ACH authorization is a fraud prevention feature you can enable to maintain tighter control over who can draw funds from your Mercury account via ACH pulls, also called ACH debits. Most ACH transactions require robust account verification measures (typically through microdeposits or Plaid) so there's a very low prevalence of fraudulent ACH pulls. That said, it’s still possible for banks to initiate an ACH pull with less robust verifications (such as when a bank accepts a voided check as verification). Because this limited risk does exist, we encourage all Mercury customers to enable our ACH authorization feature.
Once enabled, ACH authorization will flag any ACH pulls from unauthorized vendors and any pulls that exceed the transaction limit you’ve set for an authorized vendor, giving you a chance to decline them before they are processed. If no action is taken within the review period, they'll be approved automatically. If you prefer, you can modify this default setting from your Controls settings.
Admins have the ability to enable and use this feature by default, as well as grant permissions for custom users to manage authorizations as well.
Enabling ACH authorizations
- Go to your Authorizations page.
- Click Get Started from the box in the middle of the screen.
- You’ll be prompted to authorize your first vendors immediately. You can also do this later if you don’t have the vendor info handy just yet.
- Follow the prompts to complete setup and enable ACH authorization.
If you no longer want to require ACH authorization, you can disable the feature from your Controls settings.
Authorizing vendors
- Go to your Authorizations page.
- Select the vendor from your list of recent ACH pulls, or add a new vendor.
- You’ll also be asked for a few additional details:
- ACH Company ID (also known as ACH Originator ID or Vendor ID) : This is usually either provided by the vendor or found on their website/portal. Some vendors may have more than one ACH Company ID.
- Pay-from account: This is the account you want your vendor to pull payments from.
- Transaction limit: You can set an optional limit to control how much a vendor can pull in a single transaction. If no limit is set, they’ll be authorized to pull any amount.
- Review the authorization details, then click Authorize.
Managing authorizations
You can view a list of all currently active authorizations on your Authorizations page. From here, you can edit authorization details like: changing limits, adding company IDs, and authorizing vendors for multiple bank accounts. To remove an authorization, click on the trash can icon.
If the authorizations feature is enabled but no vendors are added, every ACH pull will be flagged for your review.
Reviewing flagged payments
When an unauthorized vendor tries to initiate an ACH pull or an authorized vendor initiates a pull that's above the transaction limit you set, the payment will be flagged.
If this happens, we'll notify you via email, the Tasks feed, and in the Flagged tab on your Authorizations page. You'll have a window of time to review the payment and either manually approve or reject it from mercury.com or the Mercury mobile app. Generally, that window is about 1 business day, although it may be less for same-day ACHs. You can always view how much time you have left to review from your Flagged tab. If no action is taken, the payment will be approved or rejected automatically, depending on the settings listed on the Flagged tab.
You can also quickly authorize a vendor for future payments by clicking on the flagged transaction and selecting “Pay and authorize vendor” beneath the transaction details.
Notification settings
Mercury will notify you via email about a flagged ACH as soon as it's ready for review. If we receive multiple flagged transactions at once, they will be grouped into one email and sent as soon as possible. Email notifications will alert you to the number of transactions pending review, dollar amounts, and vendor names. You'll also see flagged transactions appear in the Tasks page which can be reviewed on desktop or mobile.