4 ms·

They use Plaid[1] to verify bank accounts using bank login credentials instead of micro deposits -- which reduces abandoned applications since you don't have to

They use Plaid[1] to verify bank accounts using bank login credentials instead of micro deposits -- which reduces abandoned applications since you don't have to wait a couple days to complete verification. This is a very common thing for fintech companies to do. [1] https://plaid.com/ https://plaid.com/

acjohnson55 9y ago
It's so bizarre to me that there isn't proper auth delegation in online banking. You should never have to put credentials for one domain into a form on another domain. Let alone banking credentials!
- Jommi 9y ago
  I think everyone here is super overblowing this.. You're redirected to a new domain (of your bank) for verification. Then directed back.
- mbrock 9y ago
  And that's a huge indicator of why blockchain finance is attractive. The banking system is AWFUL. Exchanges are bridges between banks and blockchains, and it's quite reasonable to want to keep your money in cryptocurrency just for technical usability reasons. I can send cryptocurrency from a shell script -- that's not going to work with bank money in a million years, or if it does it's going to be because of the competition from blockchains. Blockchains enable permissionless innovation in finance, and that's HUGE.
  - Chriky 9y ago
    You can do that with Monzo already
    - mbrock 9y ago
      Looks neat, but it'll be years before that's widely available worldwide. Monzo has a waiting list and probably don't offer business accounts. Blockchains right now enable everyone in the world to open however many "accounts" they want instantly.
  - PeterisP 9y ago
    You're talking about the USA banking system, which is pretty much stone age compared to everyone else. (paper checks? really?) For example, in EU the requirement for banks to open up APIs to everyone is coming in force next year, a bit closer than a million years - and it's not happening because of competition from blockchains, it was put in force (before blockchains boomed) for reasons of consumer rights and restricting anti-competitive behavior by banks.
    - mbrock 9y ago
      I'm not sure the EU directive will open up APIs to everyone. More likely it will be to a regulated class of businesses, right? If it really means I will be able to directly access and manipulate my own personal and business bank account with curl, then I'm really excited. If I have to go through a bureaucratic approval process, then it's still pretty cool, but not what I really want (permissionless innovation).
      - PeterisP 9y ago
        Yes, the main intent is not for end-users to access those APIs directly - most consumers don't want that, and the larger business who want it already have such access, pretty much every bank here offers a cash management solution that allows you to automatically access your account data and send transactions from your system to the bank. The big expectation is that it will open up the market to fintech service providers / tool makers who can then provide services using that API to every customer of every bank; but there certainly could be (or you could make) a service provider that offers exactly what you describe - a consumer friendly API for direct access, handling the authentication in some manner that's compatible with isolated curl requests. You wouldn't have to get permission from the involved banks to do that, but you would have to get the permission from the customers, of course.
marssaxman 9y ago
What the fuck? There is no way, never, ever, that I would even consider doing that. How the hell is it a good idea for any company to try to convince people that it should be normal to share login credentials with a third party for any service, much less something as sensitive as one's bank account? That's just training people to get scammed.
- damontal 9y ago
  Hasn't Mint been doing this for ages?
  - stevenwoo 9y ago
    I entered one account on Mint and found myself with OP, and decided I didn't want to enter a bunch of different login credentials into a different app.
  - avenoir 9y ago
    Was about to say this. Pretty much most of services that tie in with a bank account that I've ever used provide this option as an alternative to waiting 3 days for bank account verification. It is truly bizarre how this has become the standard.
  - sah2ed 9y ago
    Yes, but Mint used a similar approach. Not sure if this is what they use now, but Mint used a similar (but older) service to Plaid called Yodlee [0] as their backend for accessing bank accounts. [0] https://www.yodlee.com/ https://www.yodlee.com/ [1] https://techcrunch.com/2009/09/18/mint-is-yodlees-youtube/ https://techcrunch.com/2009/09/18/mint-is-yodlees-youtube/
- zkms 9y ago
  > That's just training people to get scammed. Yes. All the work of "don't enter your bank password on any website that isn't your bank" went down the bloody trash once this awful workaround to the awfulness that is ACH happened. It's very sad.

acjohnson55 9y ago

It's so bizarre to me that there isn't proper auth delegation in online banking. You should never have to put credentials for one domain into a form on another domain. Let alone banking credentials!

Jommi 9y ago
I think everyone here is super overblowing this.. You're redirected to a new domain (of your bank) for verification. Then directed back.
mbrock 9y ago
And that's a huge indicator of why blockchain finance is attractive. The banking system is AWFUL. Exchanges are bridges between banks and blockchains, and it's quite reasonable to want to keep your money in cryptocurrency just for technical usability reasons. I can send cryptocurrency from a shell script -- that's not going to work with bank money in a million years, or if it does it's going to be because of the competition from blockchains. Blockchains enable permissionless innovation in finance, and that's HUGE.
- Chriky 9y ago
  You can do that with Monzo already
  - mbrock 9y ago
    Looks neat, but it'll be years before that's widely available worldwide. Monzo has a waiting list and probably don't offer business accounts. Blockchains right now enable everyone in the world to open however many "accounts" they want instantly.
- PeterisP 9y ago
  You're talking about the USA banking system, which is pretty much stone age compared to everyone else. (paper checks? really?) For example, in EU the requirement for banks to open up APIs to everyone is coming in force next year, a bit closer than a million years - and it's not happening because of competition from blockchains, it was put in force (before blockchains boomed) for reasons of consumer rights and restricting anti-competitive behavior by banks.
  - mbrock 9y ago
    I'm not sure the EU directive will open up APIs to everyone. More likely it will be to a regulated class of businesses, right? If it really means I will be able to directly access and manipulate my own personal and business bank account with curl, then I'm really excited. If I have to go through a bureaucratic approval process, then it's still pretty cool, but not what I really want (permissionless innovation).
    - PeterisP 9y ago
      Yes, the main intent is not for end-users to access those APIs directly - most consumers don't want that, and the larger business who want it already have such access, pretty much every bank here offers a cash management solution that allows you to automatically access your account data and send transactions from your system to the bank. The big expectation is that it will open up the market to fintech service providers / tool makers who can then provide services using that API to every customer of every bank; but there certainly could be (or you could make) a service provider that offers exactly what you describe - a consumer friendly API for direct access, handling the authentication in some manner that's compatible with isolated curl requests. You wouldn't have to get permission from the involved banks to do that, but you would have to get the permission from the customers, of course.

marssaxman 9y ago

What the fuck? There is no way, never, ever, that I would even consider doing that. How the hell is it a good idea for any company to try to convince people that it should be normal to share login credentials with a third party for any service, much less something as sensitive as one's bank account? That's just training people to get scammed.

damontal 9y ago
Hasn't Mint been doing this for ages?
- stevenwoo 9y ago
  I entered one account on Mint and found myself with OP, and decided I didn't want to enter a bunch of different login credentials into a different app.
- avenoir 9y ago
  Was about to say this. Pretty much most of services that tie in with a bank account that I've ever used provide this option as an alternative to waiting 3 days for bank account verification. It is truly bizarre how this has become the standard.
- sah2ed 9y ago
  Yes, but Mint used a similar approach. Not sure if this is what they use now, but Mint used a similar (but older) service to Plaid called Yodlee [0] as their backend for accessing bank accounts. [0] https://www.yodlee.com/ https://www.yodlee.com/ [1] https://techcrunch.com/2009/09/18/mint-is-yodlees-youtube/ https://techcrunch.com/2009/09/18/mint-is-yodlees-youtube/
zkms 9y ago
> That's just training people to get scammed. Yes. All the work of "don't enter your bank password on any website that isn't your bank" went down the bloody trash once this awful workaround to the awfulness that is ACH happened. It's very sad.