Push vs pull payments: what’s the difference and why it matters

Direction is about who initiates the instruction

Nacha provides the cleanest side-by-side definition. An ACH credit is a push from the originator’s account through its originating bank to the receiver’s account. Payroll direct deposit is a common example. An ACH debit is a pull: the originator initiates an entry that debits the receiver’s account and credits the originator. An insurance-premium collection is one example. The “originator” is the party that creates the ACH entry, so it can be the payer for a credit or the payee for a debit.

The European Central Bank makes the same distinction in SEPA. It defines a credit transfer as a payment from payer to payee initiated by the payer. It defines direct debit as a transfer initiated by the payee based on the payer’s consent through a mandate. These definitions prevent a common mistake: both payments move money from payer to payee, but the instruction enters the system from opposite sides.

Common push payments

Wires and real-time gross settlement transfers

A wire is a push instruction. The sender tells its bank which beneficiary to pay; the beneficiary does not debit the sender’s bank account. The Federal Reserve describes Fedwire as a real-time gross settlement service in which qualifying payment orders are processed individually and accepted settlement in central bank money is final and irrevocable. That makes beneficiary verification critical before release. The cited Fedwire documentation describes participant-sent payment orders, not payee-originated recurring debits.

Instant credit transfers

SEPA Instant is an instant credit transfer, so the payer side pushes the payment. FedNow likewise processes customer credit transfers between participating institutions. Its operating procedures show that a request for payment is a separate message: when accepted, it can lead to a subsequent customer credit transfer. The request does not itself debit the payer. This distinction lets a merchant ask for money while the payer retains the final send decision.

Scheduled credits and standing orders

Push does not require a person to click every time. A payer can establish a standing order or future-dated credit through its provider. Nacha’s Pay by Bank FAQ describes a standing order or forward-dated payment as the credit-transfer equivalent of direct debit. The important control remains direction: the payer preconfigures the outbound instruction instead of granting the biller authority to initiate debits.

Common pull payments

ACH and SEPA direct debits

A biller can originate an ACH debit after obtaining the authorization appropriate to the receiver, account, and entry type. A SEPA creditor can initiate a direct debit under the payer’s mandate. The payee controls the collection date within the authorized terms, which is useful for subscriptions, utilities, invoices, and scheduled collections. That convenience depends on correct authorization, amount, timing, revocation, and return handling; possession of account details alone is not permission.

Stored-card and recurring card charges

Cards use network-specific concepts rather than the bank-transfer labels alone. Visa’s framework calls a later subscription charge a merchant-initiated transaction based on a pre-agreed standing instruction and stored credential. That is pull-like in business terms: the merchant starts the later charge while the cardholder is not actively participating. It is not identical to ACH debit because authorization messages, credential storage, issuer decisions, settlement, refunds, and disputes follow card rules.

Some rails support both directions

ACH explicitly supports credits and debits. UPI also exposes both “pay” and “collect” patterns: NPCI describes a virtual address supporting pull and push, along with peer and merchant payments. But a collect request is not the same as an unapproved debit. The payer authorizes the requested UPI payment with its UPI PIN. Product wording such as “request,” “mandate,” and “autopay” must therefore be mapped to the actual instruction and consent sequence before classifying the risk.

The fraud problem moves with the control point

Push risk: the payer may authorize the wrong destination

Push control prevents a payee from initiating arbitrary debits, but it does not prove the beneficiary is genuine. Business email compromise can trick an authorized employee into sending to fraudster-controlled details. The FBI advises independently verifying payment requests and any change in account number or procedure. Nacha’s credit-push fraud initiative likewise recognizes that ACH credits can carry impersonation fraud. Protect beneficiary creation and change, not just the payment button.

Pull risk: the collector may exceed or lack authority

Pull gives the merchant or originator initiation power, so the control centers on proof of authorization, amount, date, frequency, and revocation. Nacha places the burden on the ACH originator to obtain proper authorization and distinguish consumer from business accounts. For covered US consumer accounts, Regulation E requires signed or similarly authenticated authorization for preauthorized debits, a copy for the consumer, and stop-payment and revocation handling under its conditions. Commercial accounts require separate agreement and rule analysis.

Return or error rights cannot be inferred from the word “pull.” Regulation E’s error-resolution section covers unauthorized and incorrect electronic fund transfers for covered consumer accounts. It does not create one worldwide right for every commercial debit, card charge, or mandate. Store the account classification, authorization evidence, rail, dates, and dispute status needed to apply the correct rule instead of hard-coding a generic refund promise.

Which direction fits a business use case?