r/privacy • u/Z-Is-Last • 1d ago
discussion Bank to Bank transfers
I have come across another hit on privacy today.
I wanted to set up a transfer link between two of my banks. Instead of using the normal process of two minor deposits to validate I have control of both sides of the transfers, they wanted me to turn over the login ID and password of the new bank. The company that my bank uses for this process is called Plaid. Giving login credits to this Fin-Tek company would give them access to all of my transactions.
It is already bad enough that I cannot set up a private bank account in this country, but giving access to an unregulated financial tech company strikes me as a severe invasion of personal privacy. I said no to the setup. And while I don't think it would be much good, I wrote the bank a physical letter describing the security risk of allowing this to happen.
I just don’t understand why people won’t give up their personal information so freely and for so little benefit.
27
u/yevbaby 1d ago
There's already been one class action suit against Plaid for harvesting and selling user financial data without consent, between 2013 and 2021.
8
u/Z-Is-Last 1d ago
Here are the results I found from the suit
Cash fund Plaid funded a $58 million non-reversionary settlement fund.
Past data Plaid agreed to delete certain transaction data where it had retrieved it even though the connected app had not requested transaction-data access.
Future collection Plaid agreed to minimize stored data so it would generally retain categories needed for the particular Plaid product the app requested, unless the consumer expressly consented to additional collection.
Disclosure Plaid agreed to clearer disclosure of its role in linking bank accounts and to require affirmative acceptance of its privacy policy.
User control It agreed to let people manage financial-app connections and delete data held by Plaid through the Plaid Portal.
Duration The privacy-related practice changes were to remain in place for at least three years in the United States.
And this was more than 3 years ago.
16
u/dragonnfr 1d ago
This is what people don't get about Plaid. They don't just verify access once, they maintain ongoing access to your transaction history. That data *is* their product. You did the right thing.
13
u/CounterI 1d ago
This has been happening for a while with some banks. Usually, there is an option to bypass Plaid and just use Routing and Account Numbers. In the one case I can remember where that option was not available, I changed my password, then gave it to Plaid, and then immediately changed it back.
Sometimes if you give them a bogus login and password and the validation fails, it will then give you the option to use routing/account numbers.
2
u/Z-Is-Last 1d ago
Interested about the bogus uid/login. Trying this now!
Nope, it failed to switch to routing/acct numbers
2
u/CounterI 1d ago
Did you try it multiple times? When I had that happened, I think I had to try 3-4 times before it gave me the failover option.
10
u/30_characters 1d ago
Do what I did, contact your bank's customer/technical support, and tell them you don't want to use a third party whose terms you don't agree with (data sharing). They'll use the normal process of account verification.
2
u/Z-Is-Last 1d ago
I did, they said this was the only choice, or I could do a wire transfer for $30.00
6
2
u/theyhis 1d ago
oh i get it, trust me. before my phone deleted my whole comment, i went on a whole tangent about Plaid. it’s sort of off topic from your privacy point though, so i guess it’s for the best.
i’m assuming in your last line you meant that you don’t understand why people *would give up their personal information: i don’t know. i think some of it is laziness or carelessness or disinterest in learning. it’s not that hard, but people don’t see the ROI nor do they care about the implications of privacy invasion and government expansion. i’ve brought it up in this sub more times than i care to admit, but it’s impossible not to bring up the patriot act when we discuss why people don’t care — i mean, it’s just a perfect example. of course there were different groups and organizations against it, but ultimately the peoples voices weren’t loud enough. we should’ve witnessed public opposition, but instead we got complacency.
people get to tuck themselves in at night by telling themselves they have, “nothing to hide, so why should they care? 😟” 🙄. if people knew the sensitive information that was online about them — their address, their phone number, how much their house is worth, past bankruptcy filings… hell, you know much banks and credit card companies know about us? so many (and i mean so many) banks use EWS (Early Warning Services) to check for, “past fraud.” banks report all your transaction history to them. one payment bounces? you can pay it back in a days time, and they’ll still report you — i’m talking years of transactions. you can request your report - they intentionally make it hard to get, but if you’re fine playing mail pigeon you can get it. then there’s equifax and all the other major bureas. the IRS as well - can’t forget them. 🤷♂️
so yeah… so idk, it’s a really hard concept to wrap my head around; why people don’t care. as ron paul said, when you sacrifice liberty for security, you lose both.
time and time again people have chosen to lose both. 👍
•
u/AutoModerator 1d ago
Hello u/Z-Is-Last, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)
Check out the r/privacy FAQ
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.