Verify Bank Account Numbers: ABA Routing, ACH

Wire fraud and business email compromise (BEC) cost US organizations $2.9 billion in 2023 — making BEC the costliest category of cybercrime reported to the FBI's Internet Crime Complaint Center (IC3). A significant share of those losses stemmed from payments sent to bank accounts where the account holder did not match the intended recipient. Verifying bank account details before executing a payment is no longer optional. It is a core component of fraud prevention, supplier onboarding, and regulatory compliance across financial services, procurement, and accounts payable functions.

To validate a US bank account, verify the ABA routing number (9 digits) using the check digit algorithm, confirm the account number format, and perform account ownership verification through micro-deposit validation, Plaid or MX instant verification, or ACH prenote. Format validation alone catches transcription errors but does not confirm the account exists or belongs to the expected party — full verification requires account ownership confirmation through one of these methods.

This guide covers the structure of US bank account identifiers, the verification methods available, the regulatory requirements under FinCEN and Nacha rules, and the practical steps to automate bank account validation in your workflows.

This article is provided for informational purposes and does not constitute legal advice. Consult a qualified professional for situation-specific guidance.

US Bank Account Identifiers: Routing Number and Account Number

The United States uses a dual-identifier system for domestic payments. The ABA routing number (9 digits) identifies the financial institution, while the account number (typically 8 to 17 digits, varying by bank) identifies the individual account. Together, they route payments through the ACH (Automated Clearing House) network, Fedwire, and CHIPS (Clearing House Interbank Payments System).

Unlike most countries, the US does not use the IBAN (International Bank Account Number) system for domestic transactions. IBANs are used in over 80 countries — primarily in Europe, the Middle East, and parts of Africa and the Caribbean — but US banks do not issue IBANs. For international wire transfers involving US accounts, the sender uses the bank's SWIFT/BIC code along with the ABA routing number and account number.

ABA Routing Number Structure

The ABA routing number was introduced in 1910 by the American Bankers Association. It follows a defined 9-digit structure:

Routing Number vs. Account Number vs. SWIFT Code

The ABA Check Digit Algorithm

The ABA routing number check digit at position 9 is calculated using a weighted sum algorithm. This validation detects transcription errors and invalid routing numbers.

The validation process applies multipliers of 3, 7, and 1 to alternating digit positions. Specifically: multiply position 1 by 3, position 2 by 7, position 3 by 1, position 4 by 3, position 5 by 7, position 6 by 1, position 7 by 3, position 8 by 7. Sum the products and add position 9 (the check digit). If the total is divisible by 10, the routing number is valid.

(3×d1 + 7×d2 + 1×d3 + 3×d4 + 7×d5 + 1×d6 + 3×d7 + 7×d8 + d9) mod 10 = 0

This verification catches data entry mistakes but provides no assurance about whether the account exists, is active, or belongs to the expected party. The Federal Reserve maintains the official E-Payments Routing Directory, which can be used to confirm that a routing number is active and associated with a specific financial institution.

CheckFile's automated document verification platform extracts routing numbers, account numbers, and bank details from invoices, bank statements, and supplier documents, then validates them against format rules and bank registries in an average of 4.2 seconds (CheckFile platform data, March 2026). Across 2.4 million documents verified, the platform achieves a 98.7% OCR accuracy rate and a 94.3% field extraction rate, reducing manual bank detail verification time by 83%.

Account Verification Methods in the US

Unlike the UK's Confirmation of Payee system, the US does not have a single, centralized, mandatory name-matching service for bank account verification. Instead, several methods exist, each with different levels of assurance.

Micro-Deposit Verification

The traditional method for verifying bank account ownership. The verifying party sends two small deposits (typically $0.01 to $0.99) to the account via ACH, and the account holder confirms the exact amounts. This proves the account exists, is active, and the holder can access it.

Limitations: Takes 1-3 business days for the deposits to settle. Creates friction in the onboarding process. Does not directly confirm the name on the account.

Instant Account Verification (Plaid, MX, Finicity)

Third-party services like Plaid, MX, and Finicity connect directly to the user's bank via APIs or credential-based access to verify account ownership, balance, and identity in real time. This method provides:

• Account existence confirmation
• Name matching against bank records
• Balance verification
• Account status (active, closed, frozen)

Limitations: Requires the account holder to authenticate through the third-party service. Not all banks and credit unions are supported. Privacy concerns around credential sharing, though most providers now use tokenized access.

ACH Prenote (Prenotification)

A zero-dollar ACH transaction sent to the receiving bank to verify that the routing and account numbers are valid and capable of receiving an ACH credit or debit. The receiving bank has 3 business days to respond with a return or notification of change.

Limitations: Only confirms the routing and account number are valid — does not verify account ownership or name matching. Processing takes 3-4 business days.

Bank Verification Letters and Voided Checks

Some businesses still rely on physical documentation: a voided check showing the account holder's name, routing number, and account number, or a bank verification letter on the institution's letterhead. These methods provide documentary evidence but are susceptible to forgery and are difficult to scale.

Wire Fraud, BEC, and the Regulatory Landscape

The Scale of Payment Fraud in the US

The FBI IC3 2023 Annual Report documented $12.5 billion in total cybercrime losses, with business email compromise at $2.9 billion representing the single largest category. Wire fraud — the broader category under 18 U.S.C. § 1343 — carries criminal penalties of up to 20 years of imprisonment per count, and up to 30 years when the fraud affects a financial institution.

Payment fraud targeting accounts payable departments follows a consistent pattern: a fraudster compromises or impersonates a supplier's email, sends updated banking details attached to a legitimate-looking invoice, and the paying company routes the next payment to the fraudster's account. The FBI's Recovery Asset Team (RAT) has a 73% success rate in freezing fraudulent wire transfers, but only when reported within 48 hours.

BSA/AML Requirements for Bank Account Verification

FinCEN requires financial institutions to verify customer identity under the Customer Identification Program (CIP) rule, 31 CFR 1020.220. For business accounts, the Customer Due Diligence (CDD) rule, 31 CFR 1010.230, requires identification and verification of beneficial owners who own 25% or more of the entity. The Corporate Transparency Act (CTA) created a national beneficial ownership registry at FinCEN, providing an additional verification resource.

For non-bank businesses, while the BSA does not directly mandate bank account verification for suppliers, the Federal Acquisition Regulation (FAR) requires vendor verification for government contractors, and internal controls best practices — as outlined in the COSO Internal Control Framework — call for independent verification of banking details before initiating payments.

Nacha Operating Rules for ACH

Nacha — the governing body for the ACH network — has progressively strengthened account validation requirements:

• WEB debit validation (effective 2022): Originators of WEB debit entries must use a commercially reasonable method to validate the account number of the receiver before the first transaction.
• Micro-entry rules (effective 2022): Micro-deposits used for account validation must not exceed $0.99 per deposit, the total of the credits must equal the total of the debits, and the funds must be settled within 2 business days of the verification.
• Fraud monitoring (effective 2024): ACH originators must implement fraud detection systems for all ACH transactions, including monitoring for unusual patterns in account validation activities.

Bank Account Verification Methods Compared

Common Bank Account Fraud Patterns

Bank account fraud takes several forms, each exploiting different gaps in verification processes.

Invoice Redirection Fraud (BEC)

A fraudster intercepts or impersonates a legitimate supplier and sends updated bank details, typically attached to a genuine-looking invoice. The paying company updates its records and sends the next payment to the fraudster's account. This is the most common form of payment fraud targeting businesses. The FBI reports that BEC losses have exceeded $50 billion globally since 2013, with the average loss per incident at $120,000 for US businesses.

Account Takeover

The fraudster gains access to a legitimate business email account and sends payment instructions from a trusted address. Because the email is authentic, the request bypasses social engineering defenses. Multi-factor authentication, email security protocols (DMARC, DKIM, SPF), and out-of-band verification of banking changes are the primary countermeasures.

Synthetic Identity and Mule Accounts

Fraudsters create synthetic identities by combining real and fabricated personal information (often using a real SSN with a fake name) to open bank accounts. These accounts pass standard identity verification because the SSN validates against Social Security Administration records. The FinCEN Advisory on Synthetic Identity Fraud estimates that synthetic identity fraud costs US financial institutions over $6 billion annually.

Practical Verification Workflow

An effective bank account verification process operates at three levels, each adding assurance.

Level 1: Format Validation

Validate the ABA routing number using the check digit algorithm. Confirm the routing number against the Federal Reserve's E-Payments Routing Directory to verify it is active and associated with a specific financial institution. Validate the account number length is within the expected range for the identified bank. This level catches data entry errors and obviously invalid account details.

