The short answer
A pull payment is a funds transfer initiated by the recipient — the merchant, biller, or subscription service — who pulls money from the payer's account with previously-granted authorization. Card authorizations, ACH debits, direct debits (SEPA and UK BACS), and automated bill-pay debits are all pull payments. They're the rails almost all consumer-facing e-commerce sits on. Contrasted with push payments (wires, RTP, FedNow, Visa Direct), where the sender initiates.
The pull-payment rails
- Card authorizations: Visa, Mastercard, Amex, Discover. Merchant submits an auth request, issuer responds approve/decline. If approved, merchant captures for settlement.
- ACH debits: Merchant originates a debit against customer's bank account. NACHA-governed, T+1 to T+2 settlement.
- SEPA Direct Debit (EU): Pre-authorized mandate allows merchant to pull EUR from EU customer's bank account.
- UK BACS Direct Debit: Similar in the UK.
- Check conversion: Paper check converted to ACH debit at point of deposit (BOC, ARC SEC codes).
Why the "pull" model matters
- Consumer protection is stronger. Because the payer didn't actively authorize each transaction, regulators and networks give the payer robust dispute rights. Regulation E gives 60 days to dispute ACH pulls. Card-network rules give 120+ days for many dispute reasons.
- Authorization is pre-granted. The payer authorizes once (by entering the card or signing the ACH mandate) and the merchant can debit repeatedly without re-approval — subject to card-on-file rules and NACHA authorization rules.
- Chargebacks exist because of pull mechanics. Push payments don't chargeback because the sender initiated; pull payments chargeback because the issuing bank has to give the customer recourse they didn't get to exercise at the moment of charge.
What operators need to know
- Every pull carries dispute risk. Build ops and pricing expecting chargebacks. A healthy e-commerce operation runs 0.3-0.7% chargeback ratio; anything above 0.9% hits VAMP.
- Authorization quality determines defensibility. A crisp click-through TOS with clear subscription terms beats a checkbox every time. See compelling evidence.
- ACH pull rules are stricter than card. NACHA caps unauthorized returns at 0.5%. One bad subscription offer can spike R10s and trigger ODFI action in days.
- Pull reversal via ACH return is slow. An ACH pull can be returned up to 60 days later (R10 unauthorized). Subscriptions that look healthy today can turn into a wave of returns six weeks later.
- Recurring mandate required for recurring pulls. You must capture, store, and be able to produce the authorization. Recurring mandate standards apply under both card and ACH regimes.
- Push-payment complement. For refunds to customers, many operators are shifting from card-rail refunds (pull reversal, 3-5 days) to push refunds via Visa Direct (30 minutes). Better UX, slightly higher cost.