4 ms·

I worked for a company where, as part of one product, users were giving us the user AND PASSWORD for their bank account. We had thousands of users before I left

I worked for a company where, as part of one product, users were giving us the user AND PASSWORD for their bank account. We had thousands of users before I left. As a programmer, I was sure that the product wasn't going to be viable... boy was I wrong.

plonh 11y ago
This is Yodlee, the USA's largest financial API for consumer products (Mint, etc), endorsed by all large banks and investment firms. They have millions of users.
kybernetyk 11y ago
Hah, we have a payment processor here in Germany called "Sofortüberweisung". It works like this: When you want to pay for something you give them your login credentials to your bank account and a TAN and they send the money to the merchant for you. The selling point of this service is that SEPA wire transfers usually take one day. But with their service the merchant gets an instant notification of money received and you can get your stuff one day earlier. It's crazy but people use this and have no problem handling over the keys to their bank account.
- Silhouette 11y ago
  It's crazy but people use this and have no problem handling over the keys to their bank account. I wonder whether there's more to that story. It seems like a potentially useful payment service, but it also seems like something the banks would surely be aware of. Customers giving up their credentials like that is probably a blatant violation of the bank's normal terms of business, and asking for those credentials or failing to keep them secure seems legally risky for the payment processor as well, particularly if anything ever goes wrong. Are you sure there's no separate agreement or commercial arrangement to cover this, probably between the payment processor and the banks?
  - kuschku 11y ago
    Nope – and most banks even publicly warn that using the service means you lose the money-back guarantee for transactions.
  - kybernetyk 11y ago
    Nope. It's shady as it comes and to my knowledge works via normal HBCI/FinTS access [0] you usually would use for 3rd party online banking software. But lacking wide spread of credit cards and the aversion of many merchants to PayPal here in Germany it's still pretty popular. [0] https://en.wikipedia.org/wiki/FinTS https://en.wikipedia.org/wiki/FinTS
  - germanier 11y ago
    While it's against most bank TOS, that clause has been ruled uncompetitive and therefore void by courts. As far as I know there is only a single German bank (DKB) that officially cooperates and gives them API access. For the rest they use web scraping, the banks are not allowed to (intentionally) break it. The banks don't like that payment processor and therefore just started a competitor where you only give your credentials to your bank. Hopefully it gains traction.
- phkahler 11y ago
  >> It's crazy but people use this and have no problem handling over the keys to their bank account. Part of the problem may be that people don't really understand where those keys are going. They put the information into their computer perhaps via keyboard. Beyond that they often don't know where it goes or where it gets stored. Perhaps they think it's stored locally in an app. For a while people didn't get the distinction between an app and a web site, but I think that's changing. People think Siri does voice recognition on their phone and freak out when you tell them all the recordings are sent to Apple and stored there.

plonh 11y ago

This is Yodlee, the USA's largest financial API for consumer products (Mint, etc), endorsed by all large banks and investment firms. They have millions of users.

kybernetyk 11y ago

Hah, we have a payment processor here in Germany called "Sofortüberweisung". It works like this: When you want to pay for something you give them your login credentials to your bank account and a TAN and they send the money to the merchant for you. The selling point of this service is that SEPA wire transfers usually take one day. But with their service the merchant gets an instant notification of money received and you can get your stuff one day earlier. It's crazy but people use this and have no problem handling over the keys to their bank account.

Silhouette 11y ago
It's crazy but people use this and have no problem handling over the keys to their bank account. I wonder whether there's more to that story. It seems like a potentially useful payment service, but it also seems like something the banks would surely be aware of. Customers giving up their credentials like that is probably a blatant violation of the bank's normal terms of business, and asking for those credentials or failing to keep them secure seems legally risky for the payment processor as well, particularly if anything ever goes wrong. Are you sure there's no separate agreement or commercial arrangement to cover this, probably between the payment processor and the banks?
- kuschku 11y ago
  Nope – and most banks even publicly warn that using the service means you lose the money-back guarantee for transactions.
- kybernetyk 11y ago
  Nope. It's shady as it comes and to my knowledge works via normal HBCI/FinTS access [0] you usually would use for 3rd party online banking software. But lacking wide spread of credit cards and the aversion of many merchants to PayPal here in Germany it's still pretty popular. [0] https://en.wikipedia.org/wiki/FinTS https://en.wikipedia.org/wiki/FinTS
- germanier 11y ago
  While it's against most bank TOS, that clause has been ruled uncompetitive and therefore void by courts. As far as I know there is only a single German bank (DKB) that officially cooperates and gives them API access. For the rest they use web scraping, the banks are not allowed to (intentionally) break it. The banks don't like that payment processor and therefore just started a competitor where you only give your credentials to your bank. Hopefully it gains traction.
phkahler 11y ago
>> It's crazy but people use this and have no problem handling over the keys to their bank account. Part of the problem may be that people don't really understand where those keys are going. They put the information into their computer perhaps via keyboard. Beyond that they often don't know where it goes or where it gets stored. Perhaps they think it's stored locally in an app. For a while people didn't get the distinction between an app and a web site, but I think that's changing. People think Siri does voice recognition on their phone and freak out when you tell them all the recordings are sent to Apple and stored there.