14 ms·

They are getting sued by TD Bank for this very reason: > The bank said in the court filings that the interface "dupes" consumers into believing they are enteri

They are getting sued by TD Bank for this very reason: > The bank said in the court filings that the interface "dupes" consumers into believing they are entering personal information into TD Bank's trusted platform. > "In reality, however, consumers are unwittingly giving their login credentials to the defendant, who takes the information, stores it on its servers, and uses it to mine consumers' bank records for valuable data (e.g., transaction histories, loans, etc.), which the defendant monetizes by selling to third parties," TD claimed in the court records. https://www.ctvnews.ca/business/td-bank-files-lawsuit-against-plaid-accusing-it-of-trying-to-dupe-consumers-1.5145326 https://www.ctvnews.ca/business/td-bank-files-lawsuit-agains... Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your money stolen, you may find out that the zero liability policy no longer applies to you.

xtracto 6y ago
That´s interesting, and it is an important "stick". On the other side, I know some banks are giving a "carrot" to these types of companies by providing a "portal access" that allows these companies to connect their customers with their bank accounts so that the customer can select what to share with these sites. Of course, once those portals are enabled we enter the Facebook game: Where a lot of customers will blindly give all access to Plaid like companies, and then consumer group advocates will criticize for the amount of information that they are (still) mining from ignoring customers.
- morpheuskafka 6y ago
  I think BofA does this, which I like. When I linked my account to Robinhood through Plaid, it asked for 2FA (text or phone call, BofA doesn't support TOTP codes) and verified in, then asked me to select which accounts to grant access to. Since it doesn't need the 2FA subsequently, it must be doing some kind of OAuth style authentication when it passes that token to the bank and then gets a long-term access token for that specific account. From an HTTPS perspective this is still pretty concerning though. AFAIK browsers would block the Plaid widget if someone tried to load it insecurely and the page was HTTPS (what users have been trained to look for). But without going into devtools there is no easy way to verify that the widget is actually a real Plaid widget, thus POSTing your password directly to their server and not the merchant's, and no way at all to verify that they have such a partnership with your bank sanctioning them to collect your password.
- tadfisher 6y ago
  This is essentially the core thesis of MX [1], which creates an API exchange that FIs need to join in order to use. I'm not sure how well it is catching on. Seems like they're diversifying more into other whitelabel products for fintech companies. [1]: https://www.mx.com/ https://www.mx.com/
cameldrv 6y ago
It's difficult to draw a clear line between what Plaid is doing and a phishing scam.
- smnrchrds 6y ago
  The difference is the pinky promise that they will not do bad things with their access.
  - cameldrv 6y ago
    They are selling the data to marketing companies to build a dossier on you, and this could be used for any number of purposes once it is in the hands of data brokers. They're tricking people into handing over the information, and then they're using it for purposes that may harm the victim, so like I said, it's hard to draw a line.
    - novok 6y ago
      Dont worry, visa, amex and MasterCard already do it directly
      - dmix 6y ago
        Doing it on purpose vs via black/grey market trickery is often treated as separate matters. Even if the legal mode is still full of moral issues that society has yet to fully confront. Phishing people's bank credentials has been fully established as a computer crime (not even just bad within civil law).
        Judgmentality 6y ago
        I adore the idea of the Plaid founders, and everyone else deemed complicit in a court of law (I think this should likely include investors), going to fuck-you-in-the-ass prison instead of becoming billionaires. Alas, I've lived in Silicon Valley too long to believe that anything moral will ever occur when there's money to be made. It makes me sad that people actually admire this place for anything other than the geography.
morpheuskafka 6y ago
> Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your money stolen, you may find out that the zero liability policy no longer applies to you. The trouble is, giving someone your account number also makes it not the bank's problem what they do with that number, even if it was clearly unauthorized by you. There's no good way to do ACH transfers without a high degree of trust in the recipient.
- judge2020 6y ago
  Yeah, banks could have done oauth2 years ago but it never happened.
  - viraptor 6y ago
    That's what OFX was supposed to provide, but realistic support never arrived. Even banks which allow you to download OFX format searches fail at complying with basics of the standard. (https://www.ofx.net/ https://www.ofx.net/)
  - Nursie 6y ago
    Open Banking in the UK does that now.
    - Nextgrid 6y ago
      Not really, considering it doesn't enforce a single, consistent API, so most companies will still use something like TrueLayer (our local equivalent of Plaid) to aggregate all these separate APIs into a single consistent one. Furthermore, "open" banking is very misleading because it's only open to corporations with deep pockets to obtain an AISP license/certification*, but doesn't even allow the account holder to gain API access to their own account. Unless you're lucky enough to be with a modern bank that provides that as a feature (which is legally separate from Open Banking, though often it's the same API), your only workaround is to sign up for TrueLayer yourself just to access your own account through them. * given the "deep pockets" requirement, it almost forces all the account aggregator apps/services (Emma, Yolt, etc) to have a somewhat scummy business model and monetize the captured data. Wouldn't it have been nicer that you didn't need deep pockets to gain read-only access, so that an indie developer could make such an account aggregator and not have to resort to a scummy business model to fund the certification/compliance expenses?
