Bank Aggregator Links You Didn’t Add: Micro‑Deposits and “Read‑Only” Access Clues

If you’re spotting tiny deposits you didn’t expect or you notice an unfamiliar “read-only” connection to your bank, you might be looking at an aggregator link you didn’t add. Financial aggregators connect accounts to deliver features like budgeting, payment initiation, or credit verification. When abused, they can quietly pull balances and transactions or set up future withdrawals. This guide explains what micro-deposits mean, how “read‑only” works in the real world, how to tell a legitimate link from a risky one, and the steps to shut down unauthorized access.

What Are Bank Aggregators and Why Do They Matter?

Bank aggregators are services that connect your financial accounts to apps you choose—budget trackers, payment apps, lender portals, or tax tools. They typically connect using one of two methods:

• Credentials-based aggregation: You enter your bank login through a third-party flow; the aggregator retrieves data via APIs or secure screens, sometimes storing tokens to maintain ongoing access.
• Open banking/secure API: Your bank issues a permissioned token after you consent, often with scopes like “balances” or “transactions.” Tokens can last from hours to months.

Legitimate aggregation is common, but the same mechanisms can be misused if someone links your bank without consent. Because these connections can be labeled “read‑only,” they often go unnoticed—until charges, new loans, or identity fraud appear.

Micro‑Deposits: The Small Clue That Signals a New Link

Micro‑deposits are small ACH credits—often two amounts under a dollar—sent to your account to verify ownership. They’re a standard step when linking a bank to a new service. If you didn’t start a setup, these tiny credits are a red flag that someone else attempted to connect your account.

Where You’ll See Them

• In recent transactions as ACH credits from company names you don’t recognize.
• Sometimes paired with a small debit reversal after verification succeeds.
• Descriptions may include the app or platform name, a payment processor, or a cryptic short code.

Why They Matter

• They confirm the attacker (or an automated fraud script) has enough of your information to attempt a link—often your routing and account number and sometimes your email or phone.
• If the verification completes, the new service may gain ongoing data access or the ability to pull funds.

“Read‑Only” Access: What It Really Means

“Read‑only” is often presented as safe because it can’t move money. But it can still expose sensitive details:

• Balance and cash-flow history: Useful for assessing lending risk—or for attackers to time social engineering or account takeovers.
• Transaction metadata: Merchant names, locations, and recurring payments can reveal where you bank, shop, and get paid.
• Identity breadcrumbs: Names, partial account numbers, and connected institutions may help complete identity profiles.

Some apps start as “read‑only” and later request payment permissions. Fraudsters may link “read‑only” first to test access, then escalate to debits through a different channel.

Common Signs You’ve Been Linked by an Aggregator You Didn’t Approve

• Two small unexpected ACH credits (micro‑deposits) from an unfamiliar name.
• Bank alerts about “a new connection,” “data sharing,” or “Open Banking consent” that you don’t recognize.
• A new “Linked apps,” “Security & privacy,” or “Third‑party access” entry in your bank portal you didn’t add.
• Emails or texts asking you to “confirm the amounts” for an app you don’t use.
• Small test debits or an initial reversal shortly after micro‑deposits.

How to Verify If a Link Is Legitimate

1. Check your bank’s third‑party access hub. In your online banking, look for sections named “Connected Apps,” “Security & Privacy,” “Manage Sharing,” or “Open Banking.” Review every connection, its permissions, and the date granted.
2. Match the descriptor. Compare the ACH company name from the micro‑deposits to your known services. If you can’t map it to a service you started this week, treat it as suspicious.
3. Search the descriptor string. Many processors (e.g., “Stripe,” “Plaid,” or regional ACH providers) appear in descriptors; a quick search can reveal which app uses them—still not proof you authorized it.
4. Review recent emails/SMS. Look for “verify your bank” prompts or one‑time codes. An unexpected message can indicate someone initiated the flow using your details.
5. Call your bank using the number on the back of your card. Ask if any new third‑party consents, external transfers, or ACH authorizations were set up.

Immediate Steps to Cut Off Unauthorized Access

1. Revoke the connection in your bank portal. Remove any unfamiliar app or token in “Connected Apps” or similar. This immediately severs data access for API‑based links.
2. Disable ACH debits from the unknown originator. Ask your bank to block future ACH debits from the company ID shown in the descriptor. Many banks can place an ACH “debit block” or “filter.”
3. Reset critical credentials. Change your online banking password, rotate security questions, and log out all sessions. If your bank offers it, rotate your customer ID/username.
4. Enable stronger authentication. Turn on app‑based multi‑factor authentication (or hardware key if supported). Avoid SMS-only when possible.
5. Audit all accounts. Check savings, checking, and business accounts for the same micro‑deposits. Fraudsters often test multiple accounts at once.
6. Document everything. Screenshot transactions and connection pages. Note dates, amounts, and descriptors for any dispute or police report.

