written for phone payments, to every consumer debit authorization. A Nacha article from November 3, 2025 says a consumer debit authorization "must include seven essential pieces of information," including how the customer can revoke it directly with you and the timing for doing so. Nacha's public pages don't list all seven. Payment-industry guides based on the rules usually list:

1. A statement that the customer is authorizing an ACH debit to their account
2. The amount, or how it will be worked out
3. The date or dates of the debit
4. The customer's name
5. A phone number the customer can call with questions during business hours
6. The date the customer gave permission
7. How to revoke it with you, including how and when

Treat that list as a checklist, not legal wording, and check your final text with your provider or a lawyer. For ready-made wording for each code, see our ACH authorization form templates.

Weak authorizations cost money. When a customer tells their bank they didn't authorize a debit, the payment can come back weeks later, and your records are your defense. See ACH return codes and returned eChecks for how unauthorized returns work.

Recurring debits from a consumer's account fall under Regulation E (Reg E), the federal rule for electronic transfers from consumer accounts. Section 1005.10(b) says these "preauthorized" transfers:

• "may be authorized only by a writing signed or similarly authenticated by the consumer"
• require that "the person that obtains the authorization shall provide a copy to the consumer"

The CFPB's official comments say "similarly authenticated" lets the authorization be signed electronically, and the copy can be on paper or electronic. In practice:

• Online sign-up (WEB recurring): email the customer a copy of the terms they agreed to, and keep proof you sent it.
• Paper form (PPD): give the customer a copy of the signed form.
• Phone: TEL can't be recurring on Authorize.Net. For a schedule, get a written or online authorization instead.

Customers can also stop a recurring debit by telling their bank "at least three business days before the scheduled date" (§1005.10(c)). Your authorization should explain how to cancel with you directly, so they don't have to go to the bank.

To run the schedule itself on cards or eCheck, see Authorize.Net Automated Recurring Billing.

Every ACH payment carries a short label called the Company Entry Description. It shows on the customer's bank statement next to your name. Since March 20, 2026, Nacha has required the word PURCHASE in that field for:

• Debits to consumer accounts
• For goods bought online, which normally means WEB (TEL only under Nacha's Standing Authorization rule)
• Including recurring purchases of goods first authorized online

Nacha's page says the rule does not apply to services, and lists gym memberships, utilities, rent, insurance premiums and business-to-business payments among the exclusions. If you sell physical products online and take eChecks, ask your provider how the description is set on your account.

Your bank can ask for proof that a customer authorized a payment. Keep every authorization where you can find it quickly. How long:

• Phone (oral) authorizations: Nacha's rule summary says two years from the date of a one-time authorization, and two years from the end or revocation of a recurring one.
• Written and online authorizations: payment-industry summaries of Nacha's rules give the same two years, counted from when the authorization ends or the customer revokes it. Nacha's full rulebook isn't public, so confirm the period with your provider.

A simple rule of thumb: keep each authorization for as long as you charge against it, plus at least two years. For each one, store:

• The wording the customer agreed to
• The signature, checkbox record or call recording
• The date and time
• Proof you sent the customer a copy
• Any cancellation request and when you acted on it

Store bank details securely. Never keep full account numbers in email or spreadsheets.

For more on where these rules fit in eCheck as a whole, from costs to timing, see our eCheck processing guide. For how Authorize.Net handles each code, see Authorize.Net eCheck.Net.