throwaway9980 6y ago
I am sure I will be called naive, but this is shocking to me. I assumed that Plaid was integrating with the banks and not doing this sort of thing because of the people associated with Plaid. Their seed round included Spark Capital and Google Ventures. Their most recent round included Mary Meeker and Andreessen Horowitz. [1] These investors have reputations to protect. This type of thing would certainly come out in diligence: "How do you gain access to the customer's account data with their bank?" "We impersonate their bank." "Do you tell them you do this?" "No." "Ok, that's probably fine." How in the hell does this conversation pass muster? [1] https://en.wikipedia.org/wiki/Plaid_(company)#Funding https://en.wikipedia.org/wiki/Plaid_(company)#Funding
- purple_ferret 6y ago
  A lot of these banks never had any APIs. Plaid made its name basically scrapping the html of account pages. Companies used it because there were no alternatives (no apis)
  - throwaway9980 6y ago
    I understand the situation. Another of Plaid's investors is Goldman Sachs. I naively assumed that Plaid's ability to build their product was likely based on access to private APIs available to them based on their relationships and backing. If someone came to me and asked me to build what Plaid has built, I would decline the work. I would assume that impersonating a bank would be illegal. I would assume that the banks I am impersonating would treat me as a malicious actor. I would assume that I would go to jail for building a system like this. Absolutely unbelievable.
    - f430 6y ago
      Back when I used to run a web scraping shop, we had this exact request. I didn't know it was illegal at the time but we ultimately didn't do it because lot of people just want to pay as little as possible for scraping without considering the amount of work that goes behind it.
f430 6y ago
Oh man I can't believe they actually pulled this on a Canadian Bank. I tell my founders to always always fly straight or don't fly at all because if you cut corners or deceive, it will come back to you. Had they been honest and played by the rules they could be sitting on a massive windfall. Unfortunately, some VCs and founders think like gangsters and get surprised when things dont plan out. Just because it worked for someone in your circle doesn't mean its gonna work for you. It is a horrible behavior to emulate.
- smnrchrds 6y ago
  Yeah. TD is so tired of them they have a page warning customers about them, without naming names: > When using a fintech app, you may be providing your confidential TD username and password directly to third parties over whom TD has no control. Please be aware that the sharing of your TD credentials is contrary to the terms of our agreements, and TD will not be responsible for any harm that results from the sharing of your credentials. https://www.td.com/us/en/personal-banking/security-center/fintech-app-data-risks/ https://www.td.com/us/en/personal-banking/security-center/fi...
  - toomuchtodo 6y ago
    TD should force a password reset every time a login occurs from Plaid on behalf of a user.
- milesskorpen 6y ago
  The deal didn't go through because of antitrust concerns, not because of TD's lawsuit.
WesolyKubeczek 6y ago
> takes the information, stores it on its servers, and uses it So does, for example, Yodlee, when you use them to have an API for bank statements. I cannot say if they too monetize the data that opens up to them for grabs. It took legislation and years of preparation to enforce APIs and interoperability onto European banks (yes, I can now use bank A's app to view my account balance in bank B, while maintaining control over what kind of access I'm giving). Can't see it happening in the US, though, although the demand for such APIs is clearly there, given that companies like Plaid and Yodlee prosper.
- RC_ITR 6y ago
  Yodlee literally sells the data directly to hedge funds. https://www.thetrustedinsight.com/investment-news/yodlee-jumpshot-data-problems-impact-on-hedge-funds-other-data-providers-20200304832/ https://www.thetrustedinsight.com/investment-news/yodlee-jum...
- tadfisher 6y ago
  I would wager that 90% of the business for Plaid, Yodlee, and Intuit is account verification; the thing that you used to do by having small ACH transfers of random amounts that you verify. The fact is that 90% of running a fintech business is identifying and bounding fraud risk, and these "banking API" companies are able to move the needle down a couple of basis points. edit It's shit like this that just screams for the Fed to force FIs to implement a standard API for verifying accounts and making transfers. I bet half of fintech would collapse overnight, but the collective cost savings would be in the billions.
krisboyz781 6y ago
No, that's not the problem at all. The problem is that Plaid falsely used TD Bank without having a relationship with the bank. The company literally has a bank partnerships team so that "void warranty" argument doesn't even make sense.
deleted 6y ago
[deleted]
cosmie 6y ago
> Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. Funny enough, I've seen that be the case at some banks that simultaneously integrate Plaid into their online account application flow for the initial/funding deposit but. Pretty ironic that users are implicitly coerced into voiding their liability protection at their existing bank during the course of opening an account at a new one. Who wouldn't hesitate to turn around and also invalidate your liability protections themselves if you used your new bank's credentials with Plaid elsewhere.
ehnto 6y ago
Good god that's disgusting behavior. Surely VISA would have seen this as a huge risk?

