Microdeposits for Bank Linking: ACH Verification and Scam Risks

Understand what ACH micro-entries are meant to prove

Nacha defines Micro-Entries as small ACH credits and permitted offsetting debits used to verify account access or details. Under its rule, credit micro-entries are less than $1 and one or more offsetting debit entries may not exceed the associated credits in total. The standardized company entry description is ACCTVERIFY. This does not prove the account holder authorized future large debits; it is one mechanism a legitimate originator may use during a separately authorized account-linking process.

A customer might see two small credits, such as $0.14 and $0.31, followed by an offsetting debit of $0.45. The net test amount is zero in that example. The timing and representation can vary, and other valid account-linking methods exist. Do not assume every item under $1 is part of a benign test merely because it resembles micro-entry formatting.

If you did not start an account link, contact your bank through its verified app and ask for the originating company information and reference numbers. Do not enter the amounts into a website reached from an unsolicited text. An unexpected test might indicate your account number has been shared.

Differentiate micro-entry amounts from an instant login connection

Some services validate ownership by asking you to report the exact small credits that reached your account. Others connect through a financial-data provider's secure flow. The former requires waiting for the bank to post the test credits; the latter can involve distinct permissions and credential-handling concerns. Neither method guarantees that every later transaction will be safe. Review the authorized institution name, account type and scope of access before proceeding.

Keep the micro-entry amounts private from people who did not initiate the legitimate verification flow. A scammer who already has your routing and account number may ask you to read the test amounts aloud so they can pass someone else's linking challenge. The amounts are therefore small in money terms but potentially important as an account-control signal.

Verify the service address independently, then enter only the requested values within the authenticated flow you began. Never reveal a bank one-time login code to a person offering to "help" complete microdeposit verification.

The bank-linking service should identify how it will use the verified account afterward. A check of ownership is not sufficient notice that unlimited future debits will be initiated.

Read the net debit correctly and check the ACH originator

The Nacha design requires aggregate offsetting debits not to exceed the corresponding micro-entry credits. This can yield a net credit or zero net movement, but the statement may display separate credit and debit lines on different days. For an example of $0.12 and $0.27 credits with a $0.39 offset, the net is zero. If the purported test instead removes $9.39, do not explain it away as normal without investigating the additional amount.

Check the Company Entry Description and ask the bank for the originator's name and ACH identifiers where available. Some consumer interfaces truncate the description, so an incomplete label alone does not prove malicious activity. A valid bank link should correspond to an action you initiated with a known service and a bank account you actually control.

Keep an exact dated record of your link request and the amounts entered. If you initiate several account connections at once, multiple similar credits can make it easy to verify the wrong service. Wait for the correct descriptor before confirming amounts.

Take care when two financial apps attempt verification on the same day. Matching the wrong pair of tiny credits can accidentally confirm a relationship you did not intend to create.

Stop a verification you did not request

When unexpected micro-entries appear, report them to your bank's fraud department and explain whether any larger debits or unauthorized linked-service actions have followed. Ask how the bank handles stop payments, disputed consumer electronic transfers and account credential changes. A micro-entry itself may be too small to cause a material balance loss, but it can indicate that someone has account numbers or is attempting to validate control elsewhere.

If the bank recommends changing the account number, assess how that affects payroll, autopay and issued checks before taking action. Do not send unknown parties a payment to "return" the tiny credits; banks and legitimate originators have established ways to offset test amounts. Keep alerts enabled for new ACH debits while the bank investigates the source.

A consumer who never requested linking should not report the entry as certainly fraudulent without allowing the bank to identify the originator. Some trusted services run delayed tests after an earlier consent. The appropriate first step is verification, followed by a prompt dispute if the bank identifies unauthorized activity.

If the verification entries came from a service you recognize but no longer use, ask whether a previous pending connection request remained active rather than immediately assuming account takeover.

Complete a legitimate link without expanding permissions

After correctly validating a known service, examine which transfers the service can initiate: one-time credits, recurring deposits, or outgoing debits. A successful micro-entry verification does not override the terms of future transfers or eliminate Regulation E protections where they apply. Use a dedicated transfer account if it helps reduce exposure and if your bank offers suitable controls. Keep the new link documented in a list of connected services.

If the service is no longer needed, unlink it within the service and ask whether your bank can revoke relevant debit authorizations or access tokens. Removing an app from a phone does not necessarily erase an ACH debit authorization. Observe the following statements for unexpected activity before assuming all paths have been closed.

Review how much you intend to transfer and any settlement delays before initiating the first real payment. The fact that the $0.39 verification succeeded says nothing about a future $3,900 transfer being immediate, reversible or free of cutoff restrictions.

Recheck service permissions after linking. A bank account can be correctly verified while the external application's permission settings still exceed what you wanted to authorize.

Editorial Verdict

ACH micro-entries are account-verification tools, not harmless background noise to ignore in every case. Nacha standardizes their tiny credit and offset mechanics and the ACCTVERIFY descriptor, while legitimate originators remain responsible for appropriate authorization and fraud controls. If you started a link, use only its authenticated verification flow and enter exact amounts after confirming the originator. If you did not, ask the bank to identify the entries and monitor for unauthorized follow-up debits. Never reveal account-verification amounts or one-time login codes to unsolicited callers. A zero-net micro-entry can still matter as evidence someone is testing your account details, and a completed link does not grant unlimited authority for later transfers.

Frequently Asked Questions

Do two deposits under $1 mean my account was hacked?

Not necessarily. They may be legitimate test credits associated with an account link you requested.

What does ACCTVERIFY indicate?

It is a standardized ACH description used for Nacha-defined Micro-Entries.

Can the offset debit exceed all micro-credits?

Under the Micro-Entries rule, permitted offsets cannot exceed the related credit total in aggregate.

Sources

• Nacha — Micro-Entries Phase 1 rules
• Nacha — Micro-Entries Phase 2 risk monitoring
• CFPB — Regulation E electronic transfers