6 ms·

> Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your mon

> Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your money stolen, you may find out that the zero liability policy no longer applies to you. The trouble is, giving someone your account number also makes it not the bank's problem what they do with that number, even if it was clearly unauthorized by you. There's no good way to do ACH transfers without a high degree of trust in the recipient.

judge2020 6y ago
Yeah, banks could have done oauth2 years ago but it never happened.
- viraptor 6y ago
  That's what OFX was supposed to provide, but realistic support never arrived. Even banks which allow you to download OFX format searches fail at complying with basics of the standard. (https://www.ofx.net/ https://www.ofx.net/)
- Nursie 6y ago
  Open Banking in the UK does that now.
  - Nextgrid 6y ago
    Not really, considering it doesn't enforce a single, consistent API, so most companies will still use something like TrueLayer (our local equivalent of Plaid) to aggregate all these separate APIs into a single consistent one. Furthermore, "open" banking is very misleading because it's only open to corporations with deep pockets to obtain an AISP license/certification*, but doesn't even allow the account holder to gain API access to their own account. Unless you're lucky enough to be with a modern bank that provides that as a feature (which is legally separate from Open Banking, though often it's the same API), your only workaround is to sign up for TrueLayer yourself just to access your own account through them. * given the "deep pockets" requirement, it almost forces all the account aggregator apps/services (Emma, Yolt, etc) to have a somewhat scummy business model and monetize the captured data. Wouldn't it have been nicer that you didn't need deep pockets to gain read-only access, so that an indie developer could make such an account aggregator and not have to resort to a scummy business model to fund the certification/compliance expenses?
    - ethangk 6y ago
      > Not really, considering it doesn't enforce a single, consistent API, so most companies will still use something like TrueLayer (our local equivalent of Plaid) to aggregate all these separate APIs into a single consistent one. That's not quite true. The CMA9 have to follow the Open Banking spec, and some other non-cma9 banks have decided to follow the same spec. In practise, there's some deviation from the spec between the banks (in part, due to ambiguity in the spec), but it's not like they're all pulling their own spec out of the air. > Furthermore, "open" banking is very misleading because it's only open to corporations with deep pockets to obtain an AISP license/certification*, but doesn't even allow the account holder to gain API access to their own account. Unless you're lucky enough to be with a modern bank that provides that as a feature (which is legally separate from Open Banking, though often it's the same API), your only workaround is to sign up for TrueLayer yourself just to access your own account through them. The 'deep pockets' don't need to be as deep as implied. I think it's <~£3k. It's not something that only big companies can afford, but I agree, it's not something that an individual would use to test out an idea, which would push them towards something like TrueLayer.
      - Nextgrid 6y ago
        > I think it's <~£3k. Do you have any more details? If this is indeed the price and it's a one-time cost without costly maintenance overheads (such as ongoing audits) I might just pay that to be able to release simple money management or just better UIs than the existing banks (even modern bank's apps have gotten worse lately as they try to push their "premium" offerings - looking at Monzo specifically here).
    - Nursie 6y ago
      Yes, it's only 'open' to FCA registered entities, which is an entirely reasonable requirement given how easy it is for scammers to get people to give away the keys to the kingdom. So no, it wouldn't have been nicer, it would have been a scammers delight. And yes, it does require a consistent API, thought it's perhaps open to a bit too much interpretation.
      - 6y ago
thekyle 6y ago
I don't buy this. If I give someone a check (which has an account number on it) that doesn't mean they get to withdraw whatever they want from my bank account. What bank in the U.S. wont reverse fraudulent ACH debits?
- sbeller 6y ago
  handing out your login credentials is like giving a blanko check with your signature on it already. > What bank in the U.S. wont reverse fraudulent ACH debits? If you admit to handing out signed blank checks, I would hope that most if not all banks would at least have a discussion with you about how you may be not the customer they are looking for.
  - deleted 6y ago
    [deleted]
- morpheuskafka 6y ago
  It says on page 35 of my Bank of America Deposit Agreement and Disclosures: > If you voluntarily disclose your account number to another personal orally, electronically, in writing or by other means, you are deemed to authorize each item, including electronic debits, which result from your disclosure. We may pay these items and charge your account. It may be that there is some rule that says just giving someone a check doesn't count as "voluntarily disclosing" your account number.
- alfalfasprout 6y ago
  Actually, if you hand someone a check they indeed can just use your account and routing number to pay for things using ACH. Hence why I avoid ever linking my bank to anything.
- koolba 6y ago
  > What bank in the U.S. wont reverse fraudulent ACH debits? Ah that’s the key though, you have to tell them to reverse it. I think you have 60 days in most cases. But the onus is on you to dispute the debit.
jjeaff 6y ago
You are guaranteed a minimum of 30 days to contest an ACH charge. 2 days for businesses.
- coachtrotz 6y ago
  Return timeframe is 60 days for Unauthorized Debit.

