Some time ago I wanted to connect my bank account to my old Coinbase account, once I chose my bank I was prompted to enter my online banking username and password. They use the service called Plaid, that requires your bank credentials (and one time code if 2F is enabled) to verify your checking account. I was able to go with ACH deposit verification route as an alternative, but it is not default approach anymore.
This seems like a security and privacy nightmare. First, sharing your username and password is against the most basic principle we tell the users. Don't share your password! Even a text message with the verification code says not to share it! I'd be surprised if this also does not violate terms of services for online banking. Second, according to Plaid help pages they store credentials if bank does not provide an API. Ideally, banks themselves should not store unhashed passwords, let alone third party apps. Third, it is a privacy nightmare. With such unlimited scope, they scrape everything, your entire financial history is available. And this all for what? To instantly verify a bank account? Their help pages and some comments from the founders state that they don't share/sell your info without explicit permission. They aren't now, but will they later? What if their monetization strategy changes? What if their new owner has a different view on privacy? Or I move to the state that has no CCPA analogue? Is it another service where I need to make sure to opt out of sharing and keep an eye on upcoming TS changes and wonder for how long they are going to keep my data?
I dug a little bit and discovered that Plaid is used by many in fintech: Coinbase, Robinhood, Venmo, Betterment, you name it. Maybe I was living under a rock for too long, but this password sharing practice did not use to be mainstream. I have or had accounts with some of them and I think deposit verification used to be the way few short years back.
I know the US banks don't have any shared scoped authorization mechanism similar to OAuth2/OpenID Connect and there is no easy way to instantly verify the account. ACH deposit can take a week. Though do you really need to fund your Coinbase, Robinhood or Betterment account immediately, is a week later too late? Isn't the whole spiel of Betterment and the likes that "time in market" > "time the market", so a week later would not matter for your retirement? Sure, this approach can be sensible in some narrow use case, when you indeed want them to have that unfettered access. But for the majority of consumers, I don't see how it is worthy of forming such a dangerous habit. However, I almost am certain, for fintech services there is a significant drop in conversion and uptick in abandonment rate, when they need a customer to come back in few days to finish their account funding. Again, seems to be not enough for the industry to be complacent about it.
Note: this is not a critique of Plaid or other services, their security practices maybe excellent, their code reviewed, tested, audited by 3rd parties, etc and there is a limited scope when it is sensible, I am shocked that this becomes mainstream.
UPDATE: I am well aware of Mint and that it has been around for a while. The goal of Mint is to aggregate and manage your finances from one place. It may be that narrow use case, where it can be justified given the current state of things. You want to give it full ongoing access, because of the value it brings you. My beef is with it being normalized for the sake of few point conversion increase in the use case, when it does not benefit the customer and another alternative exists.
Once they were told to never under any circumstances share their password with anyone else. Now they're expected to tell whether it's OK to share their password with a third party website or not. To the non-technical user, they were doing something else, then were asked for their banking login. They weren't trying to log into the bank, so their vulnerability to phishing is slowly increased by this pattern.
Similarly with "don't click links in emails you don't trust" - now we have security notification and email verification links to approve logins arriving, requiring users to click within 5 minutes to approve logins. Breaking the "don't fall for time pressure" rule too that users used to be trained with.
Even their email client is most likely hiding the email address of the sender and focusing on the (self-declared) sender name, and some are now masking the destination of URLs when hovered over (Outlook protection), to make it near impossible for a user to tell what they're clicking.
Back to banks, it definitely is a poor workflow and I share the same concern even where oauth style workflows are concerned - users likely can't tell if it's the real bank website or not, so they're being trained to divulge their credentials on demand. This will help attackers over time, as users become even more willing to share this kind of information upon request!
It's very common in the US, 100% legal, and allowed by the banks.
In fact, I once worked on a project where a major bank paid us to write a Plaid-like scraper for their own website because their internal systems were such a disaster.
It's definitely not great, but it's currently the only way to exfiltrate US banking data. If it bothers you, consider switching to a bank with an API that Plaid can use instead.
More info: https://plaid.com/open-banking/
And the security itself is not my main concert, privacy is. A third party should not know what I do with my money.
This is exactly why the fintech industry pushed so hard for the PSD2 directive in the EU. The Schufa, the German version of Equifax (and just as bad...), even tried to advertise a "let us look at your financial history in your bank account and maybe we'll let you pass then". Fortunately, public outrage was immense and they had to retract their plans for now (https://www.tagesschau.de/investigativ/ndr-wdr/schufa-checkn...).
In fact even you can't give your users credentials away, they're the only ones who have them.
This is if course intended to cure phishing but it also ensures this Plaid scraping flow can't make sense.
Regardless, I've quit using services that rely on Plaid. It's too much of a hassle and potential risk to deal with for me at the moment.
Are you certain that the password/text auth code are sent to Plaid instead of the bank?
Stick with domestic wire transfers to and from crypto exchanges, if in the US.
Stay out of the market if domestic wire transfers are too expensive for you.