How to Verify a Bank Account: Methods, Safety, and Your Rights

To verify a bank account, you either sign in to your online banking through a secure aggregator portal for an instant connection, or you wait one to three business days for the service to send two small test deposits that you then confirm. Both methods prove you own the account before an employer, app, or payment platform will move money through it, and the method you use is usually dictated by whether your bank supports instant verification.

What You Need Before You Start

Every verification method asks for your bank’s nine-digit routing number and your account number.¹ Both appear along the bottom of a personal check, with the routing number on the left and the account number to its right. If you don’t have checks, look in your online banking dashboard or mobile app, usually under account details or direct deposit settings.

Some services ask for a voided check instead of typed numbers. Write “VOID” in large letters across the face of a blank check. The service reads the printed routing and account numbers, and the marking keeps anyone from cashing it.

If you’re opening a new account rather than linking one you already have, the bank will also collect your name, date of birth, residential address, a taxpayer identification number such as your Social Security number, and unexpired government-issued photo identification.²³ These requirements come from Section 326 of the USA PATRIOT Act.⁴

Instant Verification With a Data Aggregator

Many apps route verification through a data aggregator such as Plaid, Finicity, or MX. When you choose the instant option, a secure portal opens where you enter your online banking username and password. The aggregator uses AES-256 encryption and Transport Layer Security to protect the credentials, and the requesting app never receives your bank password; the aggregator confirms ownership and transfers only the account data you authorize.⁵

After signing in, you pick which checking or savings account to link. If your bank uses multi-factor authentication, you’ll approve a code sent to your phone or email. The connection is typically active within seconds.

Not every bank supports instant verification. If yours doesn’t, or the connection fails, the platform will usually fall back to micro-deposits. Instant verification also assumes you’ve enrolled in your bank’s online portal. If you haven’t, set that up first.

Verification With Micro-Deposits

When instant verification isn’t available, the service sends two small ACH credits to your account, each less than $1.00.⁶ They usually arrive within one to three business days and generally won’t trigger a push notification, so you’ll need to check your transaction history or statement to find them.

Once the deposits show up, log back into the platform and enter the exact amounts, such as $0.12 and $0.36. Matching the figures proves you can see the account’s transaction records. After you confirm the correct amounts, the link activates. Some platforms then withdraw the deposits to zero out the test.

When Micro-Deposits Don’t Arrive

If the deposits never show up, the usual causes are:

A mistyped routing or account number. Even one wrong digit sends the deposits elsewhere or triggers a return.
A closed or frozen account. Banks automatically return ACH entries sent to accounts that aren’t active.⁷
Insufficient funds. Some services send an offsetting debit alongside the credit, so the account may need at least $1.00 available to avoid a rejection.
An unsupported account type. Prepaid debit cards, certain money market accounts, and some credit union sub-accounts can block incoming ACH transfers.

When a deposit is returned, fix the underlying issue before you try again. That usually means correcting the account number or making sure the account is open and can accept ACH credits.⁷

If the Account Is a Business Account

Business accounts verify through the same instant and micro-deposit methods, but opening one requires extra documentation up front. Most banks ask for your Employer Identification Number, which the IRS issues at no charge and, for most business types, delivers immediately through its online application.⁸ Banks typically also want certified copies of your formation documents (articles of incorporation for a corporation, articles of organization for an LLC), and an authorized signer must provide personal government-issued ID. Once the account is open, linking it to payroll, payment, or accounting platforms works the same way as linking a personal account.

Staying Safe During Verification

Typing bank credentials into a verification portal is only safe if the portal is legitimate. Phishing pages that mimic bank logins are a common way scammers harvest usernames and passwords, often after sending an email or text claiming a problem with your account.⁹

A few habits keep the process safe:

Launch the verification flow from inside the trusted app or website itself, not from a link in an email, text, or ad.
Check the address bar before typing. It should match the aggregator’s official domain, such as my.plaid.com.
Turn on multi-factor authentication for your bank login so stolen credentials alone can’t complete a connection.
Use the aggregator’s dashboard to review active links, disconnect what you no longer use, and delete stored data.⁵

If you think a scammer has your account information, contact your bank right away to freeze or close the account, then report the incident at IdentityTheft.gov for a recovery plan.⁹

Your Rights Once the Account Is Linked

Federal law gives you specific protections after a third party has access to your account. They matter most when something goes wrong.

Unauthorized Transfers

Under Regulation E, your liability for unauthorized electronic transfers depends on how quickly you report the problem:¹⁰

Reported within two business days of learning about the unauthorized access: your liability caps at $50.
Reported after two business days but within 60 days of your bank statement: liability caps at $500.
Not reported within 60 days of the statement: you can be responsible for the full amount of any unauthorized transfers happening after that window.

If circumstances such as a long hospital stay kept you from reporting sooner, the bank must extend these deadlines to a reasonable period.¹⁰

Error Resolution

When you report a transfer error, such as a duplicate charge or a wrong amount, the bank has 10 business days to investigate and decide whether an error occurred.¹¹ If it needs longer, it can take up to 45 days, but it must provisionally credit your account within the initial 10 business days while it keeps looking. Once the bank determines an error occurred, it must correct it within one business day.

Revoking Third-Party Access

The CFPB’s Personal Financial Data Rights Rule lets you revoke a third party’s access to your financial data at any time. After you revoke, the third party must stop using your data immediately, and deleting what it already collected is the default.¹² Any authorization you grant lasts no longer than one year, after which the third party must ask again.

What to Expect After Verification

Once verification is complete, the platform switches the account from pending to active. You may get a confirmation email that summarizes the terms of the link, including transfer limits and processing times. Read it. Platforms often impose their own daily or monthly caps on newly verified accounts, and those caps may loosen as you build a transaction history.

Before you schedule anything large or recurring, run a small test transaction to confirm funds move as expected. Same Day ACH transfers are capped at $1 million per item at the network level.¹³ Standard next-day or two-day ACH transfers have no federal per-item cap, though your bank or the platform may set its own. With a verified link, you can authorize direct deposits, schedule recurring bill payments, set up automated savings transfers, or connect the account to budgeting and investment apps.

1
American Bankers Association. ABA Routing Number
2
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
3
FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Customer Identification Program
4
FinCEN. USA PATRIOT Act
5
Plaid. Trust and Safety
6
Nacha. Micro-Entries
7
Nacha. Micro-Entries
8
Internal Revenue Service. Employer Identification Number
9
Federal Trade Commission. How to Recognize and Avoid Phishing Scams
10
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
11
eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
12
Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule
13
Federal Reserve Financial Services. Same Day ACH Frequently Asked Questions