Remix.run Logo
dtech 6 days ago

There's no legitimate case for that since PSD2 (mandatory since 2020). Are you not confused by that? PSD2 doesn't share your credentials.

I'm an European and have never needed to use nor encountered those services.

siva7 6 days ago | parent | next [-]

PSD2 is just MFA, it doesn't prevent shady companies still asking your login credentials, even if you must authorize that login from your official banking app. Klarna is one of many examples - they ask me for my bank credentials on their own website so they can crawl all my finance data .

bradfa 6 days ago | parent | next [-]

Plaid and Finicity do this in the USA for some linking of banking to other financial products. Feels SO insecure. Connecting my credit union checking account through Plaid even ironically brought me to a login page which explicitly states I should never give my banking password to any other entity.

If I need to link my accounts and these services are the only choice then I change my banking passwords immediately after.

chrisweekly 6 days ago | parent [-]

I thought Plaid used OAuth2. Hmm.

karel-3d 6 days ago | parent | next [-]

Plaid whole business model is that it uses OAuth2 on banks that support it and export the data through APIs; and for the banks that don't, they ask for name/password and scrape it through "fake" web browser that mimick user behavior on the backend.

(I worked for a Plaid competitor. The long-term goal for all similar companies is of course to use OAuth and APIs, because it breaks less often; but since the banks don't offer that, scraping it is!)

_boffin_ 6 days ago | parent [-]

MX?

cpburns2009 6 days ago | parent | prev [-]

Plaid asks for your raw bank credentials so that it can scrape up data. That's why I've always refused to use it.

WOTERMEON 6 days ago | parent [-]

I really hope to never be in the position where I have to use it

StopDisinfo910 6 days ago | parent | prev | next [-]

I have a Klarna account I opened when their flex account rate was amongst the best you could get and I don't remember them ever asking for my bank credential.

I think Bankin' used to before PSD2 and to get a bit more information from some banks but then again Bankin' is a financial agreggator whose explicit purpose is crawling your banking data so it's not too surprising to see them asking for your credentials.

raisaguys 6 days ago | parent [-]

[dead]

FinnKuhn 5 days ago | parent | prev [-]

So does Paypal nowadays when you want to open a new account...

dcminter 6 days ago | parent | prev [-]

Where a bank doesn't offer compliant APIs, screen-scraping integrations are explicitly allowed. Not sure how common that is at this point.

_boffin_ 6 days ago | parent [-]

Thousands and thousands of institutions, they scrape.

dcminter 6 days ago | parent [-]

Not sure what you mean specifically, but generally the organisations doing screen-scraping¹ would prefer to use compliant APIs as they don't require anything like as much maintenance (bank adds a button to the login flow? Kaboom! Integration is broken...) or resources (e.g. running headless browsers).

Some markets are pretty much exclusively compliant - I don't think there are any Nordic banks that don't have fully PSD2 compliant APIs for example whereas, if I remember rightly, the Spanish banks were all over the place. I'm fairly out of date though, so things may have improved or exceptions for scraping expired.

¹ Note that I'm talking exclusively about banking integrations here, not AI nonsense.