Yes, credit card companies can take money from your bank account, but only if you give them permission first
A credit card company cannot simply reach into your bank account without your consent. However, once you authorize them—either by signing up for automatic payments, setting up a payment plan, or disputing a charge—they gain the legal right to pull funds directly. This happens through a process called an ACH debit (Automated Clearing House), which is the same system that handles payroll deposits and bill payments.
The key word is authorization. You control when this permission starts. The problem arises when you forget you gave it, when a company overreaches what you authorized, or when a dispute goes wrong and they take more than they should.
Key Takeaways
- Credit card companies can only pull money from your bank account after you authorize an ACH debit, usually through automatic payment setup or a payment plan agreement.
- If you set up autopay and then cancel your credit card, the company may still attempt to debit your account unless you also cancel the authorization with your bank.
- Disputed charges can result in the card company reversing a credit and pulling money back from your account if they win the dispute with your bank.
- You can stop any ACH debit by contacting your bank directly and filing a dispute, which gives you a window to investigate before the money leaves.
- Some card companies use third-party debt collectors who can also request ACH debits if you fall behind on payments and authorize a payment arrangement.
How authorization actually works when you set up autopay
When you enroll in automatic payments on a credit card website or app, you are signing a document called an ACH authorization. This gives the card company permission to pull a set amount (or a variable amount, depending on what you chose) from your checking or savings account on a specific date each month.
The authorization stays in place until you cancel it. Canceling the credit card itself does not automatically cancel the ACH authorization. If you close a card but forget to turn off autopay, the company will still try to pull the payment on the scheduled date. Your bank may reject it if the account is closed or flagged, but the attempt will still be made.
To stop an ACH debit, you must contact your bank directly—not the credit card company. Tell your bank you want to revoke the authorization. Your bank can block future debits and, in some cases, reverse one that was already pulled if you report it quickly enough.
When a credit card company can pull money back after a dispute
If you dispute a charge on your credit card, your bank typically reverses it immediately and credits your account while they investigate. During this time, the money sits in your account. If the credit card company wins the dispute—meaning they prove the charge was legitimate—they can pull that money back out of your bank account to recover it.
This is not a surprise debit in the legal sense; it is a reversal of a reversal. However, it can feel like one if you spent the money while the dispute was pending. The card company does not need to ask permission again because the original charge authorization already covered this scenario.
To protect yourself, do not spend disputed funds until the investigation closes. Keep the money set aside in case the company wins and pulls it back.
Debt collection and payment arrangements
If you fall behind on credit card payments and the account goes to collections, a debt collector may contact you to set up a payment plan. If you agree to the plan and authorize an ACH debit as part of that agreement, the collector can pull payments from your bank account on the dates you agreed to.
This is different from the card company itself because collectors are third parties. However, the same rule applies: you must authorize the debit first. If you agree to a plan verbally but do not sign anything, the collector cannot legally pull money without written authorization.
If a collector pulls money without authorization, or pulls more than the agreed amount, you can dispute it with your bank and file a complaint with the Consumer Financial Protection Bureau (CFPB).
What to do if money is pulled without your permission
If a credit card company or collector pulls money from your account and you did not authorize it, contact your bank immediately. Tell them you want to dispute the ACH debit as unauthorized. Your bank will freeze the transaction and begin an investigation, usually within one to three business days.
During the investigation, the money stays in your account. If your bank determines the debit was truly unauthorized, they will keep the funds and the company cannot pull again. If the company can prove you authorized it (even if you forgot), your bank will return the money to them.
Keep records of all authorization documents you signed, emails confirming autopay setup, and screenshots of your account settings. These help your bank decide in your favor if there is a dispute.
How to prevent unwanted ACH debits
Review your bank statements monthly and look for recurring charges from credit card companies or collectors. If you see one you did not authorize, dispute it immediately—the longer you wait, the harder it is to reverse.
Before closing a credit card, log into the card's website and turn off automatic payments. Then contact your bank and ask them to confirm there are no pending ACH authorizations from that card company. Some banks let you view all active ACH authorizations in your online account settings.
If you set up a payment plan with a collector, ask for written confirmation of the amount and date. Do not agree to a plan over the phone unless you receive written details within a few days. This creates a paper trail if the company pulls the wrong amount.
Your rights under the Electronic Funds Transfer Act
The Electronic Funds Transfer Act (EFTA) is the federal law that governs ACH debits. It says a company cannot pull money from your account without your written authorization, and you have the right to stop any debit by notifying your bank.
If a company violates this law—for example, by pulling money after you revoked authorization—you can sue them for actual damages plus up to $1,000 in additional damages. Your bank is also required to help you dispute unauthorized debits within a certain timeframe, usually 60 days from when you first notice the problem.
Many credit card companies and collectors know this law and follow it. However, some push the boundaries by making authorization language unclear or by pulling slightly more than agreed. If this happens to you, document everything and file a complaint with the CFPB in addition to disputing with your bank.
Frequently Asked Questions
Can a credit card company pull money if I only gave them my debit card number, not authorization?
No. Providing a card number is not the same as authorizing an ACH debit. ACH debits require a separate written or electronic authorization that specifically mentions your bank account and the company's right to pull funds. A card number alone does not grant that permission.
What if I authorized autopay but the company pulls the wrong amount?
Contact your bank and dispute the debit as unauthorized or incorrect. Your bank will investigate whether the amount matched what you authorized. If it did not, they will reverse it. If the company keeps pulling the wrong amount, you can revoke the entire authorization and switch to manual payments.
How long does it take to get money back after I dispute an ACH debit?
Your bank must credit your account within one to three business days while they investigate. The full investigation typically takes 10 business days, though it can extend to 45 days in some cases. Once your bank determines the debit was unauthorized, the money stays with you.
Can a credit card company pull money from a joint bank account?
Yes, if the authorization is tied to that account. However, only the person who signed the authorization is legally responsible for the debt. If a joint account holder did not authorize the debit, they can dispute it separately with the bank.
What if the credit card company says I authorized the debit but I have no record of it?
Ask the company to provide a copy of the signed authorization. If they cannot produce one, tell your bank the authorization is disputed. Your bank will ask the company for proof. If the company cannot provide it, your bank must reverse the debit and close the authorization.