I recently created a Brokerage account at ETRADE(https://us.etrade.com/). I transferred some money over from my bank, now they want me to login using my bank info on their website to verify my bank account. Is this normal practice and safe?

Edit: They gave me 2 choices to verify, login to my bank from their website or receive 2 random deposit amounts and verify those amounts.

additional information from a comment on an answer:

they wanted me to login after the transfer was complete to verify

  • 1
    When you say "at ETRADE", what exactly is the URL of the site you created the account at?
    – Vicky
    Sep 25, 2020 at 8:20
  • 2
    From a comment: "they wanted me to login after the transfer was complete to verify" Two questions: (a) Are they actually asking for your bank login details, not just asking you to login to their site and verify that the money has transferred? or (b) I've seen some companies make a small payment/charge to your bank account of a random value under £1. After this appears in your account, you login (to the company's site) and enter the exact value to confirm you control the account.
    – TripeHound
    Sep 25, 2020 at 10:01
  • 1
    check out this from a couple years ago ! security.stackexchange.com/a/187794/179171
    – Fattie
    Sep 25, 2020 at 11:09

2 Answers 2


from your question and from your comments:

they wanted me to login after the transfer was complete to verify


to verify my bank account. Is this normal practice and safe?

In my experience when you want to link accounts that are in two financial institutions the general procedure to verify that you actually have control over the accounts is to do a pair of "micro" transactions. The sending bank will transfer two small amounts of money, and then reverse the transactions. They then give you a business day or two to verify the amounts transferred. You tell them the amounts they transferred.

The banking system allows them to reverse the exact transactions if they initiate the reversal within a few days of the transfer. This procedure allows them to make sure that you can log into the other account and verify the amounts.

In the last few years my family has had to do this for a brokerage, a bank, a credit union, and an employer.

There isn't a requirement to check the transaction history via the sending institutions website. They don't care if you check via browser, phone, or asking the teller for a printout. They just want you to go onto the sending institutions website and enter the amount of each transaction.

  • Paypal did this with me, but without reversing the transactions. I could keep the ~7 cents.
    – Daniel
    Sep 25, 2020 at 10:49

Is this normal practice and safe?

In my experience in the USA, yes this practice is normal. However, be very careful when you do this.

As you said, the bank offers two options.

  1. Verification of small deposits (often called "manual" verification)
  2. Verification through bank login details (often labeled "instant" verification)

Both of these methods are "safe" if they are done by a legitimate, scrupulous, company.

Method 1 usually entails the company make one or two small deposits less than $1 in total. Once those deposits hit your account, you login to the company (in this case the brokerage) website and tell them the amount of the deposits. If the amounts match what was actually deposited, the bank account is verified for transfers. The brokerage will usually reverse the deposits within a week.

Method 2 usually uses some sort of third party API like Plaid. This API uses your login credentials for a one-time login to verify the account. Many legitimate companies/apps use this method such as Mint (owned by Intuit), YNAB, Cashapp, and others.

Method 1 requires that you give them your account and routing numbers. Method 2 requires that you provide your username and password for a one-time login. In either case, only provide this info to companies you know and trust 100%. There is a very real threat that a scammer could use either to steal your money. Although, Method 2 is arguably more invasive and could lead to much more money being taken directly from your bank account.

As a matter of security, I always use Method 1 when I can. Giving account numbers is much safer (read as: "not as bad") than giving my bank login details. The "instant" verification of Method 2 is not worth the extra exposure of my information. Note that many banks will not cover you for fraud if you give your login details out to anyone. Some banks do the opposite and knowingly participate and allow these third-party APIs to work with their accounts.

If a company only offers Method 2, and you are unsure about their legitimacy or security, do not give them your details. It is always safer to er on the side of "I'd rather keep my identity safe than have this account".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .