Bank account linking connects a customer's bank account directly to a business's app or payment flow. It replaces manual entry of account and routing numbers with a short authentication step that pulls verified data straight from the bank. A customer picks their bank, logs in through a secure interface, and the business receives account details it can trust instead of a string of digits typed in. More than 100 million US customers have used customer-authorized data access to share their financial account information with third parties.

Below, we’ll discuss how the linking process works step by step, the different authentication methods banks support, and what happens to sensitive data during and after a connection.

Key takeaways

• Bank account linking replaces manually entered account and routing numbers with verified data pulled directly from a customer's bank.

• OAuth-based authentication keeps banking passwords away from both the linking provider and the business, while credential-based flows and microdeposits serve as alternatives when OAuth isn't available.

• Tokenized account references and permissioned data access limit what's shared and stored, although they don't eliminate fraud risks that exist outside the linking flow itself.

What is bank account linking?

Bank account linking connects a customer's bank account directly to a business's app or payment flow so nobody has to type in a routing number and account number by hand. The customer picks their bank, they log in through a secure interface, and the business gets verified account data instead of a self-reported string of digits.

How does the bank account linking process work?

Linking a bank account follows the same basic sequence no matter which provider handles it. A business activates a link request, usually through a hosted interface embedded right in its app or checkout page, and the customer follows a few short steps before their account data is verified.

Here's a step-by-step guide:

• Bank selection: The customer searches for and picks their bank from a list that typically covers major national banks and smaller regional credit unions.

• Authentication: The customer logs in with their real banking credentials, but they do so inside a secure interface hosted by the linking provider or the bank itself, never on the business's own servers.

• Consent and account selection: Once they're authenticated, the customer sees which accounts are available and chooses which ones to connect. This step matters for anyone with multiple accounts at the same bank who wants to share only one.

• Data return: After the customer confirms, the provider sends a token that represents the connection along with the account data the business asked for, such as account and routing numbers, real-time balance, or recent transaction history.

What are the authentication methods in bank linking?

Not every bank offers the same connection method. The three main approaches trade off speed, security, and how much a customer has to do to get connected.

• OAuth-based authentication: The customer logs in directly on their bank's own page or app. The linking provider never sees the password since the bank issues a token back instead. Large banks typically support OAuth-based authentication and it's the version providers often try to route customers through first. OAuth is the fastest, but it works only where the bank has built the support for it.

• Credential-based authentication: The customer types their bank username and password into a form managed by the linking provider, which then uses those credentials to pull data from the bank on the customer's behalf. It still covers banks that haven't built OAuth support, but it means the provider is handling login credentials directly, even without storing them in the long term. Credential-based flows work almost everywhere, but the cost is that the customer has to share an actual login. And the provider has to be trusted with it, even briefly.

• Microdeposit verification: The business makes one or two small deposits, usually under a dollar, into the target account and the customer confirms the exact amounts a day or two later. Microdeposit verification doesn't provide any live balance or transaction data, but it works for almost any account with a routing number, including those at banks with no digital connectivity at all. Microdeposits are the slowest method—they sometimes take a couple of days to confirm—but they're also the one method that works regardless of how modern or old a bank's systems are.

What are the security considerations for businesses using bank linking?

The core security question in bank linking is how much sensitive data moves and to whom. The answer comes down to three mechanisms: how banking passwords are protected, how account numbers are replaced with something less useful to steal, and how much a customer agrees to share.

Here are the parts of the security profile.

Credentials never leave the bank

With OAuth-based connections, a customer's banking password never reaches the linking provider or the business at all. The bank authenticates the customer on its own systems and hands back a token. Anyone who integrates this kind of linking never touches login credentials directly, no matter how the data is used afterward.

Account numbers get tokenized

Instead of storing raw account and routing numbers, providers return a token that stands in for the connection. The business's systems reference that token for future transfers rather than the numbers themselves. If a token is compromised, it generally can't be used outside the specific integration it was issued for.

Access stays scoped to what’s approved

A customer who's connecting their bank for a single payment isn't automatically agreeing to hand over a year of transaction history. Providers limit each connection to whatever the business requested and the customer approved during that consent step, and businesses that are evaluating an integration should determine exactly what their use case needs rather than request more than that.

These mechanisms don't make any payment method immune to fraud. Account takeover fraud, synthetic identity fraud, and social engineering aimed directly at the customer all sit outside the linking flow itself, regardless of how the connection is built. What permissioned, tokenized access does is reduce the number of places where raw credentials and account numbers exist, which shrinks possible exposure if any single system in that chain is breached.

What are common business use cases for account linking?

The specific data a business pulls from account linking depends on what the account information will be used for.

Here's where a linked bank account is useful:

• Direct debit and pay by bank transfers: Businesses use linking to collect verified account and routing numbers for direct debits and other bank transfers. This is common for subscription billing, invoice payments, and bill pay products.

• Balance and funds checks: Some businesses check real-time balance data right before they initiate a transfer to lower the odds of an insufficient-funds return. This matters most for larger one-time payments.

• Lending and underwriting: Lenders pull transaction history and income data through linking instead of asking applicants to upload PDF bank statements. This speeds up underwriting and minimizes document fraud.

• Personal finance and budgeting tools: Apps aggregate spending by pulling transaction categories and balances from every bank a customer uses.

The thread that connects all four is that the business needs verified, structured account data rather than a number someone typed in or a static document they uploaded.

Which tools help power bank linking?

Building bank linking from scratch means negotiating data sharing agreements with individual banks, maintaining those connections as banks change their own authentication systems, and building the interface customers use to connect an account in the first place. Many businesses lean on a third-party provider instead of taking on those responsibilities directly.

Stripe's version of this is Financial Connections, which gives businesses a hosted user interface and application programming interface (API) for linking customer bank accounts without individually negotiating bank relationships. It allows businesses to instantly verify bank accounts and retrieve permissioned data from 5,000 financial institutions, covering over 97% of US bank accounts.

Because Financial Connections sits inside the Stripe suite, a business that already uses Stripe for payments can link bank accounts within an existing checkout or billing flow without creating a separate integration just for that piece.

How Stripe Financial Connections can help

Stripe Financial Connections is a set of APIs that allows you to securely connect to your customers' bank accounts and retrieve their financial data, enabling you to build innovative financial products and services.

Financial Connections can help you:

• Simplify onboarding: Offer a seamless, instant bank account verification process that does not require manual identity and account verification.

• Access rich financial data: Retrieve comprehensive information about your customers' bank accounts, including balances, transactions, and account details.

• Automate recurring payments: Enable your customers to securely link their bank accounts for recurring payments, improving payment success rates.

• Enhance risk management: Analyze customers' financial data to make more informed decisions about credit, lending, and other financial products.

• Comply with regulations: Financial Connections helps you meet Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements.

• Innovate with confidence: Build new financial products and services on top of the secure, reliable Financial Connections infrastructure.

Learn more about Financial Connections, or get started today.