13 ms·

There's been a whistleblower or two on HN about how Plaid scapes and sells your bank account transaction history to third parties. It seems more unethical than

by akarma 8y ago

There's been a whistleblower or two on HN about how Plaid scapes and sells your bank account transaction history to third parties. It seems more unethical than most selling-user-data strategies in that the users don't even know Plaid is involved in the transaction whatsoever; they're just a hidden middle layer. I'd be interested to know if this is still part of their monetization strategy, or if anyone at Plaid can confirm definitively that they do not collect and sell your bank account transaction history? Edit: So sorry on my part, specifically on selling data, must've mixed this up now that I've read the comment (linked below). It involved scraping user data against the wishes of the banks, and doing huge amounts of customer analytics with such data, and another separate thread on giving transaction history as part of the service. Still a negative but different than above-- will leave this up so as to not destroy thread.

lbotos 8y ago
They at least collect it, as they offer that as a service: https://plaid.com/products/transactions https://plaid.com/products/transactions I flirted with the idea of using a trial account to feed that data to a Prometheus server to build graphs in Grafana. A slightly more powerful mint/personal capital would be a super valuable tool.
- bdcravens 8y ago
  Yes - the key issue being is that the product offering is an API used by second-party with assumed permission from first-party; they are not selling that data to a third-party.
randomacct3847 8y ago
It’s the Facebook API issue but IMO transaction data is much more sensitive so it’s a bigger issue. I have used the Plaid API and have no idea how they audit developers to make sure they are using the data as intended and storing that data securely. One hack incident of a developer that exposes bank numbers and transaction data would be a huge reputational hit.
- hn_throwaway_99 8y ago
  Edit: I stand corrected, I didn't think you get full account number access but you do. Leaving original comment below. They don't expose bank numbers though, that's kind of the point. Developer access is all tokenized. That said, plaid does give you access to tons of detailed financial transaction data, and it's easy for companies to tie this to PII in their own systems, and I'm sure many of those companies have less robust security than plaid. As a developer, I thought "Wow, you can get so much data through plaid!" but then as a user I would refuse to ever use a plaid integration because I know how much data it gives them. Furthermore, I don't believe the average user really realizes just how much data they are giving up. I agree with you, though, it really is similar to the Facebook API issue. All it would take is a third party company packaging data in a way to use it to target political ads and then you've got 60 Minutes exposes all over the place.
  - randomacct3847 8y ago
    Nah that’s not true. https://plaid.com/products/auth https://plaid.com/products/auth You get the full routing and account number with the Auth product - that is how you push and pull funds as a developer to a customer’s account.
    - ceejayoz 8y ago
      I'd note that you give those same numbers to every yahoo you ever write a check to. The US checking system is terrifyingly insecure in that regard.
skilled 8y ago
Link, my friend.
- alehul 8y ago
  I'll link as soon as I'm not on mobile. Recent incident was on "most unethical thing you've done" thread that reached the top of HN. Someone mentioned selling user data while being a middle layer, and confirmed it was Plaid after it was suggested. Not claiming this is definitively true which is why I'd like to hear from someone at Plaid; I believe I've interacted with them through Robinhood so it'd be concerning.
  - tlarkworthy 8y ago
    https://news.ycombinator.com/item?id=17692291 https://news.ycombinator.com/item?id=17692291 Edit update to root But the comment is not quite as bad as what is suggested
whockey 8y ago
Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/ https://plaid.com/pricing/
- mwexler 8y ago
  And just to point out, there are others that do sell this as part of their business model, so kudos to Plaid for trying to find another way. https://www.forbes.com/sites/petercohan/2018/07/22/mastercard-amex-and-envestnet-profit-from-400m-business-of-selling-transaction-data/ https://www.forbes.com/sites/petercohan/2018/07/22/mastercar... (Another "Forbes Contributor" article, so grain of salt on the details)
- alehul 8y ago
  Thanks William, and sorry for the wrong accusation. Super embarrassed; I read so many comments on that thread I must've conflated two.
  - jka 8y ago
    Thanks for speaking up alehul; for what it's worth, I think it can often be interesting to later reflect on these moments of apparent shame and embarrassment, especially in the context of attempting to speak truth to power. Accountability and transparency is important long-term; as is questioning possible abuse or misuse of power. Don't be afraid to continue to do so! Also, always use Hanlon's razor, but it's getting harder and harder to tell genuine conversations from stage-managed ones online, unfortunately. It's the logical extreme of pg's article 'The Submarine'[0]. [0] - http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html
  - ryanackley 8y ago
    Here is one discussion from a so-called whistleblower I was involved in. I will let you decide on the ethics[1]. I'm in the ACH space and I personally know a merchant who planned on using them for account verification for point of sale ACH payments. This merchant also planned on grabbing transaction history while they were in there for I don't know what. Analytics maybe? I have no idea if they ever went through with their plan. [1]https://news.ycombinator.com/item?id=17692291 https://news.ycombinator.com/item?id=17692291

by akarma 8y ago

lbotos 8y ago

They at least collect it, as they offer that as a service: https://plaid.com/products/transactions https://plaid.com/products/transactions I flirted with the idea of using a trial account to feed that data to a Prometheus server to build graphs in Grafana. A slightly more powerful mint/personal capital would be a super valuable tool.

bdcravens 8y ago
Yes - the key issue being is that the product offering is an API used by second-party with assumed permission from first-party; they are not selling that data to a third-party.

randomacct3847 8y ago

It’s the Facebook API issue but IMO transaction data is much more sensitive so it’s a bigger issue. I have used the Plaid API and have no idea how they audit developers to make sure they are using the data as intended and storing that data securely. One hack incident of a developer that exposes bank numbers and transaction data would be a huge reputational hit.

hn_throwaway_99 8y ago
Edit: I stand corrected, I didn't think you get full account number access but you do. Leaving original comment below. They don't expose bank numbers though, that's kind of the point. Developer access is all tokenized. That said, plaid does give you access to tons of detailed financial transaction data, and it's easy for companies to tie this to PII in their own systems, and I'm sure many of those companies have less robust security than plaid. As a developer, I thought "Wow, you can get so much data through plaid!" but then as a user I would refuse to ever use a plaid integration because I know how much data it gives them. Furthermore, I don't believe the average user really realizes just how much data they are giving up. I agree with you, though, it really is similar to the Facebook API issue. All it would take is a third party company packaging data in a way to use it to target political ads and then you've got 60 Minutes exposes all over the place.
- randomacct3847 8y ago
  Nah that’s not true. https://plaid.com/products/auth https://plaid.com/products/auth You get the full routing and account number with the Auth product - that is how you push and pull funds as a developer to a customer’s account.
  - ceejayoz 8y ago
    I'd note that you give those same numbers to every yahoo you ever write a check to. The US checking system is terrifyingly insecure in that regard.

skilled 8y ago

Link, my friend.

alehul 8y ago
I'll link as soon as I'm not on mobile. Recent incident was on "most unethical thing you've done" thread that reached the top of HN. Someone mentioned selling user data while being a middle layer, and confirmed it was Plaid after it was suggested. Not claiming this is definitively true which is why I'd like to hear from someone at Plaid; I believe I've interacted with them through Robinhood so it'd be concerning.
- tlarkworthy 8y ago
  https://news.ycombinator.com/item?id=17692291 https://news.ycombinator.com/item?id=17692291 Edit update to root But the comment is not quite as bad as what is suggested

whockey 8y ago

Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/ https://plaid.com/pricing/

mwexler 8y ago
And just to point out, there are others that do sell this as part of their business model, so kudos to Plaid for trying to find another way. https://www.forbes.com/sites/petercohan/2018/07/22/mastercard-amex-and-envestnet-profit-from-400m-business-of-selling-transaction-data/ https://www.forbes.com/sites/petercohan/2018/07/22/mastercar... (Another "Forbes Contributor" article, so grain of salt on the details)
alehul 8y ago
Thanks William, and sorry for the wrong accusation. Super embarrassed; I read so many comments on that thread I must've conflated two.
- jka 8y ago
  Thanks for speaking up alehul; for what it's worth, I think it can often be interesting to later reflect on these moments of apparent shame and embarrassment, especially in the context of attempting to speak truth to power. Accountability and transparency is important long-term; as is questioning possible abuse or misuse of power. Don't be afraid to continue to do so! Also, always use Hanlon's razor, but it's getting harder and harder to tell genuine conversations from stage-managed ones online, unfortunately. It's the logical extreme of pg's article 'The Submarine'[0]. [0] - http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html
- ryanackley 8y ago
  Here is one discussion from a so-called whistleblower I was involved in. I will let you decide on the ethics[1]. I'm in the ACH space and I personally know a merchant who planned on using them for account verification for point of sale ACH payments. This merchant also planned on grabbing transaction history while they were in there for I don't know what. Analytics maybe? I have no idea if they ever went through with their plan. [1]https://news.ycombinator.com/item?id=17692291 https://news.ycombinator.com/item?id=17692291