That's the standard option that all other monetary services use when they want to ACH transfer to or from your bank account. Using that mechanism will make your service much more familiar and acceptable to people, whereas asking for a username and password raises huge red flags.

I only know of one other service that asks for bank account usernames and passwords: mint.com. And they frequently have to deal with customer concerns about the security of doing so, even though they very explicitly say they only provide read-only access. Your service doesn't even have that guarantee.

So: drop the username and password thing, and only support the standard verify-two-small-transfers option that every other service uses.