Bank Account Verification Service: How It Works and How to Choose One

What is a bank account verification service?

A bank account verification service confirms that a bank account is real, open and owned by the person or business you're about to pay. It replaces voided checks, emailed bank details and phone calls. It's done instantly through a bank login or within days through micro-deposits.

AP and treasury teams use one when they add a new vendor, when a vendor sends new bank details, and before large or first-time payments. This guide covers what a service checks, how instant bank account verification works, when you need a bank account verification API instead of a bank account verification tool, and what to look for when you choose a provider.

What does a bank account verification service actually check?

Not every service checks the same thing. Most check that an account exists. Fewer check who owns it. The difference matters, because a criminal's account is a perfectly valid account.

Check	What it proves	What it doesn't prove
Routing number check	The routing number belongs to a real US bank	That the account number is real
Account validation	The account is open and can accept ACH payments	Who owns the account
Account ownership verification	The name on the account matches the vendor you're paying	That the person who sent the details is authorized
Identity verification	The person sharing the bank details is who they say they are	That the business itself is legitimate
Business verification	The company is registered and in good standing	That this is the right bank account for it

Even Nacha's own rule for online debits only requires the first two. Its minimum standard is to "validate that an account is open and accepts ACH entries" (Nacha, WEB Debit Account Validation). That's the floor, not protection against vendor fraud. For outgoing vendor payments, you want ownership and identity checks too.

Why isn't a voided check or W-9 enough?

Because anyone can make one. A voided check is an image, and a W-9 is a PDF the vendor sends out. Neither is checked against the bank. A criminal posing as your vendor can send both, with their own account number on the check, and they'll look exactly like the real thing.

That's the problem with paper and PDFs: they prove what someone typed, not what the bank has on file. And they usually arrive by email, the channel criminals use most. In 2024, vendor imposter fraud hit 45% of organizations, up from 34% the year before, and invoice fraud rose to 24% from 14% (AFP 2025 Payments Fraud and Control Survey, key highlights, p. 3). More than half of treasury practitioners said their AP department is the most vulnerable to email fraud (p. 13).

A W-9 still has a job: it gives you the vendor's tax ID for 1099 reporting. But it isn't proof of who owns a bank account. A verification service checks the account against bank data instead of trusting the document.

How does instant bank account verification work?

Instant bank account verification confirms an account in seconds, usually by having the account holder log in to their bank. There are two common methods:

• Bank login. The vendor signs in to their online banking through a secure connection. The service reads the account and routing numbers and the name on the account directly from the bank. Your team never sees the login, and the vendor never types an account number, so there's nothing to mistype or edit.

• Account status lookup. The service checks the account number against bank network data to confirm it's open and in good standing. No login is needed, but this usually confirms that the account exists, not who owns it.

Bank login gives the strongest result because the data comes straight from the bank and proves the person had access to the account. The trade-off is coverage: not every bank, and not every vendor, will connect this way. A good service falls back to another method instead of leaving you with no answer.

What are micro-deposits and are they still useful?

Micro-deposits are tiny payments sent to an account. The account holder reports the amounts back, which proves the account is open and that they can see its activity.

Nacha calls these Micro-Entries and has set rules for them since September 16, 2022:

• They must carry the description "ACCTVERIFY" so the account holder knows what they are.

• Since March 17, 2023, senders must run "commercially reasonable fraud detection" on them, including monitoring forward and return volumes.

• Silence doesn't count. If the amounts are never confirmed, the account isn't verified (Nacha, Micro-Entries).

They're still useful as a fallback when a vendor can't or won't use bank login. The downsides: they take one to two business days, they depend on the vendor coming back to confirm, and on their own they don't confirm the account holder's name. Use them as one method among several, not the only one.

When do you need a bank account verification API?

A bank account verification API lets your own software request a verification and get the result back automatically. You need one when verification has to happen inside a system you already run, not in a separate tool.

An API makes sense when:

• You onboard vendors or recipients at volume, such as a marketplace, platform or payroll provider adding hundreds a month.

