What Schools Must Do When They Take Your Payment

Schools have legal rules about how they handle tuition and fee payments, and those rules protect you

When a school takes your money for tuition, fees, or other charges, federal and state laws set the boundaries for what the school can do with it. These rules cover how the school must store your payment information, when they can charge your account, what they have to tell you before they do, and what happens if something goes wrong. You do not need to know every regulation, but understanding the main ones helps you spot when a school is breaking the rules—and what to do about it.

The rules come from three places: federal banking law (which applies to all schools that take electronic payments), state consumer protection laws (which vary by state), and state education codes (which set requirements specific to schools). A school that violates these rules can face fines, and you may have grounds to dispute a charge or recover money.

Key Takeaways

• Schools must get your written permission before charging your bank account or card, and that permission must be specific to the payment amount and date.
• Schools cannot store your full credit card number or bank account number after a transaction is complete unless they use a secure payment processor that meets federal standards.
• If a school charges you without permission or charges the wrong amount, you have the right to dispute it through your bank or card issuer within a set time window.
• Schools must tell you in writing what fees they charge, when they will charge them, and what happens if a payment fails or bounces.
• State laws vary on refund timelines and what schools must do if they overcharge you, so your state's education department can tell you what applies to your school.

Permission and authorization rules for school charges

Before a school can charge your bank account or debit card, it must have your written authorization—meaning a signed form, an email you sent, or a digital checkbox you clicked. That authorization must be specific: it has to say the exact amount, the date the charge will happen, and what the charge is for. A blanket permission like "charge me whatever you want whenever you want" is not legal.

This rule comes from the Electronic Funds Transfer Act (EFTA), a federal law that applies to any school that takes electronic payments. If a school charges you without this specific permission, or charges a different amount than you authorized, you can dispute it. The school also has to give you a way to cancel or change your authorization before the charge goes through—usually by phone, email, or online portal.

Some schools ask for authorization once and then charge you every month or semester. That is legal, but the school must tell you upfront how many times it will charge you, on what dates, and for how much. If the amount changes (for example, because you added a class), the school must get new authorization for the new amount before charging you.

How schools must protect your payment information

Schools are not banks, and they are not allowed to store your payment information the way a bank does. If a school takes your credit card number or bank account number, it must either delete that information immediately after the transaction clears, or use a third-party payment processor that meets federal security standards. A payment processor is a company like Stripe, PayPal, or a school-specific vendor that specializes in handling sensitive financial data.

The federal standard is called PCI DSS (Payment Card Industry Data Security Standard). Schools that try to store card numbers themselves almost always violate this standard, which exposes them to fines and exposes you to fraud risk. If a school asks you to email your card number, mail a check with your card number written on it, or enter your card number into a non-secure form, that school is not following the rules.

You can ask a school directly: "Do you store my card number, or do you use a payment processor?" If the answer is anything other than "we use a payment processor" or "we delete it immediately," that is a red flag. Many schools use processors but do not advertise it, so the question is worth asking.

Dispute rights when a school charges you incorrectly

If a school charges you the wrong amount, charges you twice, or charges you without authorization, you have the right to dispute the charge. How you dispute it depends on how you paid.

If you paid by debit card or bank account, you dispute through your bank. Call or log into your bank's website and report the unauthorized or incorrect charge. Your bank has to investigate within 10 business days and give you a provisional refund while they look into it. The school then has to prove the charge was correct. If the school cannot prove it, the refund becomes permanent.

If you paid by credit card, you dispute through your credit card company. The process is similar: you report the charge, the card company investigates, and you get a provisional credit while they do. Credit card disputes often move faster than bank disputes because credit card companies are more aggressive about protecting cardholders.

Some schools require you to dispute through them first before you can dispute through your bank or card company. That is not legal under federal law, but some schools try it anyway. You can go straight to your bank or card company without asking the school's permission.

Disclosure rules: what schools must tell you before charging

Schools must give you a written disclosure before you enroll or before you authorize a payment. That disclosure must include:

• The amount of each charge and what it covers (tuition, fees, materials, etc.)
• The date or dates when charges will happen
• How often you will be charged (once, monthly, per semester, etc.)
• What happens if a payment fails or bounces
• How to cancel or modify your authorization
• Your dispute rights
• Any fees the school charges if a payment fails (overdraft fees, returned-check fees, etc.)

Many schools bury this information in a student handbook or online portal and assume you have read it. If you have not received a clear written disclosure, you can ask the school's business office for one. If the school refuses or cannot produce one, that is a violation.

State-specific rules on refunds and overcharges

Federal law sets a floor, but states often add their own rules. Some states require schools to refund overpayments within 30 days. Others require refunds within 60 days. Some states say schools cannot charge a fee if a payment bounces; others allow it. Some states require schools to hold tuition money in a separate account and not mix it with operating funds.

Your state's education department website lists the rules that apply to schools in your state. If you are in a public school district, the district's business office can tell you what state rules apply. If you are in a private school, the school's admissions or business office should be able to point you to the relevant state law.

If a school violates a state rule—for example, by refusing to refund an overcharge within the required time—you can file a complaint with your state's education department or attorney general's office. These complaints are free and do not require a lawyer.

What to do if a school violates these rules

Start by contacting the school's business office in writing (email is fine). Describe what happened, what rule you believe was broken, and what you want (a refund, a correction, etc.). Keep a copy of your email and any response.

If the school does not respond or refuses to fix the problem, escalate to your state's education department. Most states have a complaint process for school billing violations. You can also file a complaint with your state's attorney general's office, which handles consumer protection issues.

If the amount is large enough, you can also consult a consumer attorney. Many offer free initial consultations and work on contingency (meaning they take a percentage of what you recover rather than charging you upfront).

Frequently Asked Questions

Can a school charge my account if I only gave permission for one payment?

No. If you authorized a single charge, the school can only charge you that one time. If the school wants to charge you again, it must get new authorization. If it charges you without new authorization, you can dispute it through your bank or card company.

What if my school says I have to pay by automatic withdrawal and I cannot use a credit card?

Schools can require automatic bank withdrawals, but they still have to follow EFTA rules: they need your specific written authorization, they have to tell you the amount and date upfront, and you have the right to cancel. If a school is charging you incorrectly through automatic withdrawal, you can dispute it and also cancel the authorization going forward.

Is it legal for a school to charge a fee if my payment bounces?

It depends on your state. Some states allow it; others do not. Check your state's education code or call your state's education department to find out. If your state does not allow it and the school charged you anyway, you can dispute the fee and file a complaint with your state.

Can I get a refund if I drop out mid-semester?

Refund policies vary by school and by state. Some schools refund a portion of tuition if you drop before a certain date; others do not refund at all. Your school's enrollment agreement or student handbook should spell out the refund policy. If it does not, ask the business office for it in writing. State law may also set minimum refund requirements; check your state's education department website.

What if the school says I owe money but I never authorized the charge?

Dispute it immediately through your bank or card company. Do not wait. Tell your bank that the charge was unauthorized. While your bank investigates, the school may contact you claiming you owe the money. You do not have to pay while the dispute is pending. If your bank rules in your favor, the charge is reversed and you owe nothing.