Complete KYC only inside the brokerage’s genuine U.S. website or official app, then connect a bank account from the authenticated funding screen. A U.S. broker-dealer generally must collect your name, date of birth, address and taxpayer identification number, and may request identity documents. Bank linking authorizes ACH transfers, but deposits shown as available may still be provisional. Use strong account security, verify every transfer alert and treat any request for an MFA code, gift card, cryptocurrency or payment to a stranger as fraud.
What KYC and bank linking mean
KYC (“know your customer”) is the identity-verification part of opening and maintaining an investment account. U.S. broker-dealers follow Customer Identification Program rules. At minimum, the firm ordinarily collects your legal name, date of birth, residential or business address and taxpayer identification number, which may be your Social Security number or another tax ID. Risk-based procedures can require a driver’s license, passport, selfie, proof of address or other records.
As an Amazon Associate I earn from qualifying purchases.
Bank linking is separate. It gives the brokerage permission to send and receive ACH transfers through an account you control. It does not make the bank account part of the brokerage account, and it does not guarantee that a deposit is final or immediately withdrawable. The broker may place limits or holds while ownership, fraud and settlement checks are completed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare before opening the verification flow
Preparation reduces failed checks and prevents you from improvising when a suspicious message arrives. Have the following ready:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Your legal name exactly as it appears on your government ID and bank account.
- Date of birth, current residential address and taxpayer identification number.
- A current driver’s license, passport or other document the brokerage lists as acceptable.
- A phone or computer with current operating-system and browser updates.
- Access to the bank account you intend to link, including its routing and account numbers if manual entry is required.
- A private location for photographing documents or completing a selfie check.
Do not begin from an unsolicited email, text message, social-media post or phone call. Type the brokerage’s U.S. web address yourself or open the official app you installed from the device’s legitimate app store. Check the spelling of the domain, the browser’s HTTPS indicator and the app publisher before entering personal information.
Complete KYC step by step
- Open the official application. Navigate to the brokerage’s account-opening or verification page from the address you entered yourself. If a caller or message supplied a link, close it and start again independently.
- Enter identity details exactly. Use your full legal name, date of birth, physical address and taxpayer ID. A mailing address, business address or recently changed name can trigger a mismatch if it does not match the firm’s requirements or records.
- Read the identity-verification notice. Firms should tell you that the information is being requested to verify your identity. Review what will be collected, how documents are uploaded and whether a third-party verification service is involved.
- Upload documents only in the authenticated flow. Take clear, well-lit images showing all corners and text. Do not email scans to a person who contacted you unexpectedly, send them through a chat app or upload them to an unfamiliar site.
- Complete a selfie or live check only when requested in the same secure session. Follow the on-screen instructions and remove glare, hats or other obstructions if the service requires a clear face image.
- Review before submitting. Check every digit in your taxpayer ID, address and document number. An incorrect entry can create a delay that looks like a security problem.
- Save the confirmation. Record the date, case number or status shown by the official app. Do not save identity documents in an unencrypted public folder or forward the confirmation to an unknown contact.
If verification fails
A failed check does not automatically mean your identity has been stolen. Common causes include a name or address mismatch, an unreadable image, an expired document, a frozen credit or identity file, or a request for additional compliance review. Use the brokerage’s published support channel inside its website or on an account statement. Explain the exact error and ask what document or correction is required. Never pay a “verification release” or “recovery” fee to an intermediary.
Why a brokerage asks for your Social Security number
Your Social Security number is a taxpayer identification number used to identify the account holder, satisfy Customer Identification Program obligations and support tax reporting. It also helps a firm distinguish you from another person with a similar name. A legitimate broker should explain that the information is being requested for identity verification and account compliance.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Entering an SSN into the brokerage’s authenticated application is materially different from reading it to an unsolicited caller. Before submitting it, confirm the domain or official app, use a private network you trust, and check that the session is encrypted. If a person who contacted you asks for the SSN by phone, text or email, end the interaction and contact the firm through its independently obtained support number.
