Account Control

Orum's second tier of verification — Account Control — ensures the end user has control of the account – combatting Reg E fraud. Verify drops a random code into the bank account and prompts the user in real-time to authenticate it – removing the lost time and expense of microdeposits.

ℹ️

Note

A control verification also includes an account status verification. This means both control_status and verification_status will update to validupon success.

Orum verifies account control by sending a unique four-character code to the bank account of your end user. Once they locate the code on the transaction, there are two ways to confirm it:

1. API-based solution: Send back the code via the Control endpoint
2. Orum Hosted Email Solution: Orum triggers an automated email to the end user with instructions on how to verify the code via an Orum-hosted website. This email comes from you, but is automatically sent by Orum.

Both options are described in further detail below.

Option 1: API-Based Solution

If you prefer owning the entire user experience with your brand, this is the option for you. In this option, Orum still sends a penny with a unique 4-character code to the end-user’s bank account. However, the other touchpoints of the experience are managed by you, the enterprise. The workflow of this solution is as follows:

1. Your enterprise builds a self-branded interface for your end customers to submit their unique four-character code
2. Your enterprise delivers the verification request to the end user and informs them of the steps they need to take to retrieve their unique four-character code
3. Your end user enters the unique 4-character code through the an interface you manage, which is then verified by Orum through our Control API

This approach works best if you want the process to be a natural extension of your brand, since you are in control of how you communicate with the end-user and the experience they’ll have submitting the code.

Option 2: Orum Hosted Email Solution

If you don’t have the resources in place to build your own user experience, our hosted email solution could be a great fit. The workflow of this solution is as follows:

1. Your enterprise sends a verification request and includes the end user’s email in the Verify request body

2. Orum sends a penny with a 4-character code to the end user’s bank account

3. Orum sends an email to the end user to prompt them to look for and enter the 4-character code in an Orum-hosted webpage in the email

   1. The email is delivered from your domain but sent via Orum (example below)
   

4. End user enters the 4-character code into the Orum-hosted webpage and successfully verifies control of the bank account

   1. This webpage is generic and does not include any customizations or branding (example below)
   2. The format of the webpage link will be verify.orum.io/YourEnterprise
   

This approach works best if you are comfortable with generic branding experience and don’t have the resources or systems in place to send emails or build and manage the code-acceptance webpage.

Email Send Timing

If using the email-based solution, Orum will send an email based on the following logic:

• If the bank account is FedNow-eligible, the email is sent once a verify_account_updated webhook event returns a verification_status of valid.
• If the bank account is not FedNow-eligible, the email is sent during evening hours or the following morning of the next business day (if not a bank holiday).

Configuring Your Domain for Sending Emails on Your Behalf

To enable Orum to send emails on your behalf securely and reliably, you'll need to update your domain settings. This process ensures your emails are trusted by recipients and aren't marked as spam.

Steps to Configure Your Domain

1. Verify Your Domain
   1. Add a special record to your domain's DNS settings to prove ownership.
2. Set Up Email Authentication
   1. SPF Record: Authorizes us to send emails on your behalf.
   2. DKIM Record: Adds a digital signature to your emails for better security and deliverability.
   3. Use a Custom Mail Domain (Mail From): Emails will be sent from a custom domain like mail.yourdomain.com, to enable this a specific DNS records must be added.

What You'll Need to Do

1. If you manage your DNS settings, we'll provide the records you need to add.
2. Once the DNS updates are in place, we'll verify and test the setup to ensure everything works perfectly.

Control Status

Regardless of whether you choose to use the API-based or email-based solution, the Control statuses and webhook events remain the same.

ℹ️

Note

The maximum number of attempts defaults to three

Sample Webhook Event

{
    "created_at": "2023-11-17T20:10:06.173Z",
    "event_data": {
        "account": {
            "id": "2b610cd7-0366-47a0-94c7-923dc0472bc5",
            "account_number": "12345678910",
            "routing_number": "102001017",
            "account_holder_name": "John Doe",
            "estimated_verification_date": "2023-11-17T00:00:00Z",
            "verification_status": "valid",
            "control_status": "valid",
            "created_at": "2023-11-17T20:09:58.356657Z",
            "updated_at": "2023-11-17T20:10:05.351604Z"
        }
    },
    "event_id": "562eec7a-b6e7-489a-bbaa-2f04c137b3d1",
    "event_type": "verify_account_updated"
}

Fraud Controls

You will be blocked from making >5 verification requests to the same account within a 24 hour period.