How to Verify a Bank Account: Methods, Safety, and Your Rights

To verify a bank account, you either sign in to your online banking through a secure aggregator portal inside the app that’s asking (instant, seconds) or wait for the service to send two small test deposits under a dollar and enter the exact amounts back into the app (micro-deposits, one to three business days). Either method needs your bank’s nine-digit routing number and your account number, and both prove to the requesting platform that you actually own the account before money can move.

What You Need Before You Start

Every method requires the routing number and account number. The routing number identifies your bank; the account number identifies your account at that bank.¹ Both are printed along the bottom of a personal check — routing on the left, account to its right — and both appear in your online banking dashboard or mobile app, usually under account details or direct deposit settings.

Some services ask for a voided check instead of typed numbers. Write “VOID” in large letters across the face of a blank check. The service reads the printed numbers at the bottom, and the marking keeps the check from being cashed.

Opening a brand-new account is a different step. Under Section 326 of the USA PATRIOT Act, the bank must collect your name, date of birth, residential address, and a taxpayer identification number such as your Social Security number,²³⁴ Once the account is open, linking it to a payroll processor or payment app uses the same verification methods below.

Instant Verification Through a Data Aggregator

Most apps offer an instant option that runs through a data aggregator — Plaid, Finicity, or MX are the common ones. When you pick it, a secure portal opens inside the app and asks you to sign in with your online banking username and password. The aggregator encrypts your credentials during the connection and passes only the account information you authorize back to the app; the app never sees your bank password.⁵

After you sign in, choose which checking or savings account to link. If your bank uses multi-factor authentication, approve the code sent to your phone or email. The link is usually active immediately.

Two things can push you off this path. Not every bank connects to every aggregator, so if yours isn’t supported the connection will fail. And instant verification depends on having active online banking, so if you haven’t enrolled in your bank’s online portal, do that first. When instant verification isn’t available, the platform will fall back to micro-deposits.

Verification Through Micro-Deposits

The service sends two small ACH credits to your account, each under $1.00.⁶ They arrive in one to three business days depending on your bank’s processing. You won’t get a push notification for them — you have to check your transaction history or statement.

When the deposits post, log back into the platform and enter the exact amounts, down to the cent (for example, $0.12 and $0.36). Matching the precise figures proves you can see the account’s transactions. Once you confirm the amounts, the link activates. Some platforms then pull the same amounts back out to zero the test.

When Micro-Deposits Don’t Arrive

If the deposits never show up after three business days, one of these is usually why:

A mistyped routing or account number. One wrong digit either sends the deposit to the wrong place or triggers a return.
The account is closed or frozen. Banks automatically return ACH entries sent to inactive accounts.⁷
The account doesn’t have a small balance. Some services also send an offsetting debit, so the account may need at least $1.00 to avoid a rejection.
The account type doesn’t accept ACH. Prepaid debit cards, certain money market accounts, and some credit union sub-accounts block incoming ACH transfers.

If a micro-deposit gets returned, fix the underlying issue — correct the account number, confirm the account is open — before you retry.⁷

Verifying a Business Account

Business accounts use the same two methods, but opening one first requires an Employer Identification Number, which the IRS issues free at IRS.gov, usually immediately.⁸ Banks also typically ask for certified copies of your formation documents — articles of incorporation for a corporation, articles of organization for an LLC — and personal government ID from an authorized signer. Once the account is open, linking it to payroll or payment platforms works exactly like a personal account.

Staying Safe During Verification

Typing your bank credentials into a verification portal is safe when the portal is real and dangerous when it isn’t. The FTC has warned that scammers send emails and texts claiming there’s a problem with your account, then route you to a fake login page built to capture your username and password.⁹

A few practical habits keep you on the real portal:

Launch verification from inside the app or website you already trust. Don’t start from a link in an email, text, or pop-up.
Check the URL before you type. Confirm it matches the aggregator’s official domain (Plaid’s, for example, is my.plaid.com).
Turn on multi-factor authentication at your bank. Stolen credentials alone then can’t complete a link.
Use the aggregator’s connections dashboard. Plaid lets you view active connections, disconnect the ones you’re done with, and delete your data from its systems.⁵

If you think a scammer captured your account information, call your bank right away to freeze or close the account, then file a report at IdentityTheft.gov for a recovery plan.⁹

Your Rights Once the Account Is Linked

Federal law sets what happens if a linked account is misused or a transfer goes wrong. Two rules matter most.

Unauthorized Transfers

Under Regulation E, how much you owe for unauthorized electronic transfers depends on how fast you report:¹⁰

Reported within two business days of learning about the problem: liability capped at $50.
Reported after two business days but within 60 days of the statement showing the transfer: liability capped at $500.
Not reported within 60 days of that statement: you could be on the hook for the full amount of any unauthorized transfers that happen after that window.

If something like a hospital stay kept you from reporting, the bank has to extend these deadlines to a reasonable period.¹⁰

Errors on a Transfer

When you report an error like a duplicate charge or wrong amount, the bank has 10 business days to investigate. If it needs longer, it can take up to 45 days, but it has to provisionally credit your account within the first 10 business days while it keeps looking. Once it confirms an error, it has to fix it within one business day.¹¹

Revoking a Third Party’s Access

The CFPB’s Personal Financial Data Rights Rule gives you the right to cut off any third party’s access to your financial data at any time. Once you revoke, the third party has to stop using your data immediately, and deleting what it already collected is the default. Any authorization you grant lasts no longer than a year — after that the third party has to ask again.¹²

1
American Bankers Association. ABA Routing Number
2
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
3
FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Customer Identification Program
4
FinCEN. USA PATRIOT Act
5
Plaid. Trust and Safety
6
Nacha. Micro-Entries
7
Nacha. Micro-Entries
8
Internal Revenue Service. Employer Identification Number
9
Federal Trade Commission. How to Recognize and Avoid Phishing Scams
10
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
11
eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
12
Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule