Airbnb requested Plaid access to my entire Chase account and all transactional data to "verify my credit card" a few years ago, and wouldn't budge until I tried Apple Pay, where they apparently weren't able to figure out the underlying issuer and accordingly left me alone.

Needless to say that it was my last stay with Airbnb.

They're a YC company so every other YC company is going to use them, that's how YC companies operate.

Depending on the rate difference, I'd be tempted to setup a 'burner' checking account at a separate financial institution and just auto-transfer the loan amount from my primary bank to the burner every month.

It’s worse than keys, it’s a persistent read-only view of all account data.

At least there is a process for unauthorized ACH debits. For this blatant breach of privacy, there is nothing.

But what comes after? Can users decline or at least downgrade the level of access requested by whoever wants to peek into their bank account? Do banks clearly indicate (and periodically remind the user about!) all parties currently having access to their account?

It's usually still persistent full access, and given that, the question of whether the user's password also leaks in the process is almost besides the point.

If it doesn't look like a real account, you usually won't get whatever you're signing up for.

Plaid wants you to enter your bank username-password into their form. If it was just routing+account it would be truly no different than other bank connection methods.

The same info is also on checks, and there's an established story around fraud there -- if I didn't authorize an ACH withdrawal then my bank is legally required to make me whole. If I hand over my username+password to a third party, I'm on my own.

Also, the routing+account numbers just let them deposit/withdraw money, not snoop on all my transactions and harvest my data...

With plaid they get access to all of your account numbers.

HR just sees a single savings account that I strictly use for direct deposit. They don’t see my actual savings account or my other purpose-specific checking accounts.

Whenever I have seen the Plaid integration it will also ask permission to your transactions. HR software won't get those when I provide it my account & routing numbers.

routing+account numbers are not that sensitive. that's been API for how we transact money since pre-historic times. plaid gets access to your online account with access personal data, security details, documents, transactions, statements, write-access etc.

It’s roughly the difference between giving somebody your phone number and letting them eavesdrop on every single call.

plaid asks for your bank username and password not just your routing + account

Generally no. Plaid access generally includes whatever name you put on the account, as well as transaction history.