8 ms·
Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. A
by nikolay 7y ago
Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'm not willing to disable 2FA! Maybe being Visa, it will make the whole service more meaningful if Visa pushes banks to integrate, because it's 2020, and giving your password for your bank to a third party, when there are APIs and OAuth/OpenID protocols available for banks.
- sithlord 7y agopretty sure this is false, all my accounts are 2FA, and connected to a few different account aggregators (mint, personalcapital, etc) which i am prettty sure all use Plaid. Handles it fine.
- maccam94 7y agoMint does not use Plaid, they have an in-house integrations system.
- avip 7y agoIn house by intuit
- thamer 7y agoMy Wells Fargo account uses 2FA, and recently (November 2019) I was unable to connect a service to it through Plaid, getting an error that said my account type was not supported – or something along those lines. They may have fixed it by now, I haven't tried more recently.
- dude3 7y agoYou can remove 2FA, login with Plaid, and re add it. This worked for me.
- thamer 7y agoI'm already uneasy with the way Plaid works, I'm not also going to disable 2FA on my account to accommodate the broken way they access accounts (pretending to be a browser instead of using APIs). There are good, secure ways to grant access to resources, and giving your password to Plaid for them to log in to your account with reduced security is definitely not one of them and certainly not an attractive proposition.
- nikolay 7y agoWorst of all, it's a full access, not a scope-restricted one. Imagine somebody hacking Plaid and you disabling 2FA, because otherwise you can't use some of the fancy new services you saw on Product Hunt.
- fulldecent2 7y agoWorst of all, is their privacy policy. > We retain information we collect about you for as long as necessary to fulfill the purposes for which we collected it, unless a longer retention period is required OR PERMITTED under applicable law. It is not necessary to "hack" Plaid.
- angry_octet 7y agoYeah, it's the users who got hacked when they signed up.
- choopchik 7y agoIt's all in the way Plaid connects to the banks - they do not systematically support MFA in their bank connectors; hence the issues you are seeing.
- nikolay 7y ago
- nikolay 7y agoSo, you call me a liar? I have personal, my own business, and several accounts of a nonprofit I am an officer at. All have 2FA and none work. Intuit is a different story and I'm able to sync in bank transactions into it - not with Plaid-based services though!
- rntksi 7y agoI feel sorry you had to go through those replies telling you your statements were false or wrong. I think it comes from people who think that if it works for them, it must work for everyone else.
- nikolay 7y agoYeah, I thought I'm imagining things, tried again, and this is what they say about BofA: https://ibb.co/KGMhFXF https://ibb.co/KGMhFXF
- deleted 7y ago[deleted]
- kccqzy 7y agoMint uses its own system I think. Personal Capital uses Yodlee.
- blensor 7y agoAre there any APIs out there that show the separate amounts a counter credit is made out of (for Bank of America accounts)? We wanted to use it for importing transactions into our system but if several checks are deposited at once the amount would have to ne split manually as it comes in as one transaction.
- nikolay 7y agoI am not familiar with their API - possibly it's a crappy one, but I had one integration in the past (can't recall) and there's an area in your profile for authorized apps. I've done Wells Fargo integration, too.
- zelly 7y agoThe way Plaid works, I'm surprised that they hadn't already been shut down for breaking banks' TOS. It exposes the banks to so much liability for a product that's not even theirs.
- nikolay 7y agoWorst is their suggestions to disable 2FA! I twitted to them about it, and they seem to have removed it after that!
- orthecreedence 7y agoWells Fargo's 2FA uses SMS. Hardly worth enabling.
- josh2600 7y agoI don’t know why you’re being downvoted. Sms 2FA is not safe, full stop.
- ericleung 7y agoSure, SMS-based 2FA is not nearly as secure as other forms of 2FA. But unless you're targeted, SMS-based 2FA still helps add a layer of security against other issues like password re-use. Of course none of us do that either, but for the general public, I'd rather support SMS-based 2FA across the board than nothing at all.
- blackearl 7y agoFor the average Joe it's good enough, no one is SIM swapping Bob who works at Walmart
- nikolay 7y agoThat's default, but you can buy an RSA hardware token.
- 7y ago
- brogrammernot 7y agoNot even close to true. We’re one of the larger clients with Plaid and that’s not on Plaid but the service provider to not provide a manual entry. Plaid works great and we’ve ran into next to no issues with customers linking Plaid
- nikolay 7y agoSo, I'm imagining their errors and suggestions to turn off 2FA?
