Implement micro-deposit account verification with correct retry and expiry logic

Steps

1. Initiate micro-deposits via your bank provider (Stripe, Dwolla, Plaid, or directly through your ODFI); two small ACH credits are sent to the target account, typically settling in one to two business days
2. Store the verification attempt state (pending, amounts_sent, verified, failed, expired) and the timestamp of deposit initiation; set an expiry of around seven to ten days depending on your provider's rules
3. When the consumer reports the two deposit amounts, compare them to the stored amounts using a constant-time comparison to prevent timing attacks; increment an attempt counter on each mismatch
4. Enforce a maximum attempt limit (typically three) before marking the verification as failed and requiring the consumer to restart; this prevents brute-force guessing of the amounts
5. If verification succeeds, transition the bank account to verified status and store the verification_id or confirmation for audit; proceed to originate transactions only after verified status is confirmed
6. Handle failed micro-deposits: if the deposits are returned (wrong account number, closed account), mark the bank account as invalid and prompt the consumer to re-enter their account details