Is this normal practice and safe?
In my experience in the USA, yes this practice is normal. However, be very careful when you do this.
As you said, the bank offers two options.
- Verification of small deposits (often called "manual" verification)
- Verification through bank login details (often labeled "instant" verification)
Both of these methods are "safe" if they are done by a legitimate, scrupulous, company.
Method 1 usually entails the company make one or two small deposits less than $1 in total. Once those deposits hit your account, you login to the company (in this case the brokerage) website and tell them the amount of the deposits. If the amounts match what was actually deposited, the bank account is verified for transfers. The brokerage will usually reverse the deposits within a week.
Method 2 usually uses some sort of third party API like Plaid. This API uses your login credentials for a one-time login to verify the account. Many legitimate companies/apps use this method such as Mint (owned by Intuit), YNAB, Cashapp, and others.
Method 1 requires that you give them your account and routing numbers. Method 2 requires that you provide your username and password for a one-time login. In either case, only provide this info to companies you know and trust 100%. There is a very real threat that a scammer could use either to steal your money. Although, Method 2 is arguably more invasive and could lead to much more money being taken directly from your bank account.
As a matter of security, I always use Method 1 when I can. Giving account numbers is much safer (read as: "not as bad") than giving my bank login details. The "instant" verification of Method 2 is not worth the extra exposure of my information. Note that many banks will not cover you for fraud if you give your login details out to anyone. Some banks do the opposite and knowingly participate and allow these third-party APIs to work with their accounts.
If a company only offers Method 2, and you are unsure about their legitimacy or security, do not give them your details. It is always safer to er on the side of "I'd rather keep my identity safe than have this account".