Micro-Deposit Verification

Micro-deposit verification is a method of confirming that a bank account exists and that the person linking it has access to it. A company sends one or two very small credits, typically a few cents each, to the account number the customer has supplied. The customer looks up the amounts on their bank statement or banking app and enters them on the company's site. Matching amounts show that the account is open and that the customer can see its transactions.

The method is used mainly in the United States, where the ACH network does not verify the account holder's name and a mistyped or stolen account number would otherwise go undetected until a payment failed or was disputed. It is one of several forms of bank account verification. For many consumer products it has been overtaken by instant account verification, but it remains the universal fallback because it works with any bank.

The customer enters a routing number and account number. The company, acting as originator through its bank, sends two ACH credit entries of random amounts under one dollar. They reach the account in one to three business days, or sooner by Same Day ACH. The customer returns to the site, usually prompted by an email, and types in the two amounts. If they match, the account is marked verified and can be used for payments; after a limited number of wrong attempts the link is locked.

Many companies recover the deposits with a single offsetting debit. A newer variant sends one deposit carrying a short code in the statement description, which the customer enters instead of an amount. Where the customer's bank is connected to an instant payment network, the deposit can arrive within seconds, removing the waiting period.

The Nacha Rules have recognised these payments formally since 2022 under the name micro-entries. A micro-entry is defined as a credit of less than one dollar, together with any offsetting debit, used to verify an account. Originators must label the entries with the description ACCTVERIFY so that receiving banks and customers can recognise them, and the company name must be one the customer will know.

Any offsetting debits must not exceed the total of the credits and must be sent at the same time, so that the customer's account is never left out of pocket. Since 2023 originators must also use commercially reasonable fraud detection on micro-entries, including monitoring the volumes sent and returned. Verification by micro-entry is one of the methods accepted for the account validation requirement that applies to internet-initiated consumer debits, the WEB entry.

The method's strength is reach. It needs nothing from the customer's bank beyond the ability to receive an ACH credit, it does not ask the customer to share online banking credentials, and it confirms more than an ACH prenote, which tests only that the account number is valid.

Its weakness is delay and effort. The customer must wait days and then come back, and a large share never do. Businesses that depend on quick activation, such as trading apps or lenders, lose customers at this step, which is why they offer instant methods first and micro-deposits second. The process also verifies access, not identity: it shows that someone can see the account's activity, but it does not return the owner's name, so it is weaker than an account ownership check and no substitute for name-matching services such as Confirmation of Payee in the United Kingdom.

Micro-deposits can be misused. A fraudster who has taken control of a victim's online banking through account takeover can read the amounts and link the victim's account to a wallet or brokerage account, then pull funds by ACH debit. Verification should therefore be combined with identity checks and limits on newly linked accounts.

A second pattern targets the verifying company. Criminals use scripts to trigger thousands of micro-deposits to accounts they control or to random account numbers, either to collect the small sums at scale or to discover which account numbers are valid for later fraud. This abuse prompted the Nacha monitoring requirement. Defences include a velocity check on verification attempts per customer and device, limits on retries, and tracking of each ACH return generated by deposits to closed or non-existent accounts.

Similar techniques exist elsewhere under names such as penny test or penny drop. In India, lenders and payment companies send one rupee through an instant payment system, and the response returns the registered name of the account holder, giving ownership confirmation without any action by the customer. In the euro area a small first payment by the customer is often used to confirm an account before a direct debit mandate is accepted. Where a payee name-checking service is built into the payment system itself, as in the United Kingdom and, since 2025, the euro area's instant transfers, the need for micro-deposits is much reduced.