Bank Account Verification for WordPress

Bank account verification on a WordPress site means confirming that the account a user gives you is real, open and able to take ACH debits, and often that the user owns it. The quickest method is a bank login through a service like Plaid, which returns verified account details in one step; micro-deposits are the slower fallback. This guide explains the methods, what Nacha requires for online debits, and how ID checks differ from bank checks.

What does bank account verification mean?#

It means checking a bank account before you debit it or pay into it. There are two separate questions, and many sites only need the first:

Keep these apart when you plan a WordPress flow. A checkout needs validation. A payout or lending form may need ownership too. A regulated signup may need full ID checks.

When is account verification required?#

If you take online consumer ACH debits in the US, Nacha's rules require account validation. Nacha's WEB debit rule (opens in a new tab) took effect March 19, 2021. It says the originator's fraud detection system "must, at a minimum, validate the account to be debited."

Key points from the rule:

• It applies to the first use of an account number and to any later change.
• Accounts already used for WEB debits before the effective date did not need re-validation.
• Validation means confirming the account is "a legitimate, open account to which ACH entries may be posted at the RDFI."
• Ownership checks are not part of the minimum standard, though some businesses may need them.
• Accepted methods include prenotifications, micro-transactions, validation services and API based tools. A history of successful prior payments also counts.
• Nacha does not consider a fraud system without account validation sufficient.

This guide is general information, not legal or financial advice. Your bank or payment processor can tell you how these rules apply to your business.

What are the ways to verify a bank account?#

There are four common methods, and they trade speed for coverage.

Plaid's Auth docs (opens in a new tab) describe "micro-deposit-based verification and database verification" as extra methods you configure in the Account Verification Dashboard. Plaid's error docs also mention Instant Auth and Instant Match: if an Item does not support them, Plaid falls back to micro-deposits (Item errors (opens in a new tab)).

Stripe uses a similar split. Its ACH docs (opens in a new tab) say that if a customer enters an account by hand instead of using Financial Connections, Stripe verifies it with micro-deposits, and customers have 10 days to confirm.

How does Plaid Auth verify an account?#

Plaid Auth verifies the account by having the user sign in to their bank through Plaid Link, then returning the account details to your server. Per the Auth docs (opens in a new tab), Auth "allows you to request a user's checking, savings, or cash management account and routing number."

What Auth returns by country:

Two details matter for WordPress builders:

1. Tokenized account numbers. Plaid says only Chase, PNC and US Bank currently return a tokenized account number (TAN) instead of the real one. TANs work only for ACH and RTP, and each app gets its own. Expired or revoked TANs fail with an R04 return code.
2. No credit accounts. Auth does not support credit cards or other credit accounts.

If you use a Plaid payment partner, you do not need to call /auth/get at all. You create a processor token, or a Stripe bank account token, and send that to the partner. Plaid's partners page (opens in a new tab) says this frees you "from having to securely store sensitive bank account information."

How do you confirm the user owns the account?#

Use Plaid Identity, which returns the owner details the bank has on file, or Identity Match, which scores how well your user's details match them. The Identity docs (opens in a new tab) explain the two endpoints:

• /identity/get returns names, addresses, emails and phone numbers from the bank. The name is always present; other fields may be empty.
• /identity/match takes the name and contact details you collected and returns a match score for each field. Plaid recommends a threshold of 70 or higher per field.

Plaid lists these use cases: fraud reduction, onboarding, supporting KYC checks, and checking ownership before an ACH transfer. You can run Identity for every user or only for higher-risk ones.

On a WordPress site, the natural place for a match is right after Link: compare the WooCommerce billing name or the membership signup name against the bank's owner name.

How is Plaid Identity Verification different?#

Identity Verification checks the person, not the bank account. The Identity Verification docs (opens in a new tab) list these checks:

• Documentary Verification: the user photographs an ID document.
• Selfie Check: confirms a live person and can match the selfie to the document.
• Data Source Verification: checks name, address, date of birth, phone and ID number against records.
• SMS Verification: confirms the phone number with a one-time code.
• Risk Check: background anti-fraud checks, with a Trust Index Score for US sessions.

Plaid notes that Identity Verification is "mutually exclusive with other Plaid products in a Link session," that the checks are set in a Dashboard template, and that onSuccess "does not indicate that the user has passed." Your server must fetch the result with /identity_verification/get. Your company must be based in the US, Canada or the UK to integrate.

You can combine the two: Plaid's docs say pairing Identity with Identity Verification confirms the bank account's owner matches a verified identity.

How do you add bank verification to a WordPress site?#

Add a "Connect your bank" step where the user needs it, run the Plaid checks on your server, and save only the result and tokens. A typical flow:

1. Pick the moment. WooCommerce checkout, a MemberPress signup, a payout form, or an Elementor form.
2. Create a link_token on the server with auth, and identity if you need ownership.
3. Open Plaid Link in the browser so the user signs in to their bank.
4. Exchange the public_token on the server for an access_token.
5. Run checks. Get Auth data or a processor token, and run Identity Match against the name the user typed.
6. Record the outcome on the order or user profile: verified, failed or needs review.
7. Handle fallbacks. Offer micro-deposits if the bank cannot be linked.
8. Handle errors. For example, INCORRECT_DEPOSIT_VERIFICATION means a wrong micro-deposit code, and after three wrong entries Plaid returns TOO_MANY_VERIFICATION_ATTEMPTS and locks the Item (invalid input errors (opens in a new tab)).

What should you store in WordPress?#

Store as little as you can, and never store raw account numbers if a token will do. Plaid says the access_token should be stored in a persistent, secure manner, and it never belongs in the browser. Nacha's data security rule (opens in a new tab) requires larger originators (2 million or more ACH entries a year) to make stored account numbers unreadable through encryption, truncation, tokenization or similar means. It is a sensible habit at any size.

A minimal record:

Our data handling and security doc goes further.

What does verification cost?#

Plaid and Stripe bill verification differently. Plaid's billing docs (opens in a new tab) say Auth and Identity use a one-time fee per Item, while Identity Match is a flat fee per request. Identity Verification is billed for events such as document, selfie and data source checks. Plaid publishes no prices; your plan sets them, and Sandbox is free.

As listed on October 23, 2026, Stripe's pricing page (opens in a new tab) shows Financial Connections instant bank account verification at $1.50 per successful verification, and says "Micro-deposit verifications are free."

Where does BankBridge fit?#

BankBridge is a WordPress plugin that connects your site to Plaid, built to work with WordPress, WooCommerce, Elementor, MemberPress and more. If you want Plaid based account verification on WordPress, check the BankBridge docs for the Plaid products overview, Plaid Link setup and the WooCommerce or MemberPress guide that matches your site. You use your own Plaid account, and Plaid bills you directly. Each license includes a year of updates and support, with a 14-day refund window and secure checkout by Stripe.

Sources#

Checked October 23, 2026.

• Nacha: Supplementing Fraud Detection Standards for WEB Debits (opens in a new tab)
• Nacha: Supplementing Data Security Requirements (opens in a new tab)
• Plaid Docs: Auth (opens in a new tab)
• Plaid Docs: Auth payment partners (opens in a new tab)
• Plaid Docs: Identity (opens in a new tab)
• Plaid Docs: Identity Verification (opens in a new tab)
• Plaid Docs: Item errors (opens in a new tab)
• Plaid Docs: Invalid input errors (opens in a new tab)
• Plaid Docs: Billing (opens in a new tab)
• Stripe Docs: ACH Direct Debit (opens in a new tab)
• Stripe pricing (opens in a new tab)

Plaid is a trademark of Plaid Inc. BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid.