Bank Microdeposits: Verify an Account Without Fraud
Understand tiny ACH verification deposits, Nacha micro-entry requirements, suspicious links and when to report unknown debits to your bank.
Two deposits of a few cents may appear in a bank account after you link it to an investment app, payroll provider or payment service. These microdeposits are a legitimate method of confirming access to an account, but unfamiliar verification entries can also signal someone testing information obtained through fraud. The difference lies in whether you initiated the linking process, whether the company is recognizable and what the service asks you to do with the amounts.
How legitimate ACH microdeposit verification works
An account-linking service may send one or more small ACH credits and ask you to report the exact amounts inside its authenticated app or website. Nacha defines a Micro-Entry as a credit of less than $1 used for validation, potentially paired with offsetting debits whose combined value does not exceed the credits. Under its standard, the description includes ACCTVERIFY and the company name should be recognizable to the recipient.
Suppose you start linking a new savings account and see credits of $0.07 and $0.13. You may be asked to enter those figures in the app where you started the request. An offsetting $0.20 debit could follow as part of the verification arrangement. That does not mean every transaction involving a few cents is safe; it simply describes a recognized pattern. Never enter amounts in an unrelated text-message link that arrives without context.
Nacha's Micro-Entry framework requires relevant ACH verification credits to be below $1 each, while any associated offsetting debits must not exceed the combined credits. A verification debit can therefore be visible without being an ordinary unauthorized withdrawal, but a surprise entry is not automatically legitimate just because it is small. The standardized company-entry description ACCTVERIFY is a useful clue, not proof that the sender is trustworthy. If you did not initiate account linking, report the activity and ask the receiving bank to identify the originator before confirming amounts to any third party.
Identify suspicious verification attempts
If you did not link any account, treat unexplained microdeposits as a reason to investigate. An attacker with a routing and account number may attempt to validate access through a payment platform. A tiny credit by itself does not prove a criminal has authorization to withdraw funds, but it can precede more consequential activity. Note the descriptors and contact your bank's fraud department using an independently verified channel.
Watch for requests to disclose one-time passcodes, online banking credentials or the exact deposit amounts to a caller claiming to be from customer support. The microdeposit amounts are often used to prove account access, so revealing them to an unsolicited stranger defeats the validation purpose. Revoke unknown external account links if the bank offers that function and review pending ACH debits. Save the transaction details before the entry disappears from an app's recent-activity screen.
Understand the difference from instant login-based linking
Some services connect accounts through a third-party authorization flow instead of waiting for small ACH deposits. That approach may provide faster verification, but it introduces different questions about permissions, data sharing and revocation. A service that asks you to authenticate through a trusted bank-controlled flow is operationally different from one that asks you to type full banking credentials into its own unrelated page.
Before linking, examine what the service may retrieve: account ownership, balances, transaction history or permission to initiate debits. A customer who merely needs to move $50 once may not want ongoing read access to months of transactions. Compare the availability of microdeposit verification, its time delay and the security consequences of broader data-sharing permission. Check the provider's revocation method and whether unlinking actually cancels scheduled transfers.
Know what verification does not guarantee
Successful microdeposit verification confirms something about access to an account, not that every future transfer is authorized, affordable or instant. The service may still impose hold periods, transfer limits and fraud reviews. A bank may display the tiny credits as pending before they finally post, while the linking service can require you to wait for final amounts. Do not repeatedly submit guesses if a link fails; the provider may lock the attempt.
If an unintended ACH debit follows unfamiliar microdeposits, report the debit promptly as a potentially unauthorized electronic transfer. Preserve the original microdeposit dates and your statement history; they can help identify the source. Consumers may have rights under Regulation E, but the specific protections and deadlines depend on what occurred. Do not assume that reversing the validation entries will automatically cancel a later authorization you genuinely provided elsewhere.
Build a safer routine for linking accounts
Initiate links only through the account or service you intended to use, double-check the receiving institution and limit the number of unused connections. Set transaction alerts for small and large entries. If the service offers a choice, evaluate whether an occasional transfer can be made by another route without leaving standing external-debit access. Review external linked accounts quarterly and remove those no longer necessary.
For a payment app that will pull monthly rent, verify the link well before the first due date. For a one-time investment transfer, do not schedule a large transfer until the small-amount validation has succeeded and the institution confirms availability. Keep the details of the app, bank and dates in your records so an unfamiliar transaction can be traced without relying on guesswork.
One practical safeguard is to create a short log whenever you intentionally connect a new service: record the date, provider name and bank account nickname, without recording passwords. Later, a small transaction labeled ACCTVERIFY can be matched against that log. If the provider is missing from the list, treat it as unexplained until verified. This also makes it easier to distinguish an old forgotten link from a new fraudulent attempt.
MyBankAnswers Editorial Verdict
Microdeposits are a useful verification mechanism when you started the process and can identify the originator. They are a warning sign when they appear unexpectedly, especially alongside requests for login codes or unusual debits. Confirm amounts only inside the legitimate service you already opened and never provide them to a surprise caller. The safest practice is to distinguish account verification from permission to debit, review what data is shared and report unknown entries quickly. Small dollar amounts should not lead consumers to dismiss the security implications of an unfamiliar account link. Unexpected verification credits are worth investigating before you enter their amounts anywhere.
Official sources and research notes
- Nacha: micro-entry rules and validation
- Nacha: micro-entry fraud controls
- CFPB: unauthorized bank transactions
Research status: Second-pass editorial review, October 10, 2026. Key consumer-rights and regulatory distinctions were checked against the primary materials listed. This does not constitute a legal opinion or an exhaustive review of every state-law exception; current account terms and live URLs must be checked before publishing.