To verify a bank account, you either sign into your bank through the platform’s secure connection for instant confirmation, or you wait one to three business days for the platform to send two small test deposits and then enter those exact amounts back on the platform. Both methods prove the account exists and belongs to you. Which one you use depends on whether the platform and your bank support instant verification; if not, micro-deposits are the universal fallback.
What You Need Before You Start
Two numbers do all the work: your bank’s nine-digit routing number and your personal account number. The routing number identifies the financial institution. The account number points to your specific account inside it.
On a paper check, the routing number sits on the far left along the bottom edge, and the account number sits in the center. The number on the right is the check number and doesn’t matter here.
Most people pull these numbers from somewhere other than a checkbook:
- Online or mobile banking, usually under account details or a section labeled “account and routing numbers.”
- A paper or electronic statement, printed near the top or bottom of the page.
- Your bank’s public website, which often lists routing numbers on a help page (you’ll still need to log in for the account number).
- A phone call or branch visit, after the bank confirms your identity.
Some employers still ask for a voided check to set up direct deposit. Write “VOID” in large letters across a blank check; the printed routing and account numbers remain readable, but no one can cash it.
ACH and Wire Routing Numbers Are Not Always the Same
This is where verifications quietly fail. Some banks assign one routing number for ACH transfers (direct deposits, payment apps, most online transfers) and a different one for wire transfers (one-off, higher-value transactions like real estate closings). Account verification uses the ACH routing number. If your bank uses separate numbers and you enter the wire version, the verification will fail or payments will route incorrectly. Confirm with your bank which number applies to electronic transfers and direct deposits.
Instant Verification
Instant verification links the platform to your bank through a secure third-party service. You’re redirected to a login screen, you enter your online banking credentials, and the service confirms in real time that the account exists, that you own it, and that it’s in good standing. The whole exchange usually takes under a minute, and the account is immediately available for transfers.
How the service handles your login matters for security. Newer connections use tokenized access: you authenticate directly with your bank, and the third party receives a limited-permission token instead of your username and password. Older systems used screen scraping, storing your credentials and logging in on your behalf. If the platform’s login screen is clearly your bank’s (its branding, its URL in the redirect), you’re on a tokenized flow. If a third-party service is asking you to type your bank password into its own form, it’s likely storing those credentials.
Micro-Deposit Verification
When instant verification isn’t available, the platform sends two small amounts, usually a few cents each, to the account you provided. They typically land in one to three business days. Once you see them, you return to the platform and type the two exact amounts into a confirmation form. Entering the correct values proves you can view the account’s transactions, which stands in for ownership.
You have a limited window to finish, usually around seven to ten days depending on the platform. Miss it, or enter wrong amounts too many times, and the verification expires. You start over.
The test deposits are usually pulled back automatically within a few days, sometimes combined into a single withdrawal. The net effect on your balance is zero.
Micro-deposits are slower and require you to come back to the platform, but they work with essentially every bank and credit union in the country. They’re also the fallback when an instant verification attempt fails because the bank’s systems are briefly unavailable or don’t support third-party connections.
When Verification Fails and How to Fix It
The single most common cause is the wrong routing number. Roughly 100 new routing numbers are registered each year and 300 to 500 are retired, often because of bank mergers and acquisitions. If you switched banks, or your bank was acquired, the number printed on an old check may no longer be valid.
Other things that trip verifications:
- Name mismatch. The name on the bank account must match what the platform has on file. A nickname, a maiden name, or a business account registered under your personal name will often be rejected. Business accounts need the legal entity name.
- Wrong account type. Some platforms accept only checking accounts for certain transactions, or require you to correctly label the account as checking or savings during setup. Picking the wrong type can cause a silent failure.
- ACH versus wire routing number, as above.
- Closed or frozen accounts. If the account has been closed, frozen for suspicious activity, or placed under a hold, neither method will succeed.
If a verification fails, confirm your routing number through your bank’s online portal or by calling. Don’t rely on numbers from old checks or deposit slips printed before a merger.
Security When Sharing Bank Credentials
Handing a third-party service your banking login makes people uneasy, and the level of actual risk depends on how that service accesses the account.
Tokenized API connections (sometimes called open banking) are significantly safer than screen scraping. With a tokenized connection, you authenticate on your bank’s own page and the third party gets a limited access token; your credentials never pass through or get stored. Screen scraping requires the service to store your actual username and password, creating a centralized pool of credentials that becomes a high-value target for breaches.
FINRA has warned that data aggregators using screen scraping create “heightened security risk” by storing financial information and credentials in one place, and that many aggregators “operate under limited regulatory oversight” compared with banks and other registered financial institutions. Before granting access, FINRA recommends checking whether the aggregator uses encryption, how long it retains your data, and whether it can sell your information to other companies.
Your Rights If Something Goes Wrong
Once your account is linked, two layers of federal protection apply.
The Electronic Fund Transfer Act, codified at 15 U.S.C. § 1693, sets the baseline rules for consumer electronic transfers. It requires financial institutions to disclose transfer terms clearly, investigate errors you report, and follow set timelines for resolving disputes.
Your liability for unauthorized transfers depends on how fast you report them. Under 15 U.S.C. § 1693g:
- Report within two business days of learning about the unauthorized access, and your maximum liability is $50.
- Report after two business days but within 60 days of the statement showing the transfer, and your exposure rises to $500.
- Wait more than 60 days after the statement, and you can be held responsible for everything taken after that 60-day mark.
The two-day clock starts when you learn about the problem, not when the transfer happened. Check linked accounts in the days right after a new verification, and if you see a transfer you didn’t authorize, call your bank the same day.
Disconnecting a Link You No Longer Use
A verified link stays active until you cut it. If you stop using a service, leaving the connection open is unnecessary exposure.
For services that connected through a tokenized bank data-sharing system, most banks offer a management page in your online banking settings where you can see which third parties have access and revoke authorization. Look for a section labeled something like “third-party access,” “connected apps,” or “account data sharing.”
For services that used screen scraping and stored your login, there’s no clean switch to flip. Changing your online banking password is the most reliable way to cut access, because the stored credentials stop working. Contact the service directly to request deletion of your stored information.
If the link was tied to recurring payments, set up an alternative payment method before you disconnect so you don’t trigger missed payments or late fees. Then watch the account for a few days to confirm no new unauthorized transactions appear.