What are A2A payments, and are they safe? A US guide by payment rail
Payments
November 12, 2026
|
Aeropay Team
This article was written by the payments nerds at Aeropay. Our goal is to provide you with solid insights to help your business operationalize more efficient, value-focused payments.
Most explanations of A2A payments are written for Europe or the UK, and many promise instant settlement that only some US rails deliver. In the US, whether an A2A payment is safe depends on which rail carries it and which side of the payment you're on.
Account-to-account (A2A) payments move money directly from one bank account to another without a card network in the middle. In the US, they run on ACH, Same Day ACH, the RTP network, FedNow and wire transfers. They protect payers at checkout because no card number is shared. For businesses, the risk depends on the rail.
When a customer pays a business this way at checkout, the experience is usually called pay by bank, which we cover in Pay by bank 101. This guide looks at the rails underneath and where each one puts the risk.
Every US A2A payment is either a pull or a push, and that direction decides who carries the risk.
| Rail | Direction | Can it be reversed? |
|---|---|---|
| Standard ACH | Push or pull | Yes. ACH debits can be returned under the Nacha Operating Rules |
| Same Day ACH | Push or pull | Yes, under the same return rules as standard ACH |
| RTP network | Push only | No. Payments are final once sent |
| FedNow | Push only | No. Payments are final once sent |
| Wire transfer | Push only | No. Fedwire payments are final and irrevocable once settled |
For which rail suits which payment, see ACH vs. RTP vs. FedNow: which rail should each payment use?
A2A payments are safe for a customer paying a business at checkout. The customer doesn't hand over a reusable card number that could be stolen and used elsewhere. When they link their account by logging in with their own bank, the bank issues a secure token wherever it supports one, and the business never sees the password. If a business debits a consumer's account without authorization, the Nacha Operating Rules let the consumer's bank return that debit for up to 60 days from settlement.
Push payments carry a different risk for the person sending them. A consumer who is tricked into sending money over RTP or FedNow can't reverse the payment, because both rails treat it as final. On instant rails, the payer's main risk is being scammed into sending money, not having it taken.
For a business, the risk flips with the direction of the payment.
When a business pulls money in by ACH debit, the risk is that the payment comes back after the goods have shipped or the balance has been credited. Returns for insufficient funds or closed accounts arrive within two banking days, but unauthorized consumer debits can come back for up to 60 days. We explain which return codes cost the most in What do ACH return codes mean, and which ones cost you most?
When a business pushes money out over RTP, FedNow or wire, the payment can't be pulled back. The danger is sending it to the wrong account or to someone who shouldn't receive it, so the account has to be verified before the money moves.
Either way, the safety decision happens before settlement. We built Aeropay around that. Users link and verify a bank account in under 10 seconds with Aerosync, and Aeropay Guard scores each pay by bank transaction in real time to predict fraud and return risk before funds move. On payouts, trading platform Topstep cut trader payout times from 3 days to 9 seconds with Aeropay instant payouts. For how providers make these calls, see How do payment providers decide which bank payments to stop?
A2A payments don't have chargebacks, which belong to card networks. ACH debits have returns instead: a consumer's bank can return an unauthorized debit for up to 60 days after settlement. RTP, FedNow and wire payments have neither, because they're final once sent.
US A2A payments run under rail rules and federal consumer protection. ACH payments follow the Nacha Operating Rules, and consumer electronic fund transfers fall under Regulation E, which sets how consumers report unauthorized transfers. RTP and FedNow each run under their operators' own rules.
A2A payments move money directly between bank accounts, and in the US they run on ACH, Same Day ACH, RTP, FedNow and wires. They protect payers at checkout because no card number changes hands. For businesses, the rail sets the risk. Unauthorized consumer ACH debits can come back for up to 60 days, while instant pushes and wires can't be undone. Verifying accounts and scoring risk before settlement is what makes A2A payments safe to rely on at scale.
Want to accept bank payments with less return risk? See how Aeropay verifies accounts and scores risk before money moves.