xtracto 6y ago

That´s interesting, and it is an important "stick". On the other side, I know some banks are giving a "carrot" to these types of companies by providing a "portal access" that allows these companies to connect their customers with their bank accounts so that the customer can select what to share with these sites. Of course, once those portals are enabled we enter the Facebook game: Where a lot of customers will blindly give all access to Plaid like companies, and then consumer group advocates will criticize for the amount of information that they are (still) mining from ignoring customers.

morpheuskafka 6y ago
I think BofA does this, which I like. When I linked my account to Robinhood through Plaid, it asked for 2FA (text or phone call, BofA doesn't support TOTP codes) and verified in, then asked me to select which accounts to grant access to. Since it doesn't need the 2FA subsequently, it must be doing some kind of OAuth style authentication when it passes that token to the bank and then gets a long-term access token for that specific account. From an HTTPS perspective this is still pretty concerning though. AFAIK browsers would block the Plaid widget if someone tried to load it insecurely and the page was HTTPS (what users have been trained to look for). But without going into devtools there is no easy way to verify that the widget is actually a real Plaid widget, thus POSTing your password directly to their server and not the merchant's, and no way at all to verify that they have such a partnership with your bank sanctioning them to collect your password.
tadfisher 6y ago
This is essentially the core thesis of MX [1], which creates an API exchange that FIs need to join in order to use. I'm not sure how well it is catching on. Seems like they're diversifying more into other whitelabel products for fintech companies. [1]: https://www.mx.com/ https://www.mx.com/

cameldrv 6y ago

It's difficult to draw a clear line between what Plaid is doing and a phishing scam.

smnrchrds 6y ago
The difference is the pinky promise that they will not do bad things with their access.
- cameldrv 6y ago
  They are selling the data to marketing companies to build a dossier on you, and this could be used for any number of purposes once it is in the hands of data brokers. They're tricking people into handing over the information, and then they're using it for purposes that may harm the victim, so like I said, it's hard to draw a line.
  - novok 6y ago
    Dont worry, visa, amex and MasterCard already do it directly
    - dmix 6y ago
      Doing it on purpose vs via black/grey market trickery is often treated as separate matters. Even if the legal mode is still full of moral issues that society has yet to fully confront. Phishing people's bank credentials has been fully established as a computer crime (not even just bad within civil law).
      - Judgmentality 6y ago
        I adore the idea of the Plaid founders, and everyone else deemed complicit in a court of law (I think this should likely include investors), going to fuck-you-in-the-ass prison instead of becoming billionaires. Alas, I've lived in Silicon Valley too long to believe that anything moral will ever occur when there's money to be made. It makes me sad that people actually admire this place for anything other than the geography.

morpheuskafka 6y ago

> Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your money stolen, you may find out that the zero liability policy no longer applies to you. The trouble is, giving someone your account number also makes it not the bank's problem what they do with that number, even if it was clearly unauthorized by you. There's no good way to do ACH transfers without a high degree of trust in the recipient.

judge2020 6y ago
Yeah, banks could have done oauth2 years ago but it never happened.
- viraptor 6y ago
  That's what OFX was supposed to provide, but realistic support never arrived. Even banks which allow you to download OFX format searches fail at complying with basics of the standard. (https://www.ofx.net/ https://www.ofx.net/)
- Nursie 6y ago
  Open Banking in the UK does that now.
  - Nextgrid 6y ago
    Not really, considering it doesn't enforce a single, consistent API, so most companies will still use something like TrueLayer (our local equivalent of Plaid) to aggregate all these separate APIs into a single consistent one. Furthermore, "open" banking is very misleading because it's only open to corporations with deep pockets to obtain an AISP license/certification*, but doesn't even allow the account holder to gain API access to their own account. Unless you're lucky enough to be with a modern bank that provides that as a feature (which is legally separate from Open Banking, though often it's the same API), your only workaround is to sign up for TrueLayer yourself just to access your own account through them. * given the "deep pockets" requirement, it almost forces all the account aggregator apps/services (Emma, Yolt, etc) to have a somewhat scummy business model and monetize the captured data. Wouldn't it have been nicer that you didn't need deep pockets to gain read-only access, so that an indie developer could make such an account aggregator and not have to resort to a scummy business model to fund the certification/compliance expenses?