- brogrammernot 7y agoI need to go back and check, we might be in one of their test groups as I haven’t heard any issues with 2FA. We do a catch-all and based on the error, we prompt the user to manually provide their banking info to proceed. Worth noting I don’t work for a financial services company so the use case is likely very different than the services you’re discussing. Apologies if I came off strong, it appears I may be a one-off consumer as opposed to mainstream.
- ztratar 7y agoIt's actually pretty rare to not run into issues with Plaid. It depends on your customers, too. If you're targeting consumers, Plaid's integration works far better than if you're targeting business bank accounts.
- fulldecent2 7y agoNo issues with customers linking Plaid. If your company is ONLY supporting Plaid then your issue is that your smarter customers are leaving.
- staplers 7y agoI can confirm this. I really want to use the trading platform Gemini but will never cave to Plaid. Any organization that asks for your personal password is nefariously normalizing this behavior and building complacency in consumers to trust anyone with their private information.
- twblalock 7y agoThis is why I never wanted to use Mint, although maybe Mint is better about this now. I've also seen online mortgage applications ask for banking and retirement account passwords for the purpose of automated form-filling. It seems very shortsighted to give away your password to save 5 minutes filling out a form. The nightmare scenario is that you give your bank account password to one of these screen scraping services, someone manages to hack them and empties your account, and you can't get the money back because giving away your password violates the terms of service for your online banking.
- nikolay 7y agoI don't have issues with Mint. As somebody suggested, Intuit has the privilege of having a different level of access unlike Plaid - maybe due to the importance of QuickBooks to both individuals and businesses.
- usrusr 7y agoThe cynical part of me is convinced that banks would want to secretly run and popularize this kind of service as honeypots for collecting passwords sharing violations as a future liability defense.
- ceejayoz 7y agoThat’d probably risk a counter-suit for willful negligence.
- pininja 7y agoMint used to sync with Chase and Wells Fargo through sketchy scraping, but those banks have since then integrated with Mint over APIs. Mint then disabled syncing until customers reestablished the connection with the new, more secure, method (which I thought was a good move)
- billatq 7y agoFor a while they were using Yodlee for the backend (which did all sorts of weird stuff), but I think they rewrote it after Intuit bought them.
- judge2020 7y ago> and does not work if you have 2FA enabled Certainly false, at least for Bank Of America. Just yesterday I connected BofA to privacy.com using Plaid and it asked me to enter the SMS 2fa code.
- nikolay 7y agoIt works only once as they relay the code for verifying account numbers. But it doesn't always work (both with BofA and Wells Fargo) and certainly not for continuous pulling of data.
- angry_octet 7y agoWhich is how 2FA is supposed to work. Perhaps they try to keep the session from timing out, but that is bound to break. The solution is regulation to force Banks to provide customer data over an API to an authorized third party (preferably with 2FA on that too, and other security mechanisms, like mutual auth, auditing the security and probity of the subscriber etc). Scraping is such a 1990s solution, and Plaid's Uber-like disregard for rules made it a non-starter for anyone sensible. Ironically, while it might get systematic integration with VISA, the privacy implications are far worse.
- nikolay 7y agoIt doesn't - I tried again just to see if I was imagining things: https://ibb.co/KGMhFXF https://ibb.co/KGMhFXF
- ianhawes 7y agoBoth Bank of America and Wells Fargo do technically have APIs, though they're limited in scope to corporate accounts for treasury purposes. I've applied for access to both and both declined to even a sandbox account.
- bloodm 7y agoThink what you want about the EU, but sometimes they have good initiatives. https://www.eu-startups.com/2019/09/open-banking-and-what-it-means-for-european-fintechs-and-consumers-part-1/ https://www.eu-startups.com/2019/09/open-banking-and-what-it...
- Nextgrid 7y agoThis is a sham. You need to go through lots of audits & other administrative BS in order to be declared an "AISP" even if you don't actually process banking data yourself and it never leaves the user's device. Imagine PCI-DSS compliance but without the exception that you don't have to be PCI-compliant yourself if you don't touch card data and pass it directly to a PCI-compliant payment processor.
- jiofih 7y agoIt might look dreary to you from a distance, but for us on the ground, it is working. My bank is already offering to show any other banks’ statements along my accounts.
- Tankenstein 7y agoIt's only working for large, existing players, is his point. For me wanting to build automatic syncing to my budget tools, I'm still out of luck. They don't even let you access your own data.
- jiofih 7y agoThat’s kind of expected, isn’t it? An integration you make could be potentially used/abused by others and must be thoroughly vetted. For personal use my bank offers daily CSV downloads.
- slim 7y agoyou can't rely on third party api for your business. IMHO scraping is the way to go
- thenewnewguy 7y ago> does not work if you have 2FA enabled Plaid definitely works with BoA + 2FA, at least as of about a month ago when I had to use it.
- nikolay 7y agoJust tried again as I don't wanna be accused of making things up: https://ibb.co/KGMhFXF https://ibb.co/KGMhFXF
- thenewnewguy 7y agoWhat type of 2FA are you using? I have the default (SMS based) and it works for me.
- nikolay 7y agoSame.
- thenewnewguy 7y agoAre you trying to use a business account or something? Otherwise I have no clue.
- nikolay 7y agoI have both a personal and a business account, but the login is the same, and they fail at the login level, not after I'm authenticated. One cannot tell what sort of accounts are behind the account before you successfully log in.
- thenewnewguy 7y agoI have no idea then, it's worked for me in the past - Plaid asks me to give them the 2FA auth code I receive via text.
- JensRantil 7y agoI work for a popular european competitor of Plaid, Tink (https://tink.com https://tink.com). We don't do screen scraping, but use the banks' own APIs. These days we also ride on the european bank directive "PSD2" which gives us the right to aggregate financial data from financial providers such as banks. That means we aren't breaking an Terms of Services with banks! ...and yes, we support 2FA. ;)
- mritchie712 7y agodoes Plaid actually "screen scrape" though? I thought they did the same thing (use the banks API's)
- JensRantil 7y agoApparently they don't seem to do it with all their integrations at least: https://www.insider.com/jpmorgan-announces-partnership-with-plaid-2018-10?utm_source=reddit.com https://www.insider.com/jpmorgan-announces-partnership-with-...
- colourgarden 7y agoNote that a SSL_ERROR_BAD_CERT_DOMAIN is shown when trying to access tink.com at the moment. Says the certificate is only valid for cloudfront.net. Edit: the website itself also returns a 403.
- JensRantil 7y agoWeird. Works for me now. ¯\_(ツ)_/¯
- mst 7y agoLancaster, England, Windows 10, Firefox, working perfectly for me as well.
- duiker101 7y agoVery cool! Maybe you could enlighten me as to why it seems that no one support Transferwise? They have an API but all this services snub them
- Dirlewanger 7y agoPlaid's better than using Finicity, which is even worse.
- mwexler 7y agoFinicity is actually the old Intuit screen scraping tech. It's been around almost as long as Yodlee. Not to impugn legacy tech or anything, but I suspect there's some cleanup to do there.
- nikolay 7y agoWhat's funny is that I can link accounts with Betterment, which uses Quovo, which got acquired by Plaid, but I can't with Plaid itself!
- jermaustin1 7y agoI'm surprised they still scrape Bank of America. A few months back (maybe a year), when they really pushed their API integration over scraping, a bunch of services (QuickBooks, Mint, Privacy) required me to reauth on my BofA accounts. I assumed this was because they were switching over to their API, and that was the only way to pull data now. I could be wrong, it just seems weird that 3 different sites made me reauthenticate within a month or so.
- mwexler 7y agoIn many cases, if the APIs are available _and support all the necessary features_, Plaid will work with the bank to use the APIs. Banks have chosen to withhold some info from the APIs that are available on the site, which prevents a full switchover. The other problem, of course, is the payment model: should Plaid pay banks for access to the data? Should banks have to make the APIs as fully featured as their site for external consumption? Also worth noting that the largest of US banks do offer APIs, but a large swath of the rest do not, either due to proprietary systems, choosing not to use their processor-offered solutions, or simply avoiding risk. So, Plaid will have to scrape for another few years, I suspect, until the banks catch up in the US to what we are seeing in UK and other places.
- bicx 7y agoYou can now enter manual account and routing numbers with Plaid and they will handle micro-deposit verification. They also now support 2FA for many banks. Plaid is definitely not great in some areas, but there really isn't a good alternative if you want to aggregate your banking and transaction data. Not in the U.S. Very few banks have publicly-accessible APIs, and when they do, they likely won't return consistent data. There simply isn't a standard in the U.S. There are literally thousands of banking systems in this country. As someone who helps run a fintech app, I can assure you there are significant numbers of people who are simply members of their local credit union with very limited technology.
- compuguy 7y agoI'm not a fan of how Plaid works either, but short of pushing for legislation mandating API for all banks, I doubt it will happen in the short term...