Link your bank account without handing credentials to a scammer
- Open Funding, Transfers or a similarly named menu inside the signed-in brokerage account. Labels vary by firm; do not use a funding link supplied in a message.
- Select the bank-linking method. The brokerage may offer an instant-verification provider or manual micro-deposits. Review the institutions supported and any transfer limits displayed on that screen.
- Confirm ownership. Link an account held in your name, or in the ownership arrangement the broker permits. Compare the bank’s routing and account numbers with your own records before authorizing an ACH relationship.
- Review the authorization language. It should identify the brokerage, the account to be debited or credited and the ACH purpose. Stop if the screen asks for a wire to a person, gift card, cryptocurrency or an unrelated payment.
- Finish verification in the same secure flow. If instant verification redirects you, check that the new page is the provider the brokerage identified and that you reached it from the signed-in session. Never reuse your brokerage password on another site.
- Check the linked-account list afterward. Confirm the last four digits, bank name and status. Remove an account you do not recognize and contact the brokerage immediately.
Instant verification
An instant method may ask you to authenticate with your bank so ownership and account details can be confirmed quickly. Its safety depends on reaching the provider through the brokerage’s genuine funding flow and on protecting your bank credentials. The presence of an instant option is not proof that a page is legitimate, and no provider is universally safe for every situation.
Micro-deposits
With micro-deposits, the brokerage or its processor sends one or more small amounts to your bank. You wait for them to appear, then enter the amounts or a confirmation code in the brokerage’s official screen. This avoids giving a verification service your online-banking password, but it requires waiting and accurately confirming the deposits. Timing, deposit count and supported institutions are broker-specific.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Consideration | Instant verification | Micro-deposits |
|---|---|---|
| What you provide | Bank authentication in the provider flow; exact fields vary. | Routing and account details, followed by confirmation of small deposits or a code. |
| Typical user experience | Potentially immediate confirmation when the bank is supported. | Requires waiting for deposits to post and then returning to the brokerage. |
| Password exposure | Requires careful confirmation that the page is the identified, legitimate provider. | Does not require entering online-banking credentials into an instant-verification screen. |
| Failure points | Unsupported institution, incorrect bank login, canceled authorization or provider outage. | Delayed deposits, an incorrect amount entered, account mismatch or an expired confirmation window. |
| What is not established universally | It is not always safer or faster for every bank or broker. | It is not always faster, and it may not be available for every account type. |
Whichever method you choose, keep the brokerage’s confirmation and monitor the bank account for unexpected debits. If the bank account is a joint, business, savings or retirement account, verify that the brokerage accepts that ownership type before attempting the link.
Understand ACH settlement before you trade or withdraw
Some firms display “instant funds” or a similar provisional balance before an ACH deposit has fully settled. That balance is not the same as cash that has cleared the banking system. FINRA has warned that criminals exploit the gap between provisional availability and an ACH return.
Before placing a trade, find the brokerage’s current funds-availability page and read the separate rules for buying securities, withdrawing cash and transferring money back to a bank. Pay attention to:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- When a deposit becomes available for each type of transaction.
- Whether unsettled or returned ACH transfers can restrict trading or withdrawals.
- How long a withdrawal hold lasts after a new bank link or deposit.
- Daily or rolling transfer limits, rejected-transfer fees and any review process.
- Whether the firm can reverse a purchase, sell securities or require additional funds if the ACH is returned.
If a deposit is reversed, do not attempt to “fix” it by sending money to an individual who claims to represent the broker. Use the official support channel, preserve the transaction records and ask what amount is actually settled and available.
Secure the brokerage account after KYC
Identity verification protects account opening; it does not prevent later account takeover. Apply these controls as soon as the account is active:
- Turn on two-step verification, preferably with an authenticator application or a passkey when supported.
- Use a long, unique passphrase that is not reused at your email provider, bank or another investment service.
- Enable alerts for new logins, password or profile changes, bank-link changes, deposits, withdrawals and trades.
- Keep the phone, computer, browser and security software updated. Remove unknown browser extensions and review installed apps.
