Instant Account Verification (IAV)

Instant account verification (IAV) is a way of confirming, within seconds, that a bank account exists, is open and is controlled by the person who wants to link it. In its most common form the customer chooses their bank from a list, signs in with their online banking credentials through a secure window, and picks the account to connect. The verifying company receives the account and routing numbers, and often the account holder's name and balance, directly from the bank's records.

The technique is used mainly in the United States, where bank payments over the ACH network carry no built-in check that the account details are correct or that the payer owns the account. It replaced, for most consumer flows, the slower micro-deposit verification, which takes one to three business days. IAV is one form of bank account verification and is usually supplied by a data aggregator.

There are three broad methods, and providers often combine them.

• Credential-based login. The customer authenticates with their bank inside the provider's module. Where the bank offers an open banking API, the customer is redirected to the bank's own page and approves sharing through OAuth, so the provider never sees the password. Where no such interface exists, the provider may log in on the customer's behalf by screen scraping, a practice that banks and regulators have been working to phase out.
• Database verification. The account and routing numbers typed by the customer are checked against a shared database of account status and history contributed by banks. This confirms that the account is open and in good standing, and some services also match the owner's name, but the customer does not log in.
• Instant micro-deposit. A tiny credit carrying a code is sent over an instant payment rail such as the RTP network or FedNow, and the customer reads the code from their banking app immediately.

A login-based check proves more than the others. It shows that the person has access to the account, which is strong evidence of ownership, and it can return the name on the account for comparison with the customer's profile in an account ownership check.

The largest use is linking a funding account for ACH debit. Brokerage apps, wallets, lenders, payroll services and bill payment platforms verify the account before pulling money from it. Verification is also used before paying money out, so that wages, loan proceeds or marketplace earnings are not sent to a mistyped or closed account.

Because the same connection can return balances and transactions, many companies use it for more than verification. A balance check just before a debit reduces returns for insufficient funds. Lenders use the transaction history to assess income. Merchants offering pay by bank at checkout rely on an instant link so the customer can pay on the first visit.

Under the Nacha Rules, an originator of internet-initiated consumer debits, known as a WEB entry, must use a commercially reasonable system to detect fraud. Since 2021 that system must include validating the account number the first time it is used and whenever it changes. Nacha does not prescribe the method: an ACH prenote, micro-deposits, a database check or a login-based service can each satisfy the rule. Instant methods are popular because they do not interrupt the customer's sign-up.

Originators also have a commercial reason. Each ACH return carries a fee, and Nacha sets limits on the rate of unauthorized and administrative returns that an originator may run. Verifying accounts at the start is the simplest way to stay below those limits.

Coverage is not complete. Small banks and credit unions may not be reachable by every aggregator, some customers will not share banking credentials with a third party, and bank connections fail from time to time. Providers therefore fall back to micro-deposits or manual entry when the instant route is unavailable, and conversion through the linking step is a closely watched number.

Verification is not a guarantee against fraud. A criminal who has taken over a victim's online banking can pass a login-based check, so companies combine IAV with identity checks, device signals and limits on new accounts. An instant check shows the position at one moment: the account may be emptied or closed before the debit arrives. A verified account can still produce an unauthorized return if the true owner later disputes the payment.

Data handling is the other concern. Access to a customer's bank data depends on clear permission, and good practice limits the data collected to what the purpose requires and lets the customer withdraw access, the subject of consent management. In the United States the legal framework for consumer-permissioned data sharing under section 1033 of the Dodd-Frank Act has been contested and remains unsettled, while the industry has been moving connections from scraping to bank-provided interfaces by agreement.