• You have your own onboarding portal and want verification built into it.

• You want results written straight into your ERP or AP system, so no one re-keys bank details.

• You have developers who can build and maintain the integration.

Most AP teams don't need one. A bank account verification tool with a web dashboard and shareable request links does the same checks with no code. Nacha's rules don't favor either. They are "neutral with regard to specific methods or technologies" and list API-based services alongside micro-entries and prenotes as acceptable ways to validate an account (Nacha).

Tool, API or manual callback: which should you use?

Pick by volume and by who will run it. Many teams use a tool for day-to-day work and keep a callback as a backup.

	Verification tool	Verification API	Manual callback
Best for	AP and treasury teams	Platforms and high-volume payers	Teams with no tool yet
Setup	Sign up and send a link	Developer integration	None
Speed	Seconds with bank login; days with micro-deposits	Seconds with bank login; days with micro-deposits	Hours to days, depending on reaching the vendor
Confirms the account exists	Yes	Yes	No
Confirms who owns it	Yes, with bank login	Yes, with bank login	No, only what the vendor tells you
Audit trail	Built in	Built in, stored in your system	Notes you keep yourself
Main risk	Vendor may not finish the request	Build and maintenance time	Calling a number the criminal controls

A callback is still worth doing on any bank change if you have nothing else. Call a number you already had on file, never the one in the request. It confirms the request is real, but not that the account belongs to your vendor.

What should you look for in a bank account verification provider?

Ask each provider these questions before you sign:

1. Does it verify ownership, or only that the account exists? Validation alone won't stop a criminal who opened a real account.

2. Does it verify the person sharing the details? Ownership tells you whose account it is. Identity checks tell you the request came from them.

3. What happens when bank login doesn't work? Look for a fallback such as micro-deposits, so no vendor is left unverified.

4. How do vendors share their details? A secure link or portal beats email and PDFs, because nothing can be edited in transit.

5. Does it keep a record you can't change? Auditors and insurers will ask who verified what, and when.

6. Does it work without a login for the vendor? Vendors finish requests faster when they don't have to create an account.

7. Does it fit your process? A tool for AP teams, an API for platforms, and ideally both.

8. How is it priced? Per verification, per vendor or a flat subscription. Compare it to the cost of one diverted payment.

Be wary of any provider that can't tell you exactly which of the five checks in the table above it performs.

How does verification fit into vendor onboarding and bank detail changes?

Verify at the two moments when bank details enter your system: when a vendor is added, and when a vendor's details change.

• New vendors. Verify the account before it goes into your vendor master data, not after the first invoice arrives. It belongs inside your vendor onboarding process.

• Bank detail changes. Treat every change as a new account and verify it again. This is where payment diversion fraud happens. FinCEN warns that criminals use compromised or spoofed email to exploit existing vendor relationships and redirect payments (FinCEN Advisory FIN-2019-A005).

• Before large or first payments. If an account hasn't been paid before, confirm it's still verified.

The cost of skipping it is high. Business email compromise cost victims about $123,000 per reported complaint on average in 2025, based on the FBI's loss and complaint totals (FBI IC3 2025 Internet Crime Report). For how ownership checks work in detail, see what bank account ownership verification is.

How does Coffr verify bank accounts?

Coffr is a payment verification service built for AP and treasury teams. Instead of emailing a form or PDF, you send the vendor a secure link. They don't need to create an account. Through Coffr's secure channel, the vendor shares their bank details by bank login, or by micro-deposit. Coffr verifies the person sharing the details and confirms the account belongs to them before the details reach your team.

Each verification is recorded on an immutable blockchain ledger, so you have a record auditors can trust and any later change stands out.

See how Coffr can verify your vendors' bank accounts before you pay. Book a demo.

Sources

• AFP 2025 Payments Fraud and Control Survey, key highlights

• FBI IC3 2025 Internet Crime Report

• Nacha, Supplementing Fraud Detection Standards for WEB Debits

• Nacha, Micro-Entries

• FinCEN Advisory FIN-2019-A005