- Store backup codes offline in a secure location. Do not send them to support staff or anyone who contacts you.
- Review active sessions and linked external accounts regularly; revoke sessions and remove connections you do not recognize.
- Protect the email account associated with the brokerage with its own MFA, because email access can enable password resets.
How to tell whether a brokerage login page is real
Use a repeatable check rather than relying on a familiar logo. Type the address yourself or use a bookmark you created after confirming it. Inspect the full domain, not only the words before the first dot; look for misspellings, extra words or a misleading subdomain. Confirm HTTPS and the browser’s certificate warning status, but remember that HTTPS alone cannot prove that a fraudulent domain is the brokerage.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Official apps should come from the device maker’s legitimate app store and list the expected publisher. Compare the app’s name and developer with information on a statement or the brokerage’s independently located website. Do not install a remote-control application at a caller’s request. A genuine support representative will not need to view your screen to receive an MFA code.
Warning signs that indicate a scam
Stop the interaction when someone claiming to be a broker, regulator or “fraud department”:
- Requests an MFA code, password, passkey, backup code or full bank login.
- Demands a gift card, cryptocurrency, wire to a person or payment to unlock an account.
- Creates urgency, threatens arrest or account closure, or insists you stay on the phone while transferring money.
- Promises guaranteed returns or says you must move funds to a “safe” personal account.
- Sends a recovery link, asks for a recovery fee or instructs you to install remote-access software.
No legitimate broker or regulator will ask for your MFA code or pressure you to transfer money to a stranger. End the call or message. Do not click further links, and do not reply with personal information.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat to do if you suspect compromise
- Contact the bank and brokerage independently. Use numbers from official websites, account statements or the back of a bank card, not the suspicious message.
- Change credentials. Start with the brokerage email and password, then change any reused password. Use a clean, updated device if malware is possible.
- Revoke sessions and connections. Sign out unknown devices, remove unfamiliar bank links and disable unrecognized transfer instructions.
- Review activity. Check trades, deposits, withdrawals, profile changes and MFA settings. Ask the firms to place appropriate holds or restrictions.
- Preserve evidence. Keep messages, phone numbers, website addresses, transaction IDs and timestamps without forwarding malicious links to others.
- Report suspected securities fraud to the SEC. Follow the SEC’s official reporting process and any instructions from your financial institutions. If identity-theft indicators appear, also follow the relevant government identity-theft reporting guidance.
Compare broker procedures before choosing one
Security and convenience differ by firm. Read the current U.S. help and disclosure pages for each brokerage and compare the following items rather than assuming that a familiar workflow is universal:
| Area | Questions to answer |
|---|---|
| Identity checks | Which IDs, proof-of-address records, selfies and ownership documents are accepted? How are failed checks appealed? |
| Bank verification | Is instant verification, micro-deposit verification or both available? Which banks and account types are supported? |
| ACH controls | When can deposits be traded? When can cash be withdrawn? What holds, limits, reversals and rejected-transfer charges apply? |
| Account security | Does the firm support authenticator MFA, passkeys, trusted-device controls, session management and detailed alerts? |
| Fraud support | Is there a clearly published way to report unauthorized activity, and can support explain a restriction without asking for a secret code? |
Save the relevant policy pages or disclosures when you open the account. Rules can change, and the amount shown as available in an app may not answer the separate question of whether a withdrawal or purchase is permitted.
Quick Recap
A practical safety checklist
- Started from a self-entered U.S. brokerage address or official app.
- Confirmed the domain, HTTPS status and app publisher.
- Entered legal name, birth date, address and taxpayer ID accurately.
- Uploaded ID only inside the signed-in verification flow.
- Linked a bank account you own and checked routing and account numbers.
- Read whether the verification method uses instant authentication or micro-deposits.
- Checked funds-availability, ACH-return and withdrawal-hold rules before trading.
- Enabled MFA or a passkey, unique credentials and transaction alerts.
- Reviewed linked accounts, active sessions and recent activity.
- Refused requests for codes, gift cards, cryptocurrency, recovery fees or transfers to strangers.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
