4 ms·
As isomorph says I've built a fully transactional API that works with existing major banks. We currently have a closed beta supporting banks in the RBS group (R
by sjtgraham 11y ago
As isomorph says I've built a fully transactional API that works with existing major banks. We currently have a closed beta supporting banks in the RBS group (RBS, Natwest, Ulster, IOM) and we'll be adding Barclays and HSBC next.
http://teller.io/ http://teller.io/
- aembleton 11y agoHave the banks provided you with a private API or are you doing everything by scraping the web UI?
- sjtgraham 11y agoNeither. We cracked their mobile apps to reverse engineer their private mobile app APIs, and then implemented our own clients for those APIs. To the bank Teller looks like one of their own mobile apps.
- ddoolin 11y agoI've thought about doing this (and sort of started) but for a separate industry. This is going to prove challenging legally, no?
- sjtgraham 11y agoWhat I've done is actually completely legal and specifically protected by the law in the EU.
- deanclatworthy 11y agoSo you're building a service on top of undocumented and private APIs? They could shut you down an instant - no?
- sjtgraham 11y agoNo. There are a number of things that stop them doing this practically: - Making breaking changes to their APIs break all in-flight clients. This is poor UX for their regular customers if their first party app stops working every week. - App store approval time is a choke point - Internal change control is another choke point - I can find what's changed and deploy a fix in no time.
- deanclatworthy 11y agoWhat if they block the ips you use to power the API? Furthermore, using some simple heuristics it should be easy to fingerprint your API and automate the blocking. Eg A normal user is unlikely to cycle IPs between requests. Your ApI might.
- tomschlick 11y agoWhat are you going to do when you start getting C&D letters?
- sjtgraham 11y agoBuy some nice frames and put them on the wall.
- Johnie 11y agoThis is a sign of how bad and far behind the bank technology stack has become. They are all fighting to stay relevant by keeping others out. But technologists are finding loopholes around their stack.
- sionsmith 11y agoThis is exactly what Tink app have done and they have been in operation for the past 3 years. Legally your using public available endpoints so even if they did block your IP's spin that docker image up on a new host ;)
- antaviana 11y agoWhat prevents you from emptying my account if I use your service?
- StavrosK 11y agoLooks like just their honour, unfortunately. If banks provided first-party support, rather than forcing people to reverse engineer mobile phone app APIs, we might see safer implementations.
- pmx 11y agoThis is incredibly exciting! I got myself on the waiting list, looking forward to trying it out!
- raesene4 11y agohow are you handling the problem of banks revoking customers online fraud guarantees if they make use of 3rd party services to make transactions? From what I saw of the aggregation sites that pulled details from UK banks in the past, this was a major stumbling block...