For example, Coinbase requires logging in with Plaid to... setup auto-pay for their credit card statements. No way to just provide account/routing numbers the good ole way.
There's lots of issues with Plaid but one big one is that banks (e.g big ones like BofA) can lock your account due to suspicious login with Plaid.
The Plaid listing you linked doesn’t have a batch by their name.
Needless to say that it was my last stay with Airbnb.
I'm not the most privacy-focused individual, not nearly as paranoid as I could be, but Plaid's model is an OBVIOUS step too far.
Could be wrong though, as I never considered it'd be used for payments at all.
Requesting full account access for anything other than maybe budgeting software should just not be legal.
Of course, you're not obligated to use Plaid but I do find the concerns around this quite strange since you're likely exposing account information already.
HR just sees a single savings account that I strictly use for direct deposit. They don’t see my actual savings account or my other purpose-specific checking accounts.
As an aside, I think each permission has to be granted explicitly in Plaid so it's not just getting "root" access to do simple transactions (unless you grant it)
Also, the routing+account numbers just let them deposit/withdraw money, not snoop on all my transactions and harvest my data...
In retrospect, they were maybe right on the competitive part, but the data privacy impact was disastrous.
At least there is a process for unauthorized ACH debits. For this blatant breach of privacy, there is nothing.
Which is hopefully nothing beyond looking at transaction data without 2FA.
They're literally proxying the bank's login page just like a phishing site would, and I assume they're also selecting the "trust this computer" option so their access is more persistent. My bank does require re-2FA for larger transfers, but there's still a lot of damage I can do on a "trusted" computer without triggering another 2FA prompt.
Doing re-2FA for every outbound transfer, and mentioning the consequences of entering the 2FA code out of band (e.g. "enter code 123456 to confirm transfer of x$ to y" or "press OK to confirm transfer..." in a mobile app) should be the bare minimum these days.
Currently, there is no aligned format for sharing your bank transaction history with other financial institution of your choice. Your current bank is the one who purposely makes it hard (only allowing you to share it through the same bank login) so that you are more locked-in in their eco system.
I used to work with Plaid as a provider, and you will notice certain banks who really do not like their customers using Plaid in sharing their bank transaction history with competitors will often have unscheduled maintenance that Plaid wouldn’t work so that you as a user would find friction using someone else and stay with only using products within their ecosystem.
I think the real question is less about why are we using Plaid to share our transaction information. If we are to have an open format to share our banking transaction history, what should be that format and what would be the lock and key for it?
Instant transfer (sub-second) for free is available to everyone. (Up to a certain limit)
It's usually still persistent full access, and given that, the question of whether the user's password also leaks in the process is almost besides the point.
The result is that I attempt, at all cost to not use anything that requires plaid or their competitors since I know how that sausage is made.
Handing my finances over to a company like that is a hard no for me, I can't imagine ever doing business with someone who required it.