9 ms·

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

lewisl9029 9y ago
I believe this is true for most US banks also. I can't even count how many promising-looking Fintech products I had to pass over because the only auth mechanism they offered was through sharing online banking credentials. Until bank policies regarding credentials-sharing actually change, I think it's really irresponsible for products to even ask for credentials at all, let alone offer it as the default/only auth option. Users could be unwittingly putting their entire life savings at risk.
- sillysaurus3 9y ago
  Users could be unwittingly putting their entire life savings at risk. Is this a realistic concern? I thought the point of a bank was that situations like that can be reversed 100% of the time.
  - Jemmeh 9y ago
    It's a realistic concern. For example, a lot of elderly people are targeted for scams because they A.) Are often little easier to trick and B.) Tend to have more money. Comes up in the news a lot. They don't get it back.
  - lewisl9029 9y ago
    In this particular case, yes, because banks tend to deny all liability for fraudulent transactions that result from credentials sharing, so the user is entirely liable for whatever loss that occurs.
  - Mtinie 9y ago
    That reversal is not instantaneous, and by no means is it a guarantee that you'll ever get the whole amount back when overdraft fees, third-party bounced check fees, and all of the other non-monetary impacts are taken into account. Depending on the scope of your accounts with the financial company that you're banking with it's possible that beyond your day-to-day operating funds and your mid-term savings accounts that you may also have access to your investments and other long-term stores of value. They aren't as liquid, and it would be harder for a thief to shift them into something that can be transferred out of your account, but it certainly is possible for it to happen if sales of stocks/bonds/etc. are conducted without your knowledge and then the funds are wired out.
  - EpicEng 9y ago
    Unless you hand out your credentials to an unauthorized third party, relieving the bank of any liability.
- technofiend 9y ago
  Yodlee not only wants your credentials but at one point updated their customer agreement to grant them Power of Attorney with each institution they managed on your behalf. I don't know about you but PoA, a binding arbitration clause and their marketing your data to boot is well beyond my comfort level.
thibaut_barrere 9y ago
It's the same in France, yet some aggregators (e.g. Bankin) are using those credentials directly (and afaik the risk is handled via some sort of insurance). I'm personally waiting for the PSD II law to be deployed (see https://blog.teller.io/2016/04/26/tauth.html https://blog.teller.io/2016/04/26/tauth.html) in order to have clear-cut protections & boundaries, before leveraging Bankin or similar (Teller) as a SaaS product builder.
- wutwutwutwut 9y ago
  How do you actually share your credentials? I assume you have to provide a 2FA-token when logging on?
  - knlje 9y ago
    You write the equivalent info (user+pass+keycode) into a third party app.
    - KGIII 9y ago
      Is it me, or does this read like a disaster in the making?
      - BillinghamJ 9y ago
        It’s better because going through the same process as the official banking apps means that you should end up using tokens etc rather than actually storing the original credentials.
sjtgraham 9y ago
Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" Secondly, we have ongoing dialogue open with every major UK bank at very senior levels, from C-level down. We want to help banks deliver these APIs. Formal agreements with banks are a key strategic objective for Teller, but they only started returning my calls once I'd broken their apps and took their APIs. The market can't wait for the banks, developers and users want new choices, apps and service now.
- pricechild 9y ago
  Anecdotally, I've seen banks claim the reason for $something_bad was a virus on a chromebook. Whether or not there's 'been a single case of fraud or loss attributed to "screen-scraping"', I believe most banks are more than happy to blame you by default and make it difficult/expensive to resolve.
  - nailer 9y ago
    Most people don't really distinguish between viruses and worms, and there's been worms on Unix systems before (hi RTM!)
  - deleted 9y ago
    [deleted]
- bowersbros 9y ago
  Do you have a mailing list where I can say my bank is with "Halifax let me know when you support them securely?" I'd like something like this, but I wouldn't want to give the bank details away.
- Zenst 9y ago
  Would be prudent and indeed consumer friendly if you where to go thru those TOS the banks have in conjunction with your own and provide a simple at a glance list of liability/impact. Reassure people that way and shows, you care and thought this thru beyond saying we recommend reading this and that as people are wary and equally might not understand it. Sure would take time and some effort, but would certainly return well for such an effort and as said, people would appreciate that greatly, so can only help you and your business.

