4 ms·
I’ve been asked to sign up to plaid by clients three times. Each time I’ve said no. I’m not giving a 3rd party access to my bank account. I don’t understand ho
by binarymax 5mo ago
I’ve been asked to sign up to plaid by clients three times. Each time I’ve said no. I’m not giving a 3rd party access to my bank account. I don’t understand how people enable this total loss of friction for direct account egress. There needs to be friction.
- chao- 5mo agoRefinancing a loan I passed on the lowest possible rate I could get, for a slightly higher one, specifically because they used Plaid. I'm not the most privacy-focused individual, not nearly as paranoid as I could be, but Plaid's model is an OBVIOUS step too far.
- njovin 5mo agoDepending on the rate difference, I'd be tempted to setup a 'burner' checking account at a separate financial institution and just auto-transfer the loan amount from my primary bank to the burner every month.
- lazide 5mo agoThat generally wouldn’t pass underwriting. They want the account the money is coming from to be the account with history and money in it already.
- el_benhameen 5mo agoReally? Both times I got a loan they wanted bank statements from all of my main accounts and verifiable income history, but they didn’t care that I was paying from an account that I had just opened for the specific purpose of paying the loan.
- volkk 5mo agosame. maybe it just depends on the bank, but i can't imagine why that would matter at all. they have the whole picture of your financial history, generally. what does it matter whether that one bank account has only enough in it to pay off the loan every month.
- phil21 5mo agoI'm not OP, but I assumed from their post that they meant the loan provider wanted Plaid access in order to perform underwriting - as in give us access to your account(s) so we can pull your banking history via an automated manner instead of sending PDFs. Could be wrong though, as I never considered it'd be used for payments at all.
- saratogacx 5mo agoMy bank's underwriter/loan officer actually said to get the best rate with them to specifically setup an account with them (They aren't my day to day bank) and just use it for my house payment. For the past decade the only transactions it has ever seen has been the direct deposit and the auto-withdraw for the mortgage.
- shostack 5mo agoBMO offered the ability to link plaid and some other company to automate it vs me sending updated statements manually. I chose manual. I hate that this is the only option for convenience.
- deleted 5mo ago[deleted]
- josephscott 5mo agoOne thousand times this. I am not giving away the keys to my bank accounts.
- lxgr 5mo agoIt’s worse than keys, it’s a persistent read-only view of all account data. At least there is a process for unauthorized ACH debits. For this blatant breach of privacy, there is nothing.
- robhlt 5mo agoPlaid requires your bank username and password, so they have full read-write access to your account. They can do anything you can do when logged in to the bank's website, and so can anyone else who gains access to Plaid's database.
- lxgr 5mo ago> They can do anything you can do when logged in to the bank's website Which is hopefully nothing beyond looking at transaction data without 2FA.
- robhlt 5mo agoPlaid's login flow also requires a 2FA code if your bank requires it. The same 2FA code that banks say to never provide to anyone else. They're literally proxying the bank's login page just like a phishing site would, and I assume they're also selecting the "trust this computer" option so their access is more persistent. My bank does require re-2FA for larger transfers, but there's still a lot of damage I can do on a "trusted" computer without triggering another 2FA prompt.
- lxgr 5mo agoTo be honest, that's on the bank then. Doing re-2FA for every outbound transfer, and mentioning the consequences of entering the 2FA code out of band (e.g. "enter code 123456 to confirm transfer of x$ to y" or "press OK to confirm transfer..." in a mobile app) should be the bare minimum these days.
- hypeatei 5mo agoHave you ever entered your routing+account number into HR software for direct deposit? Doesn't that qualify as handing a third party essentially the same access as Plaid gets? I think bank accounts are generally more accessible in the modern era, it's just a risk that you take. Of course, you're not obligated to use Plaid but I do find the concerns around this quite strange since you're likely exposing account information already.
- liveoneggs 5mo agoplaid asks for your bank username and password not just your routing + account
- whycombinetor 5mo agoPlaid wants you to enter your bank username-password into their form. If it was just routing+account it would be truly no different than other bank connection methods.
