X12 828 — Debit Authorization
The 828 transmits a pre-authorization for ACH debit — recurring or one-time — from a payor to its originating bank and the merchant initiating the debit.
Purpose
The 828 documents the signed consumer authorization for an ACH debit: merchant name, account number to debit, amount (fixed or variable), frequency, effective dates, revocation rules. It is the contract document in NACHA, signed physically or electronically.
It feeds ACH file processing at the ODFI (Originating Depository Financial Institution). Acknowledged by 997. Pairs naturally with the 820 when a debit is initiated.
Envelope structure
The 828 travels within the three X12 envelope levels (ISA/IEA,
GS/GE with functional group DA, and ST/SE).
Didactic example in release 004010:
ISA*00* *00* *ZZ*MERCHANT *ZZ*ODFI *260515*1200*U*00401*000000828*0*P*>~
GS*DA*MERCHANT*ODFI*20260515*1200*1*X*004010~
ST*828*0001~
BGN*00*AUTH-2026-7711*20260515~
N1*PE*ACME UTILITY CO*24*EIN-MERCH~
NM1*IL*1*JOHNSON*ROBERT*B***34*SSN-PARTIAL~
REF*ZZ*ROUTING-123456789~
REF*ZZ*ACCOUNT-MASKED-XXXX9911~
REF*ZZ*FREQUENCY-MONTHLY~
AMT*ZZ*125.00~
DTM*090*20260601~
SE*10*0001~
GE*1*1~
IEA*1*000000828~ Common segments
- Header —
ST,BGN. - Merchant / consumer —
N1*PE(Payee),NM1*IL(Consumer). - Account —
REF*ZZ(Routing),REF*ZZ(Account masked). - Frequency / amount —
REF*ZZ,AMT*ZZ. - Effective —
DTM*090. - Summary —
SE.
Common pitfalls
- Regulation E: a consumer ACH debit authorization is regulated by Reg E; a 828 without clear revocation language violates.
- WEB vs PPD vs CCD: NACHA distinguishes Standard Entry Class codes; a mis-classified 828 blocks ACH processing.
- Re-authorization: a recurring authorization may need periodic re-authorization per NACHA rules (variable amount, new merchant) — ignoring exposes to unauthorized debit.
Related transactions
Documentation
The code 828 and the name Debit Authorization are public and listed on x12.org/products/transaction-sets. The complete structure of loops, qualifiers and code lists is distributed by DISA via the proprietary Implementation Guides (TR3). ediverse.io covers only public concepts, the envelope and didactic examples.