And it should be banned by law, It's a security nightmare for users and a major pain in the ass from banks perspective as well (worked in one that was scrapped

And it should be banned by law, It's a security nightmare for users and a major pain in the ass from banks perspective as well (worked in one that was scrapped kind of that way). I'm happy my region is mostly free of those practices and attempts are publicly shamed. PSD2 in EU did a lot of good to push companies to create actual API's to their services as a mandatory requirement. Edit: TLDR: I have simplified a few things, but basically its european "eIDAS" and it seems to work! Currently in Poland there is a "my id" kind of service driven by gov. You can create an account there and manage some of your own data, like send formal message to any office, check your public health procedures history, status of vehicles owned, etc.. It's not perfect, but it's growing. Such account can be verified by our "IRS", for instance. You can also skip verifying the account by logging into that "my id" service using bank account you already have. At least 10 major banks and additional 20 other services allow that. The idea is that they already checked your documents (or verified you in any other way) when creating their accounts. Biggest surprise here is that it actually works. More or less a gift from previous administration. We have a working ID infrastructure that basically anyone can use - owning some kind of account is basically required and the most basic bank accounts are free by law. So anyone using any of those 30+ services (major telecoms, banks, insurance) can authorize with any service that uses "my id". Now you have to be really stubborn to NOT be able to log into gov sites, even without going out of your house at all.