Initiate micro-deposits via your bank provider (Stripe, Dwolla, Plaid, or directly through your ODFI); two small ACH credits are sent to the target account, typically settling in one to two business days
Store the verification attempt state (pending, amounts_sent, verified, failed, expired) and the timestamp of deposit initiation; set an expiry of around seven to ten days depending on your provider's rules
When the consumer reports the two deposit amounts, compare them to the stored amounts using a constant-time comparison to prevent timing attacks; increment an attempt counter on each mismatch
Enforce a maximum attempt limit (typically three) before marking the verification as failed and requiring the consumer to restart; this prevents brute-force guessing of the amounts
If verification succeeds, transition the bank account to verified status and store the verification_id or confirmation for audit; proceed to originate transactions only after verified status is confirmed
Handle failed micro-deposits: if the deposits are returned (wrong account number, closed account), mark the bank account as invalid and prompt the consumer to re-enter their account details
Known gotchas
Micro-deposit amounts should be chosen randomly within a small range (e.g., 1–99 cents) but not in a predictable pattern; some implementations inadvertently use sequential amounts that a sophisticated attacker could guess
ACH micro-deposits can take one to two business days to settle — consumer friction is high; offer instant verification via Plaid Auth or bank login as a faster alternative and fall back to micro-deposits only when needed
Some banks reject micro-deposits to savings accounts that have a limit on the number of ACH transactions per month (Reg D legacy limit, now abolished federally but still enforced by some institutions); warn consumers to check with their bank if deposits do not arrive
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp