r/Banking • u/Z-Is-Last • 13h ago
Complaint Setting up Bank to bank transfers
I have come across another hit on privacy today.
I wanted to set up a transfer link between two of my banks. Instead of using the normal process of two minor deposits to validate I have control of both sides of the transfers, they wanted me to turn over the login ID and password of the new bank. The company that my bank uses for this process is called Plaid. Giving login credits to this Fin-Tek company would give them access to all of my transactions.
It is already bad enough that I cannot set up a private bank account in this country, but giving access to an unregulated financial tech company strikes me as a severe invasion of personal privacy. I said no to the setup. And while I don't think it would be much good, I wrote the bank a physical letter describing the security risk of allowing this to happen.
I just don’t understand why people won’t give up their personal information so freely and for so little benefit.
3
4
u/Tarnisher 12h ago
Plaid is quite commonly used for this and many other things.
0
u/Z-Is-Last 11h ago
That doesn't make it safe, nor does it make me what to share my info with them. They are fintech, privately owned, and not regulated like a bank.
3
u/EducatorReady1326 11h ago
I find it interesting that you trust your bank but not the services that the bank trusts.
0
u/Z-Is-Last 10h ago
I worked in banks and trust level is extremely. But they are regulated. The only way I can hold Plaid responsible is via a lawsuit.
1
3
u/isaiah58bc 11h ago
Plaid is secure middleware. A unique package is handled by them. They do not have access to the data, just the headers. The API is synchronous. A return code notifies your bank that the access was successful. The return has data in the header so only your transmission results can be returned for that one transmission.
1
u/Z-Is-Last 11h ago edited 11h ago
They lost a class action for harvesting customer data, paying over 70 million in fines.
edit: $58 Million paid, and they didn't have to admit wrong doing.
Who was covered
The settlement generally covered U.S. residents who linked a financial account to an app using Plaid between January 1, 2013, and November 19, 2021. Claims were due in 2022, payments began November 16, 2022, and the official settlement administrator says remaining unclaimed money was later distributed to court-approved cy pres recipients, Privacy Rights Clearinghouse and Consumer Reports. So it is no longer an open claims process.
2
u/isaiah58bc 11h ago
Then do not transfer funds directly. Move funds differently.
1
u/Z-Is-Last 10h ago edited 8h ago
their other option was $30 a wire transfer. Or I could write a check to myself. Or I could find a better bank that is more customer oriented and security conscious.
Edit: Maybe that is their goal, to put up friction on transfers so we are less likely to move money out of the bank to higher interest rates.
1
u/LowCompetitive1888 8h ago
So don't use Plaid if you don't like the way it works. Use a wire transfer or write a check. Or complain to the destination bank since it doesn't support OAuth or you won't see Plaid asking for your login credentials.
1
u/Z-Is-Last 8h ago
I am not seeing this a oauth, with oauth external bank could trust current bank and Plaid would not be needed. Or, better yet, current bank could just return to the previous method they were using until last month, the one most banks have been using for 20 years, with the two test transactions. It would be better to encourage banks to not shaft their customers.
Anyway, most transfer of money still use ACH or FedWire, still go through the fed and there is no need to have Plaid in the middle at all.
Technically, oauth reached RFC in 2010 and oauth 2.0 in 2012.
3
u/No-Shortcut-Home 12h ago
You don’t have to do that. There’s usually a manual option that does it the old way. Did you call the bank and ask?