Level 2: Account Existence Check

Use ACH prenote, micro-deposit verification, or instant verification services (Plaid, MX, Finicity) to confirm the account exists, is active, and can receive payments. For high-value transactions or new supplier onboarding, instant verification provides the fastest and most comprehensive result.

Level 3: Name Matching and Identity Verification

Verify that the account holder's name matches the expected payee through instant verification services, bank verification letters, or direct confirmation with the financial institution. For corporate accounts, cross-reference with state Secretary of State business registries and FinCEN's beneficial ownership database. Supplement with identity verification and KYC checks for higher-risk relationships.

Automating Bank Account Verification

Manual verification of bank details does not scale. A procurement team processing hundreds of supplier invoices monthly cannot realistically call each supplier's bank to confirm account ownership. Automation addresses this gap by integrating bank account validation directly into accounts payable and onboarding workflows.

Automated document validation systems extract routing numbers, account numbers, and bank details from invoices, contracts, and supplier registration forms. The extracted data is validated against format rules, checked against the Federal Reserve routing directory, and matched against the declared beneficiary name. Any change in bank details for an existing supplier triggers an alert and a secondary confirmation workflow — the single most important control for preventing BEC-driven payment fraud.

This automated approach eliminates the delay between receiving bank details and verifying them. It also creates a complete audit trail of every verification performed, supporting compliance with internal controls, Nacha operating rules, and regulatory expectations from FinCEN and federal/state examiners.

The integration with broader customer due diligence processes ensures that bank account verification is not treated as an isolated check but as part of a comprehensive onboarding and monitoring program.

For a comprehensive overview, see our industry document verification guide. Our platform processes over 180,000 documents per month with a 94.8% fraud detection rate and a false positive rate of 2.8%, delivering results in an average of 4.2 seconds.

Take action

CheckFile verifies 180,000 documents per month with 98.7% OCR accuracy. Test the platform with your own documents — results within 48h.

Request a free pilot

---

Frequently Asked Questions

Does passing the ABA routing number check digit validation mean the account is legitimate?

No. The check digit algorithm verifies the mathematical consistency of the routing number structure. It confirms the check digit is correct for the given sequence, but it does not confirm the account exists, is active, or belongs to the expected party. A fraudster can provide a valid routing number paired with an account number they control. Full verification requires account existence confirmation and name matching through micro-deposits, instant verification services, or ACH prenote.

Why doesn't the US use IBANs?

The IBAN system was developed by the European Committee for Banking Standards (ECBS) and adopted primarily by European countries, with expansion to the Middle East, Caribbean, and parts of Africa. The US already had a well-established domestic payment infrastructure based on ABA routing numbers (since 1910), the ACH network (since 1974), and Fedwire. The cost and complexity of migrating the entire US banking system to IBAN — involving over 10,000 financial institutions — has not been justified given the existing infrastructure. For international transfers, US banks use SWIFT/BIC codes alongside routing and account numbers.

What should a business do when a supplier requests a change of bank details?

Never update bank details based solely on an email or letter. Contact the supplier using a previously verified phone number — not a number provided in the change request. Verify the new bank details through instant verification (Plaid/MX), micro-deposit confirmation, or a voided check from the supplier's bank. Require dual authorization for any bank detail change in your accounts payable system. Document the verification in your audit trail. The FBI IC3 recommends establishing a callback verification procedure as a standard control for all banking detail changes.

How do instant bank verification services like Plaid work?

Instant bank verification services connect to the user's bank account through secure API integrations or open banking protocols. The user authenticates with their bank through the service's interface, and the service retrieves account details including the account holder's name, account number, routing number, account status, and balance. The service returns a verification result to the requesting business without exposing the user's banking credentials. Response times are typically under 5 seconds. These services can be integrated into ERP systems, payment platforms, and onboarding workflows via API.

What is the difference between ABA routing number validation and full bank account verification?

ABA routing number validation checks the format and check digit of the 9-digit routing number and confirms it is listed in the Federal Reserve's E-Payments Routing Directory. Full bank account verification goes further by confirming the account exists, is active, can receive payments, and belongs to the declared party. Validation catches typos and invalid routing numbers; verification catches fraud, misdirected payments, and account ownership mismatches. Both are necessary for a secure payment process. For organizations subject to BSA/AML requirements or handling high-value transactions, full verification is an essential control.