lewisl9029 9y ago

I believe this is true for most US banks also. I can't even count how many promising-looking Fintech products I had to pass over because the only auth mechanism they offered was through sharing online banking credentials. Until bank policies regarding credentials-sharing actually change, I think it's really irresponsible for products to even ask for credentials at all, let alone offer it as the default/only auth option. Users could be unwittingly putting their entire life savings at risk.

sillysaurus3 9y ago
Users could be unwittingly putting their entire life savings at risk. Is this a realistic concern? I thought the point of a bank was that situations like that can be reversed 100% of the time.
- Jemmeh 9y ago
  It's a realistic concern. For example, a lot of elderly people are targeted for scams because they A.) Are often little easier to trick and B.) Tend to have more money. Comes up in the news a lot. They don't get it back.
- lewisl9029 9y ago
  In this particular case, yes, because banks tend to deny all liability for fraudulent transactions that result from credentials sharing, so the user is entirely liable for whatever loss that occurs.
- Mtinie 9y ago
  That reversal is not instantaneous, and by no means is it a guarantee that you'll ever get the whole amount back when overdraft fees, third-party bounced check fees, and all of the other non-monetary impacts are taken into account. Depending on the scope of your accounts with the financial company that you're banking with it's possible that beyond your day-to-day operating funds and your mid-term savings accounts that you may also have access to your investments and other long-term stores of value. They aren't as liquid, and it would be harder for a thief to shift them into something that can be transferred out of your account, but it certainly is possible for it to happen if sales of stocks/bonds/etc. are conducted without your knowledge and then the funds are wired out.
- EpicEng 9y ago
  Unless you hand out your credentials to an unauthorized third party, relieving the bank of any liability.
technofiend 9y ago
Yodlee not only wants your credentials but at one point updated their customer agreement to grant them Power of Attorney with each institution they managed on your behalf. I don't know about you but PoA, a binding arbitration clause and their marketing your data to boot is well beyond my comfort level.

thibaut_barrere 9y ago

It's the same in France, yet some aggregators (e.g. Bankin) are using those credentials directly (and afaik the risk is handled via some sort of insurance). I'm personally waiting for the PSD II law to be deployed (see https://blog.teller.io/2016/04/26/tauth.html https://blog.teller.io/2016/04/26/tauth.html) in order to have clear-cut protections & boundaries, before leveraging Bankin or similar (Teller) as a SaaS product builder.

wutwutwutwut 9y ago
How do you actually share your credentials? I assume you have to provide a 2FA-token when logging on?
- knlje 9y ago
  You write the equivalent info (user+pass+keycode) into a third party app.
  - KGIII 9y ago
    Is it me, or does this read like a disaster in the making?
    - BillinghamJ 9y ago
      It’s better because going through the same process as the official banking apps means that you should end up using tokens etc rather than actually storing the original credentials.

sjtgraham 9y ago

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" Secondly, we have ongoing dialogue open with every major UK bank at very senior levels, from C-level down. We want to help banks deliver these APIs. Formal agreements with banks are a key strategic objective for Teller, but they only started returning my calls once I'd broken their apps and took their APIs. The market can't wait for the banks, developers and users want new choices, apps and service now.

pricechild 9y ago
Anecdotally, I've seen banks claim the reason for $something_bad was a virus on a chromebook. Whether or not there's 'been a single case of fraud or loss attributed to "screen-scraping"', I believe most banks are more than happy to blame you by default and make it difficult/expensive to resolve.
- nailer 9y ago
  Most people don't really distinguish between viruses and worms, and there's been worms on Unix systems before (hi RTM!)
- deleted 9y ago
  [deleted]
bowersbros 9y ago
Do you have a mailing list where I can say my bank is with "Halifax let me know when you support them securely?" I'd like something like this, but I wouldn't want to give the bank details away.
Zenst 9y ago
Would be prudent and indeed consumer friendly if you where to go thru those TOS the banks have in conjunction with your own and provide a simple at a glance list of liability/impact. Reassure people that way and shows, you care and thought this thru beyond saying we recommend reading this and that as people are wary and equally might not understand it. Sure would take time and some effort, but would certainly return well for such an effort and as said, people would appreciate that greatly, so can only help you and your business.