Learn · Bank payments (ACH)

R10 return code: customer says the debit wasn't authorized

The customer says they don't know you, or never gave you permission. The strongest return a consumer can send.

60 dayscalendar days a consumer has for an R10 return
0.5%Nacha's unauthorized return rate threshold
Finalno appeal through the ACH network, per Stripe
In brief

R10 is the ACH return code for "Customer Advises Originator is Not Known to Receiver and/or Originator is Not Authorized by Receiver to Debit Receiver's Account." The consumer told their bank they don't know the business, have no relationship with it, or never authorized the debit. The bank needs the customer's written statement of unauthorized debit, and the return can come up to 60 calendar days after settlement. R10 counts toward Nacha's 0.5% unauthorized threshold. The debit can't be sent again without a new authorization.

What does R10 mean?

R10's full title is "Customer Advises Originator is Not Known to Receiver and/or Originator is Not Authorized by Receiver to Debit Receiver's Account." Nacha says the bank uses it when the customer:

  • does not know the identity of the business that sent the debit,
  • has no relationship with that business, or
  • has not authorized it to debit the account.

Nacha also allows R10 for a debit that was improperly reinitiated, because Nacha expects most of those to surface through customer complaints after the normal two-day window has closed.

How is R10 different from R11?

Until 2020, R10 was a catch-all. Nacha then split it. R11, "Customer Advises Entry Not in Accordance with the Terms of the Authorization," now covers an authorized debit with an error, such as the wrong amount or a date earlier than agreed. With an R11, the business may fix the error and send a corrected debit within 60 days of the return's settlement date, without a new authorization.

R10 means there is no valid authorization at all. Nothing can be corrected.

Who sends an R10, and how long do they have?

The customer's bank (the RDFI). R10 is for consumer debits, or consumer debit types sent to business accounts. Corporate debits use R29 instead. The bank must first get the customer's written statement of unauthorized debit.

R10 is an extended return. It must reach the business's bank by the opening of business on the banking day after the 60th calendar day following the settlement date. Stripe adds that disputes inside these limits are final and can't be challenged through the ACH network.

Does R10 count against my return rates?

Yes. Nacha's unauthorized return rate covers R05, R07, R10, R11, R29 and R51. The threshold is 0.5% of debits over the preceding 60 days or two calendar months, cut from 1.0%. R10 also counts toward the 15.0% overall level.

Can I send the debit again?

No. Nacha says an unauthorized debit cannot be remedied, and reinitiating it is an improper reinitiation. You can debit the account again only with a new authorization obtained after you receive the return.

Stripe reports R10 as debit_not_authorized. A dispute invalidates the mandate, and you have to resolve it with the customer and collect a new one before charging again. If the customer disputes a later payment too, Stripe blocks the bank account.

What should I do when a plan payment comes back R10?

  1. Stop every scheduled debit to that account.
  2. Contact the customer. If they signed a plan with you, ask whether they recognized your name on their bank statement, and check what your debits say.
  3. Collect a new authorization if they want to continue, and settle the returned payment with them directly.
  4. Look at the pattern if more arrive. Several R10s at once can push you toward the 0.5% threshold quickly.

Example: a business sends 400 plan debits over two months. Three come back R10 and one R07. That's 4 unauthorized returns out of 400, or 1.0%, twice Nacha's threshold.

For the related codes, see R07 and R29.

General information, not legal advice.

Built for businesses collecting $100K a month or more.

Payment plans built from the deal in HubSpot or Pipedrive, with each location paid into its own account and books.

Book 15 minutes