ACH Standard Entry Class code

WEB SEC code: Internet-Initiated/Mobile Entry

Consumer debit authorized online or on a mobile device, or a person-to-person credit.

What WEB is for

Consumer debits authorized online or in a mobile app, single or recurring. The Payment Type Code that used to mark which (entry detail positions 77–78) has been optional since September 17, 2021: the ODFI decides whether to fill it, so an RDFI can’t rely on it.
Person-to-person credits a consumer sends through an online or mobile service.

Consumer accounts.

Authorization

An authorization given over the internet or a wireless network that identifies the consumer and is signed or similarly authenticated. The Originator must screen WEB debits with a commercially reasonable fraud detection system, including account validation when it first uses an account number, and protect the data in transit.

A summary in general terms: the Nacha Operating Rules set the exact requirements, and Regulation E adds its own for consumer accounts.

Debits, credits and addenda

Debits and credits.

Addenda on a forward entry: type 05, up to 1 per entry. Returns (addenda type 99) and Notifications of Change (type 98) follow their own layouts whatever the SEC code.

Returns

A consumer who says a debit was unauthorized can have it returned within 60 calendar days (R10, or R11 when the debit doesn’t match the authorization), with a Written Statement of Unauthorized Debit; R07 when the authorization was revoked.

Common mix-ups

WEB or PPD? The channel where the consumer authorized the debit decides: online or in an app is WEB, a signed paper form is PPD.
WEB or TEL? A spoken authorization in a phone call is TEL.

Where WEB sits in a NACHA file

The SEC code is a batch-level field: positions 51–53 of the Company/Batch Header record (type 5), so every entry in the batch shares it, and a file that mixes SEC codes puts them in separate batches. The batch header also carries the Company Name, Company Identification and Company Entry Description that Receivers see on their statements.

To read a WEB batch record by record, open the file in NACHA Navigator, a free sister site that parses NACHA files in your browser without uploading them.

Look up WEB from code or an AI agent

REST · GET · no key

curl -s 'https://payopskit.com/api/v1/codes/WEB?set=ach-sec'

MCP · tools/call · lookup_payment_code

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "lookup_payment_code",
    "arguments": {
      "code": "WEB",
      "set": "ach-sec"
    }
  }
}

Response (JSON)

{
  "code": "WEB",
  "set": "ach-sec",
  "found": true,
  "matches": [
    {
      "set": "ach-sec",
      "code": "WEB",
      "name": "Internet-Initiated/Mobile Entry",
      "description": "Consumer debit authorized online or on a mobile device, or a person-to-person credit.",
      "details": {
        "direction": "both",
        "addendaTypes": "05",
        "minAddenda": 0,
        "maxAddenda": 1
      }
    }
  ]
}

The MCP server is at /mcp (Streamable HTTP, no key); the API and MCP docs show how to connect Claude, Cursor or VS Code.

Source: Nacha Operating Rules, Appendix Three (Standard Entry Class codes). The code’s name is the Rules’ own; the rest is this site’s plain-language summary, informational and not a substitute for the Rules or your ODFI agreement.