I went through this exact situation with a gym that kept charging me $79/month for 18 months after I canceled. Total unauthorized charges: $1,422. Here is the step-by-step process that got me a full refund plus additional compensation.
First, understand your rights under the Electronic Fund Transfer Act (EFTA), codified at 15 U.S.C. Section 1693. For unauthorized ACH debits, you have 60 days from the date the statement showing the unauthorized charge is sent to you to notify your bank. If you notify within 60 days, your liability is limited to $50 per transaction.
I immediately called my bank and requested an ACH stop payment on the company originator ID. Under Regulation E (12 CFR 1005.10), your bank must honor a stop payment request if received at least three business days before the next scheduled debit. I followed up in writing as required by the regulation.
For past unauthorized charges, I filed disputes with my bank under EFTA/Reg E for each charge within the 60-day window. For older charges, I sent a formal demand letter to the gym citing the EFTA and my state consumer protection statute. The gym corporate office responded within 10 days and refunded all 18 months of charges plus a $200 goodwill payment. Always file with the CFPB as well, as companies respond much faster to regulatory complaints.