What Is ACH Verification and How Does It Work?

ACH verification is the step a business takes to confirm that a bank account exists and belongs to you before it debits that account through the Automated Clearing House network. Nacha, the organization that writes the rules for ACH payments, requires this check before the first online consumer debit runs. The verification can happen in a few different ways: small test deposits you confirm a couple of days later, an instant login-based check that finishes in seconds, or a zero-dollar test entry sent quietly through the network.

What Information You Provide

Every verification method starts with the same three pieces of information from your account. The nine-digit routing number identifies your bank. Your account number identifies you within that bank. And the account type tells the system whether it is checking or savings. You can find the routing and account numbers printed along the bottom of a paper check, with the routing number on the left, or listed in your online banking under account details.¹

The business also needs your signed authorization. That authorization sets the terms: when the business can debit the account, how much, and for how long the permission lasts.² If the debits will recur, the authorization must also explain how you can revoke permission for future transactions.³ Nacha does not require a particular format, but the business must be able to produce proof of your authorization if anyone asks for it.

How the Verification Methods Work

Micro-Deposits

With this method the business sends two small credits, each under one dollar, to your account. Nacha calls these micro-entries and requires them to carry the description “ACCTVERIFY” so you can spot them in your transaction history.⁴ The credits usually arrive within one to three business days. You return to the verification screen, enter the exact amounts, and matching the figures proves you have access to the account’s transaction records.

Miss the confirmation window or enter the wrong amounts and the link expires; you start over. In some cases the processor sends a small offsetting debit to bring the balance back to where it started. Nacha rules cap the offsetting debits at no more than the credits sent and require both to share the same effective date, so the net effect on your account is never a charge.⁴

Instant Verification

Instant verification skips the wait by connecting to your bank in real time. You pick your bank from a list and then authenticate, either by entering your online banking credentials into a secure window run by the verification provider or by being redirected to your bank’s own login page if the bank supports OAuth. The provider confirms the account is active and that the identity matches, then returns a token to the business. Your actual banking password never reaches the merchant.

This is the fastest option. It finishes in seconds. It also involves sharing your financial data with a third party, which is why federal rules now limit how that data can be used. Those limits are covered further down.

Prenotifications

A prenotification, or prenote, is a zero-dollar test entry sent through the ACH network. Your bank has a standard return window to flag any problem, such as an invalid account number or a closed account. If nothing comes back during that window, the business can treat the account as validated and start sending real payments.⁵

Prenotes are the slowest method because the business has to wait out the return period before running any live entries. They also confirm only that the account exists and is open; they do not confirm that you are the account holder. From your side there is nothing to do, because no money moves.⁵

Why Businesses Have to Verify

Nacha’s Supplementing Fraud Detection Standards for WEB Debits rule, effective March 19, 2021, requires businesses to validate consumer account information before the first online debit. The requirement also applies whenever the account number on file changes, not just at initial setup.⁶

The rule does not name one required technology. It calls for a “commercially reasonable” method, which lets each business pick an approach that fits. Nacha recognizes several as sufficient: a prenotification entry, micro-entry verification, a commercial validation service that checks account status against its own database or bank connections, and API-based validation that queries a financial institution in real time. What counts as commercially reasonable depends on the size of the business, its risk profile, and how it compares to similar organizations. An account with a proven history of successful payments from the same customer can itself serve as sufficient validation for a new authorization.⁵ Businesses that fail to comply face financial penalties and possible suspension from the ACH network.

One boundary worth knowing: this mandatory first-use validation rule applies to consumer WEB debits, not to business-to-business ACH payments. Corporate transactions using CCD or CTX formats sit outside the requirement, though Nacha still encourages validation as a best practice.⁷

When Verification Fails

When an ACH transaction cannot go through, the receiving bank sends back a return code that says why. Two codes point directly at validation problems. R03, “No Account / Unable to Locate Account,” means the account number is structured correctly but does not match the named individual or is not open. R04, “Invalid Account Number,” means the number itself is malformed. Frequent R03 and R04 returns are a sign that a business is not checking accounts carefully before submitting transactions.

Two other codes matter if you ever need to push back on a charge. R10, “Not Authorized,” applies when you have no relationship with the business and did not authorize the debit at all. R11, “Authorization Error,” applies when you did authorize the business but the specific debit does not match the terms you agreed to, such as a wrong amount or an early debit date. R11 preserves the underlying authorization and lets the business correct the mistake and resubmit within 60 days.⁸ Using the right one matters when you are disputing a charge with your bank.

Your Protections If Something Goes Wrong

Federal law caps your losses when an unauthorized ACH debit hits your account. Regulation E, which implements the Electronic Fund Transfer Act, sets the caps based on how fast you tell your bank:

Notice within two business days of learning about the unauthorized transfer: liability capped at $50.⁹
Notice after two business days but within 60 days of the statement showing the transfer: liability up to $500.⁹
Notice after 60 days: you can be responsible for all unauthorized transfers that occur after the 60-day window closes, until you notify your bank.

If something like a serious illness or extended travel kept you from reporting on time, your bank must extend those deadlines to a reasonable period.¹⁰ State law or your account agreement can set lower liability limits, and if it does, the lower limit is what applies. Your bank must investigate any error you report within 60 days of the statement that first showed the problem. The clock runs from when the statement is sent, not when you open it, so checking statements regularly is the most practical protection you have.

Instant verification adds a second layer of protection because you are handing bank data to a third party. The CFPB’s Personal Financial Data Rights rule at 12 CFR Part 1033 phases in beginning April 1, 2026, for the largest depository institutions and nondepository data providers.¹¹ Under the rule, a verification provider that accesses your bank data must limit its collection, use, and retention to what is reasonably necessary to deliver the product or service you asked for. Using your data for targeted advertising, cross-selling, or resale to others is prohibited unless you separately consent to each of those uses as a standalone service.¹²

The rule also caps ongoing data access at one year from your most recent authorization. To keep pulling your information after that, the provider has to get a new authorization from you. If you revoke access or decline to reauthorize, the provider must stop using and retaining the data it already collected, unless keeping it is still reasonably necessary to finish a service that is already underway.¹²

1
American Bankers Association. ABA Routing Number – Find Your Number, and Search Database
2
Nacha. The Importance of Compliant ACH Authorizations
3
ACH Guide for Developers. How ACH Works
4
Nacha. Micro-Entries
5
Nacha. Account Validation Frequently Asked Questions
6
Nacha. Supplementing Fraud Detection Standards for WEB Debits
7
Nacha. Account Validation Resource Center
8
Nacha. Differentiating Unauthorized Return Reasons
9
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
10
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
11
eCFR. 12 CFR Part 1033 – Personal Financial Data Rights
12
Federal Register. Required Rulemaking on Personal Financial Data Rights