judge2020 6y ago

Yeah, banks could have done oauth2 years ago but it never happened.

viraptor 6y ago
That's what OFX was supposed to provide, but realistic support never arrived. Even banks which allow you to download OFX format searches fail at complying with basics of the standard. (https://www.ofx.net/ https://www.ofx.net/)
Nursie 6y ago
Open Banking in the UK does that now.
- Nextgrid 6y ago
  Not really, considering it doesn't enforce a single, consistent API, so most companies will still use something like TrueLayer (our local equivalent of Plaid) to aggregate all these separate APIs into a single consistent one. Furthermore, "open" banking is very misleading because it's only open to corporations with deep pockets to obtain an AISP license/certification*, but doesn't even allow the account holder to gain API access to their own account. Unless you're lucky enough to be with a modern bank that provides that as a feature (which is legally separate from Open Banking, though often it's the same API), your only workaround is to sign up for TrueLayer yourself just to access your own account through them. * given the "deep pockets" requirement, it almost forces all the account aggregator apps/services (Emma, Yolt, etc) to have a somewhat scummy business model and monetize the captured data. Wouldn't it have been nicer that you didn't need deep pockets to gain read-only access, so that an indie developer could make such an account aggregator and not have to resort to a scummy business model to fund the certification/compliance expenses?
  - ethangk 6y ago
    > Not really, considering it doesn't enforce a single, consistent API, so most companies will still use something like TrueLayer (our local equivalent of Plaid) to aggregate all these separate APIs into a single consistent one. That's not quite true. The CMA9 have to follow the Open Banking spec, and some other non-cma9 banks have decided to follow the same spec. In practise, there's some deviation from the spec between the banks (in part, due to ambiguity in the spec), but it's not like they're all pulling their own spec out of the air. > Furthermore, "open" banking is very misleading because it's only open to corporations with deep pockets to obtain an AISP license/certification*, but doesn't even allow the account holder to gain API access to their own account. Unless you're lucky enough to be with a modern bank that provides that as a feature (which is legally separate from Open Banking, though often it's the same API), your only workaround is to sign up for TrueLayer yourself just to access your own account through them. The 'deep pockets' don't need to be as deep as implied. I think it's <~£3k. It's not something that only big companies can afford, but I agree, it's not something that an individual would use to test out an idea, which would push them towards something like TrueLayer.
    - Nextgrid 6y ago
      > I think it's <~£3k. Do you have any more details? If this is indeed the price and it's a one-time cost without costly maintenance overheads (such as ongoing audits) I might just pay that to be able to release simple money management or just better UIs than the existing banks (even modern bank's apps have gotten worse lately as they try to push their "premium" offerings - looking at Monzo specifically here).
  - Nursie 6y ago
    Yes, it's only 'open' to FCA registered entities, which is an entirely reasonable requirement given how easy it is for scammers to get people to give away the keys to the kingdom. So no, it wouldn't have been nicer, it would have been a scammers delight. And yes, it does require a consistent API, thought it's perhaps open to a bit too much interpretation.
    - 6y ago

thekyle 6y ago

I don't buy this. If I give someone a check (which has an account number on it) that doesn't mean they get to withdraw whatever they want from my bank account. What bank in the U.S. wont reverse fraudulent ACH debits?

sbeller 6y ago
handing out your login credentials is like giving a blanko check with your signature on it already. > What bank in the U.S. wont reverse fraudulent ACH debits? If you admit to handing out signed blank checks, I would hope that most if not all banks would at least have a discussion with you about how you may be not the customer they are looking for.
- deleted 6y ago
  [deleted]
morpheuskafka 6y ago
It says on page 35 of my Bank of America Deposit Agreement and Disclosures: > If you voluntarily disclose your account number to another personal orally, electronically, in writing or by other means, you are deemed to authorize each item, including electronic debits, which result from your disclosure. We may pay these items and charge your account. It may be that there is some rule that says just giving someone a check doesn't count as "voluntarily disclosing" your account number.
alfalfasprout 6y ago
Actually, if you hand someone a check they indeed can just use your account and routing number to pay for things using ACH. Hence why I avoid ever linking my bank to anything.
koolba 6y ago
> What bank in the U.S. wont reverse fraudulent ACH debits? Ah that’s the key though, you have to tell them to reverse it. I think you have 60 days in most cases. But the onus is on you to dispute the debit.

jjeaff 6y ago

You are guaranteed a minimum of 30 days to contest an ACH charge. 2 days for businesses.

coachtrotz 6y ago
Return timeframe is 60 days for Unauthorized Debit.