From the suit... "Plaid has never adhered to the standard and secure OAuth procedure for the critical process of having consumers log into their bank accounts.

From the suit... "Plaid has never adhered to the standard and secure OAuth procedure for the critical process of having consumers log into their bank accounts. Instead, for the first several years of Plaid’s operations, Plaid arranged for its fintech clients to collect consumers’ bank login information and then pass that information to Plaid, which then approached the banks directly. In or around 2016, Plaid (belatedly, given the security risks) jettisoned this process for one even more beneficial to Plaid. In or around 2016 Plaid implemented a method to mimic the OAuth procedure, but Plaid’s method differs materially from a true OAuth process. Under this current system, Plaid “directly collect[s]” credentials from the consumer. According to Hockey, the goal was not to eliminate the security risk Plaid itself had created, but to “centralize[] that risk” at Plaid." and... "With access to information going back up to five years, Plaid has taken detailed banking information for thousands of transactions for each consumer—3,700 transactions on average— that shows users’ healthcare, educational, social, transportation, childcare, political, saving, budgeting, dining, entertainment, and other habits, with an average of 1,750 unique geolocations to which the transactions were mapped."