implement micro-deposit account verification correctly

Steps

1. Collect the user's bank routing number and account number, then initiate two small ACH credit micro-deposits (typically between $0.01 and $0.99 each) to the account; store the amounts against the user's account record.
2. Wait for the deposits to settle (typically 1–3 business days for standard ACH); notify the user via email or in-app prompt to check their bank statement.
3. Present a verification form where the user enters the two deposit amounts; compare against the stored amounts with a constant-time comparison to prevent timing attacks.
4. Implement attempt limiting — lock the verification after 3–5 failed attempts and require the user to restart with a new set of deposits to prevent brute-force guessing of the 2-cent range.
5. On successful verification, mark the bank account as verified in your database and withdraw the micro-deposit amounts via ACH debit or absorb them as a cost of verification.
6. Set an expiry window (e.g., 10 days) on pending verifications; if the user does not verify within the window, mark the bank account as expired and require re-enrollment.