A payday lender can withdraw money from your bank account — but only with your authorization, only within the limits of what you agreed to, and only within the rules set by California and federal law. After two consecutive failed withdrawal attempts, the lender cannot try again without new written authorization from you. If a lender is taking money from your account without authorization, that is illegal and you have the right to stop it.
Scope: What Type of Loan Does This Article Cover?
This article applies to deferred deposit transactions made by lenders licensed under the California Deferred Deposit Transaction Law (CDDTL), Financial Code §§ 23000–23106. If your loan is from a tribal lender, an unlicensed online lender, or is structured as an installment loan above $300 under the California Financing Law, different rules may apply. Verify your lender’s license at dfpi.ca.gov.
How Lenders Access Your Bank Account
When you take out a payday loan, you authorize the lender to collect repayment in one of two ways:
- Post-dated check — you write a check dated for your next payday. The lender deposits it on that date.
- ACH debit authorization — you provide your bank routing and account number and authorize the lender to pull the repayment electronically on the due date.
Both are forms of advance authorization you provide at the time of the loan. The lender is not taking money without permission in the original transaction — you authorized it. The question is what limits apply to that authorization and what happens when it is abused.
The Two-Attempt Rule
As of March 30, 2025, the CFPB Payday Loan Payments Rule imposes a hard limit: after two consecutive failed withdrawal attempts, the lender cannot make another attempt to withdraw from your account without obtaining a new specific written authorization from you.
This rule addresses a practice that was routine before 2025 — lenders would attempt to withdraw from accounts they knew were empty, sometimes dozens of times, each triggering a new overdraft or NSF fee from the bank. Those bank fees could dwarf the original loan amount. If a lender violates the two-attempt rule, state attorneys general can enforce it and you may raise it in private litigation.
The $15 NSF Cap
Under Financial Code § 23035, the payday lender — not your bank — is limited to a single $15 NSF fee on a returned check or failed ACH debit. One time only. They cannot charge it again on subsequent failed attempts on the same transaction.
Your bank’s overdraft or NSF fee is separate and is governed by your account agreement — California law does not cap what your bank can charge you.
How to Revoke Authorization
You have the right to revoke ACH authorization at any time. To do it properly:
- Send written notice to the lender revoking your ACH authorization — keep a copy
- Notify your bank in writing that you have revoked authorization and instruct them to block ACH debits from that lender
- Do both — notifying only the lender or only the bank leaves gaps
If the Lender Ignores Your Revocation
If you have revoked authorization in writing and the lender continues to withdraw funds, that is an unauthorized electronic funds transfer under the Electronic Funds Transfer Act (EFTA), 15 U.S.C. § 1693 et seq. You have the right to:
- Dispute the transaction with your bank and request a chargeback
- File a complaint with the CFPB at consumerfinance.gov/complaint
- File a complaint with the DFPI at dfpi.ca.gov/file-a-complaint
- Consult a consumer protection attorney about your options under the EFTA
If You Did Not Authorize the Withdrawal
If a lender is taking money from your account and you have no record of authorizing it — no loan agreement, no ACH authorization form — that is unauthorized and potentially fraudulent. Steps to take:
- Contact your bank immediately and dispute the transaction as unauthorized
- Request that your bank block future debits from that company
- File a complaint with the CFPB and DFPI
- Verify whether the lender is licensed at dfpi.ca.gov — unlicensed lenders have no legal right to collect
Payday Loan Scams: Phantom Debt
A common scam involves collectors calling and threatening to take legal action or withdraw funds over a payday loan you never actually took out. They may have partial personal information from a data breach and use it to pressure payment. This is called phantom debt collection. No one can withdraw money from your account without your authorization — and authorization you never gave cannot be used against you.
If You Are Sued
If a lender or collector sues you over the debt — whether you revoked authorization or not — you have 30 days to file a response in limited civil court, or you must appear at the hearing in small claims. Do not ignore it.
Learn how to respond to a debt collection lawsuit in California →
If you are weighing whether bankruptcy might be the right move to address payday loan debt, speaking with an attorney is the right first step.
Your Rights Under California and Federal Law
- CFPB Payday Loan Payments Rule — limits lenders to two consecutive failed withdrawal attempts before new written authorization is required
- Electronic Funds Transfer Act, 15 U.S.C. § 1693 — protects against unauthorized electronic withdrawals
- FDCPA, 15 U.S.C. § 1692 — prohibits abusive collection practices by third-party collectors
- Rosenthal Act, Civil Code § 1788 — same protections, applies to original creditors as well
File complaints with the DFPI at dfpi.ca.gov/file-a-complaint and with the CFPB at consumerfinance.gov/complaint.
Frequently Asked Questions
Can a payday lender take money from my account whenever they want?
No. They can only withdraw funds pursuant to the authorization you gave at the time of the loan — on the agreed date, for the agreed amount. After two consecutive failed attempts, the CFPB Payday Loan Payments Rule prohibits further attempts without new written authorization from you.
What if I told the lender to stop taking money from my account?
A verbal instruction may not be enough. Send written revocation to both the lender and your bank. Keep copies. If the lender continues to withdraw funds after written revocation, that may be an unauthorized transfer under the Electronic Funds Transfer Act.
Can I close my bank account to stop a payday lender from withdrawing funds?
You can, but it does not eliminate the debt. The lender can still pursue collection by other means, including a lawsuit. If possible, revoke the ACH authorization in writing before closing the account rather than simply closing it without notice.
What if my bank keeps honoring debits after I told them to stop?
If you have notified your bank in writing to block ACH debits from a specific lender and the bank continues to honor them, the bank may be liable for those unauthorized transfers under the EFTA. File a complaint with the CFPB.
Is a payday lender allowed to take partial payments from my account?
Only if your authorization covers partial payments. Most payday loan ACH authorizations cover the full repayment amount on a specific date. A lender withdrawing amounts not covered by the original authorization may be violating the EFTA and the FDCPA.
What if I never gave the lender my bank information?
If a lender is withdrawing funds from your account without any authorization you provided, that is unauthorized and potentially fraudulent. Dispute it with your bank immediately, block future debits, and file complaints with the CFPB and DFPI.
Sources
- California Deferred Deposit Transaction Law, Financial Code §§ 23000–23106
- Financial Code § 23035 (NSF fee — single $15 charge)
- CFPB Payday Loan Payments Rule, effective March 30, 2025 — CFPB
- Electronic Funds Transfer Act, 15 U.S.C. § 1693 et seq.
- Fair Debt Collection Practices Act, 15 U.S.C. § 1692 et seq.
- 15 U.S.C. § 1692g (debt validation rights)
- Rosenthal Fair Debt Collection Practices Act, Civil Code § 1788 et seq.
- DFPI License Lookup — dfpi.ca.gov
- DFPI Complaint Portal — dfpi.ca.gov/file-a-complaint
- CFPB Complaint Portal — consumerfinance.gov/complaint
- Lawyers for the Little Guys — lawyersforthelittleguys.com/request-a-consult