- formerly_proven 5mo agoPlaid works a lot like PSD2-based services in the EU then, which also typically consist of a form hosted by the service using Times New Roman and the original padlock.gif from Netscape asking for your IBAN and online banking password and then a TAN/2FA number. Obviously there are no technical controls at that point to what the service can do in your account. I tend to avoid anything PSD2 for much the same reasons as Plaid, it's extremely sketchy. Somehow we can have scoped access using OAuth for random webservices but for a credit check it's "please just give us your online banking login despite everyone telling you since 1995 that you're not supposed to hand that to anyone and always double check the URL in the address bar to be yourbank.com... we assure you nl-gwlogin.xs2a.openbankingservices.co.net is an entirely legitimate place to enter your PIN"
- lxgr 5mo agoAt this point, it's often OAuth, but in my view, the exact means of access is a red herring: The only thing that changes between screen scraping and OAuth is that Plaid doesn't get my banking password, which is literally the least of my concern compared to persistent access to my account transactional data.
- webo 5mo agoHijacking this comment to complain about fintech apps / saas providers requiring Plaid - please stop. For example, Coinbase requires logging in with Plaid to... setup auto-pay for their credit card statements. No way to just provide account/routing numbers the good ole way. There's lots of issues with Plaid but one big one is that banks (e.g big ones like BofA) can lock your account due to suspicious login with Plaid. https://x.com/kanateven/status/1973793740331368841 https://x.com/kanateven/status/1973793740331368841
- measurablefunc 5mo agoThey're a YC company so every other YC company is going to use them, that's how YC companies operate.
- webo 5mo agoPlaid has an option to let the client/provider accept plain account + routing numbers, a lot of apps for whatever purpose don't use it.
- necubi 5mo agoThis isn't at all how YC companies operate (source: I did YC), but also... Plaid is not YC.
- measurablefunc 5mo agoSeems kinda weird then that they're listed in workatastartup.com: https://www.workatastartup.com/jobs/15283 https://www.workatastartup.com/jobs/15283
- andsoitis 5mo agoPlaid is not a YC company. You can just google it to confirm.
- measurablefunc 5mo ago
- lxgr 5mo agoThey do because their banks are largely not offering anything more fine grained, because they don’t have to, and in fact doing so would cannibalize their debit card business. Requesting full account access for anything other than maybe budgeting software should just not be legal.
- asah 5mo agoeasy - just keep a small amount (small %) in that account.
- wilg 5mo agoMany banks just OAuth with Plaid now.
- lxgr 5mo agoBut what comes after? Can users decline or at least downgrade the level of access requested by whoever wants to peek into their bank account? Do banks clearly indicate (and periodically remind the user about!) all parties currently having access to their account? It's usually still persistent full access, and given that, the question of whether the user's password also leaks in the process is almost besides the point.
- _boffin_ 5mo agoWhat a statement. What a statement. How many financial institutions do they support? How many different vendors supply the platform for those institutions? How many of those financal institutions (FI) don’t support oauth or other APIs? A lot! Then ask yourself: how do they talk get the data if no api? Web scraping. Then ask yourself how they build the scrapers for those? Where do those accounts come. Employees of the company who open up accounts at those FIs? What about all the other FIs? Where do you think those come from…? How do you think that process is secured? Think the process is secured enough to make you feel warm and cozy? When the scrapers are working, how do you think they get past the security measures? Do you think those financial institutions might think it’s odd that you’re logging in from multiple IPs and that one or more of those ips might be from a residential proxy network? The result is that I attempt, at all cost to not use anything that requires plaid or their competitors since I know how that sausage is made.
- rurp 5mo agoI was repeatedly pressured to hand my bank account logins over to plaid when I bought a house. People always seemed surprised when I refused. Maybe they were just acting that way to pressure me into making their sale process slightly easier, but I got the impression most people just go along with it. Handing my finances over to a company like that is a hard no for me, I can't imagine ever doing business with someone who required it.
- claw-el 5mo agoWhile I understand the risk of sharing sensitive information (e.g. bank login) with a 3rd party. But the current situation is such that your bank currently monopolize your bank information to improve your loan offer, to give you better service at better rate based on their understanding of your bank transaction history. Currently, there is no aligned format for sharing your bank transaction history with other financial institution of your choice. Your current bank is the one who purposely makes it hard (only allowing you to share it through the same bank login) so that you are more locked-in in their eco system. I used to work with Plaid as a provider, and you will notice certain banks who really do not like their customers using Plaid in sharing their bank transaction history with competitors will often have unscheduled maintenance that Plaid wouldn’t work so that you as a user would find friction using someone else and stay with only using products within their ecosystem. I think the real question is less about why are we using Plaid to share our transaction information. If we are to have an open format to share our banking transaction history, what should be that format and what would be the lock and key for it?
- diroussel 5mo agoMaybe the mechanism for sharing could be inspired by OpenBanking? In the UK and EU all the banks have to offer API access to accounts. Instant transfer (sub-second) for free is available to everyone. (Up to a certain limit)