5 ms·

Swedish payment processor Klarna does something similar to this as well. If bying something through the platform by direct bank transfer you are asked to sign t

Swedish payment processor Klarna does something similar to this as well. If bying something through the platform by direct bank transfer you are asked to sign to your bank to accept the payment using BankID [0], which is normal. What is not normal is that they grab your personal identification number and send a login request using BankID before you open your app. When authenticating the login you authorize one of Klarnas third parties to log into your bank account as you, allowing them to pull records of all your financial transactions, account statements etc. Most users just authenticate the login without reading where the request is coming from on the login prompt. I don't understand how that can be legal, but they are relying on recent court cases where scammers would call old people asking them to log on to check their retirement accounts. The scammers would then send a login request before the user sent theirs, log on to the accounts and change what funds received the victims pension payments. The scammers were ruled in the wrong, but the logins themselves were ruled to be an ok way of doing business. [0] https://en.wikipedia.org/wiki/Electronic_identification#Sweden https://en.wikipedia.org/wiki/Electronic_identification#Swed...

jks 8y ago
Klarna tried to ask for people's bank access codes in Finland until Finland's Financial Supervisory Authority ruled it illegal. Seems like a shady business to me.
- thesimon 8y ago
  Will probably be legal again due to the PSD2.
  - jks 8y ago
    The Finnish authority’s stance is that asking for passwords and screen scraping the bank pages is not acceptable. I only have a source in Finnish but Google Translate seems to work: https://www.finanssivalvonta.fi/saantely/kannanotot-ja-tulkinnat/01_2018/ https://www.finanssivalvonta.fi/saantely/kannanotot-ja-tulki... https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.finanssivalvonta.fi%2Fsaantely%2Fkannanotot-ja-tulkinnat%2F01_2018%2F https://translate.google.com/translate?sl=auto&tl=en&u=https...
Scorpiion 8y ago
I tried to find more information about this statement: "When authenticating the login you authorize one of Klarnas third parties to log into your bank account as you, allowing them to pull records of all your financial transactions, account statements etc.“ Do you have any source to verify this claim? That they can and do pull down this information. I would like to know if they really have all that information or not, if so it's a surprise to me, did not know that.
- kevsim 8y ago
  Perhaps a GDPR takeout request could answer this? Provided they’re doing things by the book.
  - haraball 8y ago
    Klarna seems to be under investigation currently for not complying with the GDPR: https://www.insidescandinavianbusiness.com/article.php?id=370 https://www.insidescandinavianbusiness.com/article.php?id=37...
    - hasa 8y ago
      1.4 ?
  - Scorpiion 8y ago
    This is a good idea, I got tempted to try this. Found this page on their homepage (in Swedish): https://www.klarna.com/se/dataskydd/ https://www.klarna.com/se/dataskydd/ Where it says you can email this address "dataskydd@klarna.se" if you either want them to delete your data (except data they are required to store as a bank) or if you want a print out of your personal information they store. The matching UK site (in English) is here: https://www.klarna.com/uk/privacy-policy/ https://www.klarna.com/uk/privacy-policy/ and has this email for the same purpose: "privacy@klarna.co.uk"
  - antocv 8y ago
    Klarna shits on GDPR and giggles while doing so. Ive been asking them singe GDPR took effect to provide me with all details they have about me, and to delete my account. Not even a response. They claim "financial institutions" are exempt due to money laundering laws. That I understand, financial transactions they can keep, but I know a friend works there, they dont only keep financial transactions, they keep data of every website/shop I visited where they have an "integration with".
Benjamin_Dobell 8y ago
POLi in Australia also asks for your bank username and password, logs into your bank's online portal, and performs a bank transfer on your behalf; which is of course in violation of the bank's policies. It's truly insane, if I see any company accepting payment via POLi it's instant verification the company in question is clueless and that I should avoid using their services whenever possible, because they have zero idea about security. According to POLi[1][2], the list includes: Qantas, Jetstar, Virgin Australia, Microsoft (?), Sportsbet, Emirates, BetEasy, CoinSpot, Australia Post, TigerAir, Facebook (?) The list goes on. It's pure madness. I really wish there was more awareness of this, I can't believe these massive companies can't comprehend how they're being implicated when they encourage users to hand over their banking password to a third party. [1] https://www.polipayments.com/ https://www.polipayments.com/ [2] https://www.polipayments.com/Buy#matrix https://www.polipayments.com/Buy#matrix
- tapland 8y ago
  The problem with Klarna in Sweden is that virtually every single online shop use them now.
- Nullabillity 8y ago
  Trustly does this, too.
  - hasa 8y ago
    Tink not mentioned yet
  - tapland 8y ago
    Not sure about that. I used trustly last week and only had one authentication that was for the actual payment. No login to my bank. But I might be misremembering.
- hiisukun 8y ago
  Thanks for this comment. I had no idea - other than regularly seeing POLi as an option (that my bank didn't support) when visiting some of the websites you mentioned. I will certainly steer clear of this process in the future.
renholder 8y ago
>The scammers were ruled in the wrong, but the logins themselves were ruled to be an ok way of doing business. This seems like something that the Riksdagen should step-in on. BankId was meant as validating a legal entity (I am who I say I am) and a third-party presenting that they are they are that legal entity (in this case, the person in question) would certainly seem to circumvent the intention behind that.
j16sdiz 8y ago
Saltedge build their whole business on gathering bank account password and provide "API" access to transactions. https://www.saltedge.com/ https://www.saltedge.com/
nchie 8y ago
Wow, as someone who has used this service, thank you for the mentioning this, I had no idea!
raverbashing 8y ago
The way I saw this done is through an iframe, I suppose it's something similar to 3DS/VbV (while ridiculously misguided, this iframe thing was done correctly) But I'm not sure that's the way Klama does
manderley 8y ago
The new EU Financial Services Directive formalizes this process and forces banks to provide an API for third-party payment providers.
- londons_explore 8y ago
  The API is read-only for now. If you can't make payments using it, a lot of the benefits are gone.
  - manderley 8y ago
    This is changing by September 2019, "Payment Initiation Services Providers (PISP) is the term used by the EU.
ryanlol 8y ago
>they are relying on recent court cases where scammers would call old people asking them to log on to check their retirement accounts How would this work? As far as I know Swedish courts don't follow stare decisis.
- lostmyoldone 8y ago
  This is going to contain errors, one would have to be a professional to get this right, but the gist is that formally, no, but in practice it kind of does. If the decision was made by one of the higher courts, a precedent will be created, which while not formally binding is essentially treated as such. In general the precedents can't create new law, only interpret. However this turns out to sometimes be a difference without significance, as effectively new law is created due to how heavy lower courts are leaning on some such cases. One I have some knowledge of regards agency of company representatives where the interpretation made it essentially legal for a company to use third party sellers to act as representatives for the company write and sign contracts, which then the original party could renege on at any time, with no penalties by simply stating that their agent had overstepped their bounds. This was a case of a house builder backing out because the agent had given a price that the house builder deemed a little too low. This is described in the relevant literature as a clear precedent for all manners of company agency, while if you read the actual judgement it was clearly marginal. But it has effectively created new law. You now have to make sure to write contracts with an employee of whomever you are dealing with if you are to be able to trust in your contract. All courts also have a right to judicial review, thus in theory a single local court can nullify any law if it doesn't follow the constituting laws, either completely, or for a specific case. If this happens, then that case becomes a precedent. This is however somewhat rare as far as I understand it, as it's somewhat of a joke that the best way to loose a case is to refer to the constituting laws, as they are essentially completely ignored. Yeah, I'm amazed it works at all. At least on the surface it seems our judicial system really has some deep flaws that nobody has really dared to address. To little real oversight, no binding checks on the constitutionality of new laws - although the advisory committee tends to be respected, and no formal way afaik to revoke precedents that turn out to have bad consequences. It seems to work a lot based on some form of "gentlemen's agreement", and tradition. By now I guess we all know how quickly those can crumble.
datenhorst 8y ago
Wait, what? I use Klarna quite regularily and I assumed they were redirecting to my bank's website (in an iframe) where I would enter my credentials. I mean, the web form is even branded with my bank's logo and color scheme. If it's really the case that I was just giving my credentials to Klarna who then logged into my bank account on my behalf, I have been phished, there's no sugar coating this.
- hopler 8y ago
  Even if it's an iframe, there's no way for a non webdev to confirm it so it's indistinguishable from phishing.
  - londons_explore 8y ago
    One can easily phish a webdev - seeing the difference between an <iframe> and an <iframé> isn't easy!
lostmyoldone 8y ago
BankID generally have quite strict rules about how you use their authentication, or so I've hear from their customers. If it is as deceptive as you say, I really don't understand how/why BankID is allowing it.
- tapland 8y ago
  It's not really BankIDs fault. It was discussed when it was discovered that Allra had misused BankID in this way. The BankID will say who/where is trying to log on, and the hijackers trust that users don't read the BankID login screen. It's a great service and I can't believe shady things like this is allowed.

jks 8y ago

Klarna tried to ask for people's bank access codes in Finland until Finland's Financial Supervisory Authority ruled it illegal. Seems like a shady business to me.

thesimon 8y ago
Will probably be legal again due to the PSD2.
- jks 8y ago
  The Finnish authority’s stance is that asking for passwords and screen scraping the bank pages is not acceptable. I only have a source in Finnish but Google Translate seems to work: https://www.finanssivalvonta.fi/saantely/kannanotot-ja-tulkinnat/01_2018/ https://www.finanssivalvonta.fi/saantely/kannanotot-ja-tulki... https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.finanssivalvonta.fi%2Fsaantely%2Fkannanotot-ja-tulkinnat%2F01_2018%2F https://translate.google.com/translate?sl=auto&tl=en&u=https...

Scorpiion 8y ago

I tried to find more information about this statement: "When authenticating the login you authorize one of Klarnas third parties to log into your bank account as you, allowing them to pull records of all your financial transactions, account statements etc.“ Do you have any source to verify this claim? That they can and do pull down this information. I would like to know if they really have all that information or not, if so it's a surprise to me, did not know that.

kevsim 8y ago
Perhaps a GDPR takeout request could answer this? Provided they’re doing things by the book.
- haraball 8y ago
  Klarna seems to be under investigation currently for not complying with the GDPR: https://www.insidescandinavianbusiness.com/article.php?id=370 https://www.insidescandinavianbusiness.com/article.php?id=37...
  - hasa 8y ago
    1.4 ?
- Scorpiion 8y ago
  This is a good idea, I got tempted to try this. Found this page on their homepage (in Swedish): https://www.klarna.com/se/dataskydd/ https://www.klarna.com/se/dataskydd/ Where it says you can email this address "dataskydd@klarna.se" if you either want them to delete your data (except data they are required to store as a bank) or if you want a print out of your personal information they store. The matching UK site (in English) is here: https://www.klarna.com/uk/privacy-policy/ https://www.klarna.com/uk/privacy-policy/ and has this email for the same purpose: "privacy@klarna.co.uk"
- antocv 8y ago
  Klarna shits on GDPR and giggles while doing so. Ive been asking them singe GDPR took effect to provide me with all details they have about me, and to delete my account. Not even a response. They claim "financial institutions" are exempt due to money laundering laws. That I understand, financial transactions they can keep, but I know a friend works there, they dont only keep financial transactions, they keep data of every website/shop I visited where they have an "integration with".

Benjamin_Dobell 8y ago

POLi in Australia also asks for your bank username and password, logs into your bank's online portal, and performs a bank transfer on your behalf; which is of course in violation of the bank's policies. It's truly insane, if I see any company accepting payment via POLi it's instant verification the company in question is clueless and that I should avoid using their services whenever possible, because they have zero idea about security. According to POLi[1][2], the list includes: Qantas, Jetstar, Virgin Australia, Microsoft (?), Sportsbet, Emirates, BetEasy, CoinSpot, Australia Post, TigerAir, Facebook (?) The list goes on. It's pure madness. I really wish there was more awareness of this, I can't believe these massive companies can't comprehend how they're being implicated when they encourage users to hand over their banking password to a third party. [1] https://www.polipayments.com/ https://www.polipayments.com/ [2] https://www.polipayments.com/Buy#matrix https://www.polipayments.com/Buy#matrix

tapland 8y ago
The problem with Klarna in Sweden is that virtually every single online shop use them now.
Nullabillity 8y ago
Trustly does this, too.
- hasa 8y ago
  Tink not mentioned yet
- tapland 8y ago
  Not sure about that. I used trustly last week and only had one authentication that was for the actual payment. No login to my bank. But I might be misremembering.
hiisukun 8y ago
Thanks for this comment. I had no idea - other than regularly seeing POLi as an option (that my bank didn't support) when visiting some of the websites you mentioned. I will certainly steer clear of this process in the future.

renholder 8y ago

>The scammers were ruled in the wrong, but the logins themselves were ruled to be an ok way of doing business. This seems like something that the Riksdagen should step-in on. BankId was meant as validating a legal entity (I am who I say I am) and a third-party presenting that they are they are that legal entity (in this case, the person in question) would certainly seem to circumvent the intention behind that.

j16sdiz 8y ago

Saltedge build their whole business on gathering bank account password and provide "API" access to transactions. https://www.saltedge.com/ https://www.saltedge.com/

nchie 8y ago

Wow, as someone who has used this service, thank you for the mentioning this, I had no idea!

raverbashing 8y ago

The way I saw this done is through an iframe, I suppose it's something similar to 3DS/VbV (while ridiculously misguided, this iframe thing was done correctly) But I'm not sure that's the way Klama does

manderley 8y ago

The new EU Financial Services Directive formalizes this process and forces banks to provide an API for third-party payment providers.

londons_explore 8y ago
The API is read-only for now. If you can't make payments using it, a lot of the benefits are gone.
- manderley 8y ago
  This is changing by September 2019, "Payment Initiation Services Providers (PISP) is the term used by the EU.

ryanlol 8y ago

>they are relying on recent court cases where scammers would call old people asking them to log on to check their retirement accounts How would this work? As far as I know Swedish courts don't follow stare decisis.

lostmyoldone 8y ago
This is going to contain errors, one would have to be a professional to get this right, but the gist is that formally, no, but in practice it kind of does. If the decision was made by one of the higher courts, a precedent will be created, which while not formally binding is essentially treated as such. In general the precedents can't create new law, only interpret. However this turns out to sometimes be a difference without significance, as effectively new law is created due to how heavy lower courts are leaning on some such cases. One I have some knowledge of regards agency of company representatives where the interpretation made it essentially legal for a company to use third party sellers to act as representatives for the company write and sign contracts, which then the original party could renege on at any time, with no penalties by simply stating that their agent had overstepped their bounds. This was a case of a house builder backing out because the agent had given a price that the house builder deemed a little too low. This is described in the relevant literature as a clear precedent for all manners of company agency, while if you read the actual judgement it was clearly marginal. But it has effectively created new law. You now have to make sure to write contracts with an employee of whomever you are dealing with if you are to be able to trust in your contract. All courts also have a right to judicial review, thus in theory a single local court can nullify any law if it doesn't follow the constituting laws, either completely, or for a specific case. If this happens, then that case becomes a precedent. This is however somewhat rare as far as I understand it, as it's somewhat of a joke that the best way to loose a case is to refer to the constituting laws, as they are essentially completely ignored. Yeah, I'm amazed it works at all. At least on the surface it seems our judicial system really has some deep flaws that nobody has really dared to address. To little real oversight, no binding checks on the constitutionality of new laws - although the advisory committee tends to be respected, and no formal way afaik to revoke precedents that turn out to have bad consequences. It seems to work a lot based on some form of "gentlemen's agreement", and tradition. By now I guess we all know how quickly those can crumble.

datenhorst 8y ago

Wait, what? I use Klarna quite regularily and I assumed they were redirecting to my bank's website (in an iframe) where I would enter my credentials. I mean, the web form is even branded with my bank's logo and color scheme. If it's really the case that I was just giving my credentials to Klarna who then logged into my bank account on my behalf, I have been phished, there's no sugar coating this.

hopler 8y ago
Even if it's an iframe, there's no way for a non webdev to confirm it so it's indistinguishable from phishing.
- londons_explore 8y ago
  One can easily phish a webdev - seeing the difference between an <iframe> and an <iframé> isn't easy!

lostmyoldone 8y ago

BankID generally have quite strict rules about how you use their authentication, or so I've hear from their customers. If it is as deceptive as you say, I really don't understand how/why BankID is allowing it.

tapland 8y ago
It's not really BankIDs fault. It was discussed when it was discovered that Allra had misused BankID in this way. The BankID will say who/where is trying to log on, and the hijackers trust that users don't read the BankID login screen. It's a great service and I can't believe shady things like this is allowed.