throwaway9980 6y ago

I am sure I will be called naive, but this is shocking to me. I assumed that Plaid was integrating with the banks and not doing this sort of thing because of the people associated with Plaid. Their seed round included Spark Capital and Google Ventures. Their most recent round included Mary Meeker and Andreessen Horowitz. [1] These investors have reputations to protect. This type of thing would certainly come out in diligence: "How do you gain access to the customer's account data with their bank?" "We impersonate their bank." "Do you tell them you do this?" "No." "Ok, that's probably fine." How in the hell does this conversation pass muster? [1] https://en.wikipedia.org/wiki/Plaid_(company)#Funding https://en.wikipedia.org/wiki/Plaid_(company)#Funding

purple_ferret 6y ago
A lot of these banks never had any APIs. Plaid made its name basically scrapping the html of account pages. Companies used it because there were no alternatives (no apis)
- throwaway9980 6y ago
  I understand the situation. Another of Plaid's investors is Goldman Sachs. I naively assumed that Plaid's ability to build their product was likely based on access to private APIs available to them based on their relationships and backing. If someone came to me and asked me to build what Plaid has built, I would decline the work. I would assume that impersonating a bank would be illegal. I would assume that the banks I am impersonating would treat me as a malicious actor. I would assume that I would go to jail for building a system like this. Absolutely unbelievable.
  - f430 6y ago
    Back when I used to run a web scraping shop, we had this exact request. I didn't know it was illegal at the time but we ultimately didn't do it because lot of people just want to pay as little as possible for scraping without considering the amount of work that goes behind it.

f430 6y ago

Oh man I can't believe they actually pulled this on a Canadian Bank. I tell my founders to always always fly straight or don't fly at all because if you cut corners or deceive, it will come back to you. Had they been honest and played by the rules they could be sitting on a massive windfall. Unfortunately, some VCs and founders think like gangsters and get surprised when things dont plan out. Just because it worked for someone in your circle doesn't mean its gonna work for you. It is a horrible behavior to emulate.

smnrchrds 6y ago
Yeah. TD is so tired of them they have a page warning customers about them, without naming names: > When using a fintech app, you may be providing your confidential TD username and password directly to third parties over whom TD has no control. Please be aware that the sharing of your TD credentials is contrary to the terms of our agreements, and TD will not be responsible for any harm that results from the sharing of your credentials. https://www.td.com/us/en/personal-banking/security-center/fintech-app-data-risks/ https://www.td.com/us/en/personal-banking/security-center/fi...
- toomuchtodo 6y ago
  TD should force a password reset every time a login occurs from Plaid on behalf of a user.
milesskorpen 6y ago
The deal didn't go through because of antitrust concerns, not because of TD's lawsuit.

WesolyKubeczek 6y ago

> takes the information, stores it on its servers, and uses it So does, for example, Yodlee, when you use them to have an API for bank statements. I cannot say if they too monetize the data that opens up to them for grabs. It took legislation and years of preparation to enforce APIs and interoperability onto European banks (yes, I can now use bank A's app to view my account balance in bank B, while maintaining control over what kind of access I'm giving). Can't see it happening in the US, though, although the demand for such APIs is clearly there, given that companies like Plaid and Yodlee prosper.

RC_ITR 6y ago
Yodlee literally sells the data directly to hedge funds. https://www.thetrustedinsight.com/investment-news/yodlee-jumpshot-data-problems-impact-on-hedge-funds-other-data-providers-20200304832/ https://www.thetrustedinsight.com/investment-news/yodlee-jum...
tadfisher 6y ago
I would wager that 90% of the business for Plaid, Yodlee, and Intuit is account verification; the thing that you used to do by having small ACH transfers of random amounts that you verify. The fact is that 90% of running a fintech business is identifying and bounding fraud risk, and these "banking API" companies are able to move the needle down a couple of basis points. edit It's shit like this that just screams for the Fed to force FIs to implement a standard API for verifying accounts and making transfers. I bet half of fintech would collapse overnight, but the collective cost savings would be in the billions.

krisboyz781 6y ago

No, that's not the problem at all. The problem is that Plaid falsely used TD Bank without having a relationship with the bank. The company literally has a bank partnerships team so that "void warranty" argument doesn't even make sense.

deleted 6y ago

[deleted]

cosmie 6y ago

> Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. Funny enough, I've seen that be the case at some banks that simultaneously integrate Plaid into their online account application flow for the initial/funding deposit but. Pretty ironic that users are implicitly coerced into voiding their liability protection at their existing bank during the course of opening an account at a new one. Who wouldn't hesitate to turn around and also invalidate your liability protections themselves if you used your new bank's credentials with Plaid elsewhere.

ehnto 6y ago

Good god that's disgusting behavior. Surely VISA would have seen this as a huge risk?