What If You Recognize the Company But Didn’t Start a New Link?

Sometimes the descriptor belongs to a legitimate company you’ve used before (a tax prep app, payment service, or lender). Possible explanations:

• Re‑link trigger: An app update or expired token can trigger a re‑verification you didn’t complete. If you didn’t open the app recently, treat it as suspicious.
• Duplicate profile: Someone created an account with your email or phone at the same service, prompting new verification attempts.
• Recycled phone number or email alias confusion: A previous owner’s app settings can accidentally point at your information if you inherited a number.

Action: Contact the company’s support, provide the last four digits of your account and the descriptor, and request they remove any bank links associated with your email/phone and place a note blocking future links without direct, verified consent.

Preventive Settings That Reduce Aggregator Risk

• Use your bank’s data‑sharing controls. Some banks let you opt out of broad data sharing or limit scopes (balance only, no transactions). Choose the minimum necessary.
• Segment accounts. Keep a low‑balance “spending” account for third‑party links and a separate, unlinked savings account. This limits exposure if a token is misused.
• Create virtual account/routing numbers if offered. Certain institutions provide disposable details for connect‑once scenarios.
• Aliases for email and phone. Use masked email addresses and virtual numbers for app signups to track which app leaked or reused your info.
• Regular access reviews. Calendar a monthly check of “Connected Apps” in each bank and card portal.

Disputes, Reversals, and Reporting

• ACH unauthorized debits: Under NACHA rules and federal protections, you typically have up to 60 days to dispute unauthorized consumer ACH debits. File promptly with your bank.
• Micro‑deposits only: Even if no money was taken, report the event. Ask your bank to block the originator ID and monitor for follow‑up attempts.
• Identity theft indicators: If you see new credit inquiries, loans, or accounts you didn’t open, place a fraud alert or credit freeze and file an FTC identity theft report.

How “Read‑Only” Data Gets Misused

• Targeted social engineering: Knowing your payday and billers helps attackers time phishing with convincing detail.
• Loan and credit abuse: Fraudsters use read‑only cash‑flow data to pass affordability checks under your identity.
• Recon for account takeover: Merchant names and amounts can help craft password reset questions or impersonation scripts with your bank.

When to Involve Monitoring and Extra Protections

If an unknown aggregator linked to your bank, treat it as a broader identity signal. Monitor for new financial accounts, credit pulls, or address changes that could follow. A practical way to keep watch is to use a consolidated credit and identity monitoring tool that alerts you to changes in your credit reports, new account openings, or unusual activity. For an option that focuses on privacy, credit monitoring, and identity protection in one place, see our SmartCredit overview.

Step‑by‑Step Checklist

1. Identify the micro‑deposit descriptors and amounts; take screenshots.
2. Review and revoke unknown “Connected Apps” in your bank settings.
3. Ask your bank to block ACH debits from the originator ID.
4. Reset passwords, enable strong MFA, and sign out of all sessions.
5. Scan other accounts for similar activity; repeat the review.
6. Contact any identified platform or processor and demand removal of unauthorized links.
7. Set calendar reminders to review data‑sharing monthly.
8. Watch for related credit or identity activity and take action quickly if detected.

Frequently Asked Questions

Are micro‑deposits always suspicious?

No. If you just linked an account for payroll, a payment app, or a budgeting tool, micro‑deposits are normal. They’re suspicious when you didn’t start a new connection.

Does “read‑only” mean no risk?

Not exactly. Read‑only access can’t move money directly, but it can expose data that enables targeted fraud or future debit setups elsewhere.

Can I stop all third‑party access?

Many banks let you disable data sharing or approve connections per app. You can also keep sensitive funds in an unlinked account and only connect a low‑risk spending account to apps you truly need.

What if the micro‑deposits are already gone?

They may be reversed after verification. Your bank’s secure messages, alerts, and connected app list still show whether a link was created. Ask support to check recent consents.

What descriptors should I look for?

Look for small ACH credits with short codes or names of payment processors, verification services, or the app itself. The pattern is often two small credits within 24–72 hours.

Conclusion

Tiny, unexpected micro‑deposits and surprise “read‑only” connections are not harmless quirks—they’re early indicators that someone attempted to link your bank through an aggregator. Move quickly: revoke access in your bank portal, block debits from the originator, strengthen authentication, and document the event. Follow up with regular access reviews, segment which accounts you link to apps, and monitor your financial identity for related activity. Early detection and decisive steps can turn a subtle clue into a blocked attack instead of a costly mess later.