When a bank connection prompts for token verification (also called re-authentication or re-verification), it can feel unexpected, especially when the connection previously worked without issues. In reality, this behavior is a normal part of modern direct bank API security and compliance.
This article explains:
Token verification is a bank-required step that confirms the account owner still approves sharing data with a third-party application. Banks often implement this to prevent ongoing data sharing without the user’s awareness and to reduce fraud risk.
Even with direct API connections (the most stable, secure method), banks can still require re-verification periodically.
Banks typically trigger token verification for one of the following reasons:
1) Password or Credential Changes
If the account owner changes their bank password or updates login credentials, the bank may invalidate existing authorization tokens. This forces a fresh verification to ensure the connection remains secure.
2) Fraud Alerts or Security Events
If the bank detects suspicious activity, receives a fraud report, or applies enhanced security controls, it may revoke existing authorizations proactively. This is a protective measure and is often outside the user’s control.
3) Periodic Consent Renewal (Most Common)
Many banks require customers to re-confirm consent periodically. This is increasingly standard across the industry and is driven by security, privacy expectations, and compliance trends.
Banks do this because:
This is the most common reason a stable connection suddenly asks for verification.
Periodic re-verification protects everyone involved:
Banks are increasingly strict because they transmit sensitive data, often including daily transaction feeds and statements. They must ensure that access is still intended and authorized.
Bottom line: This is not a bug. It is a bank-driven security policy that will happen regardless of which platform you use.
While LedgerSync cannot override bank security rules, it focuses on making the verification process fast and low-friction.
Secure Text Message Re-Authentication
LedgerSync can send the account owner a secure text message with a verification link. The user taps the link and completes verification on their phone.
For a MasterCard or MX connection that shows an error, open the connection under Bank Connections and, on its Summary screen, select Text Client To Fix. Tick the client’s phone numbers you want to text, or type another number, then select Send. The link is valid for 6 days from the moment it is sent.
If text messages are switched off for the client, the text cannot be sent.
American Express works differently. LedgerSync now connects American Express through MX, so for a MasterCard connection at American Express the text carries a link for your client to add the bank again through MX, instead of a link that repairs the MasterCard connection.
Benefits:
Traditional re-authentication often fails because it depends on:
A text message is immediate, clear, and easy to complete on a phone, exactly where many bank verification flows are designed to work best.
It makes re-authentication part of the normal workflow so it doesn’t disrupt work. Instead of treating verification as a major support event, LedgerSync provides a streamlined workflow that makes reconnection quick and repeatable.
This reduces: