I’ve been asked to sign up to plaid by clients three times. Each time I’ve said no. I’m not giving a 3rd party access to my bank account. I don’t understand how people enable this total loss of friction for direct account egress. There needs to be friction.
Hijacking this comment to complain about fintech apps / saas providers requiring Plaid - please stop.
For example, Coinbase requires logging in with Plaid to... setup auto-pay for their credit card statements. No way to just provide account/routing numbers the good ole way.
There's lots of issues with Plaid but one big one is that banks (e.g big ones like BofA) can lock your account due to suspicious login with Plaid.
Airbnb requested Plaid access to my entire Chase account and all transactional data to "verify my credit card" a few years ago, and wouldn't budge until I tried Apple Pay, where they apparently weren't able to figure out the underlying issuer and accordingly left me alone.
Needless to say that it was my last stay with Airbnb.
Depending on the rate difference, I'd be tempted to setup a 'burner' checking account at a separate financial institution and just auto-transfer the loan amount from my primary bank to the burner every month.
My bank's underwriter/loan officer actually said to get the best rate with them to specifically setup an account with them (They aren't my day to day bank) and just use it for my house payment. For the past decade the only transactions it has ever seen has been the direct deposit and the auto-withdraw for the mortgage.
Really? Both times I got a loan they wanted bank statements from all of my main accounts and verifiable income history, but they didn’t care that I was paying from an account that I had just opened for the specific purpose of paying the loan.
I'm not OP, but I assumed from their post that they meant the loan provider wanted Plaid access in order to perform underwriting - as in give us access to your account(s) so we can pull your banking history via an automated manner instead of sending PDFs.
Could be wrong though, as I never considered it'd be used for payments at all.
same. maybe it just depends on the bank, but i can't imagine why that would matter at all. they have the whole picture of your financial history, generally. what does it matter whether that one bank account has only enough in it to pay off the loan every month.
They do because their banks are largely not offering anything more fine grained, because they don’t have to, and in fact doing so would cannibalize their debit card business.
Requesting full account access for anything other than maybe budgeting software should just not be legal.
But what comes after? Can users decline or at least downgrade the level of access requested by whoever wants to peek into their bank account? Do banks clearly indicate (and periodically remind the user about!) all parties currently having access to their account?
It's usually still persistent full access, and given that, the question of whether the user's password also leaks in the process is almost besides the point.
Have you ever entered your routing+account number into HR software for direct deposit? Doesn't that qualify as handing a third party essentially the same access as Plaid gets? I think bank accounts are generally more accessible in the modern era, it's just a risk that you take.
Of course, you're not obligated to use Plaid but I do find the concerns around this quite strange since you're likely exposing account information already.
Plaid wants you to enter your bank username-password into their form. If it was just routing+account it would be truly no different than other bank connection methods.
Plaid works a lot like PSD2-based services in the EU then, which also typically consist of a form hosted by the service using Times New Roman and the original padlock.gif from Netscape asking for your IBAN and online banking password and then a TAN/2FA number. Obviously there are no technical controls at that point to what the service can do in your account. I tend to avoid anything PSD2 for much the same reasons as Plaid, it's extremely sketchy. Somehow we can have scoped access using OAuth for random webservices but for a credit check it's "please just give us your online banking login despite everyone telling you since 1995 that you're not supposed to hand that to anyone and always double check the URL in the address bar to be yourbank.com... we assure you nl-gwlogin.xs2a.openbankingservices.co.net is an entirely legitimate place to enter your PIN"
At this point, it's often OAuth, but in my view, the exact means of access is a red herring: The only thing that changes between screen scraping and OAuth is that Plaid doesn't get my banking password, which is literally the least of my concern compared to persistent access to my account transactional data.
The same info is also on checks, and there's an established story around fraud there -- if I didn't authorize an ACH withdrawal then my bank is legally required to make me whole. If I hand over my username+password to a third party, I'm on my own.
Also, the routing+account numbers just let them deposit/withdraw money, not snoop on all my transactions and harvest my data...
This is a common belief, but the CFPB has stated your bank is still legally required to make you whole in the event of fraud even if you handed over your username and password to a third party, and that any bank TOS stating otherwise are not valid. This is covered on the CFPB Electronic Fund Transfers FAQ, under the Error Resolution: Unauthorized EFTs, Question 8: https://www.consumerfinance.gov/compliance/compliance-resour...
In Germany, there was a similar antitrust-based ruling, but it even went further: They disallowed banks to block screen scraping services, as they considered the existence of screen-scraping-based confirmed instant bank transfers a valuable competitor to the (bank-led) card payment schemes.
In retrospect, they were maybe right on the competitive part, but the data privacy impact was disastrous.
With plaid they get access to all of your account numbers.
HR just sees a single savings account that I strictly use for direct deposit. They don’t see my actual savings account or my other purpose-specific checking accounts.
Sure, but GP mentioned direct account egress which is why I brought up the typical method for doing that. I figured banks are already selling / reporting the other information (account types, amounts, transactions, etc.)
As an aside, I think each permission has to be granted explicitly in Plaid so it's not just getting "root" access to do simple transactions (unless you grant it)
routing+account numbers are not that sensitive. that's been API for how we transact money since pre-historic times.
plaid gets access to your online account with access personal data, security details, documents, transactions, statements, write-access etc.
Whenever I have seen the Plaid integration it will also ask permission to your transactions. HR software won't get those when I provide it my account & routing numbers.
> OpenAI did this with your health data in January. Now it wants your financial data too.
This is far more valuable, they can see what political affiliation you have based on your campaign donations, predict things like cheating on your wife & the impending divorce, what vices you have and they can also build shadow profiles of all the people you give and receive money from even if they don't use the product.
>they can see what political affiliation you have based on your campaign donations
You can get a pretty good estimate just by looking at other demographic factors like age, education level, income, and zip code. Moreover, how many people actually donate to campaigns?
>predict things like cheating on your wife & the impending divorce, what vices you have and they can also build shadow profiles of all of the people you give and receive money from even if they don't use the product.
Google has all this capability for at least a decade. What concrete harms have actually materialized?
Okay, what concrete harms has Meta done with this information? At best you have some creeps using it to stalk their exes, which is bad, but a far cry from the AI takeover scenario implied by OP.
I haven't implied an AI takeover, this data will be repackaged into a product for military/intelligence, political applications, insurance companies that can charge you more because they know you're willing to pay, and many more.
These things already exist and happen, it's about the data getting better and not having to build tools to query it and make projections, since you can just type a query into a box even if you're not a data scientist.
I'm not sure if Plaid still is- but when they first came out they were pretty evil. They would go into your accounts and download all activity. I spent many hours e-mailing them, trying to get a clear answer of what data they collect- and they never said no to anything.
Whenever I've been forced to use Plaid, I use a throw away "free-checking" bank account that has $1 in it.
Plaid is criticized because it’s a public-facing mechanism for third-party access into your finances, but many companies already have access without you knowing. In the US, many banks share nonpublic info such as transactions with retailers, marketers, government agencies, and others. They’re allowed to do so under the Gramm-Leach-Bliley Act. Report from the GOA:
It’s like we are trying to run as fast as possible towards an AI controlled disaster by connecting absolutely everything we can to the AI… even in the worst sci-fi the robots need to steal codes to get access to systems and we are just leaving the door wide open.
I think "leaving the door open" still doesn't do it justice: In many cases, we're quite willingly sharing our data with centralized third-party inference clusters and are delegating decisions to AI.
Rather than Skynet grabbing all access it can uninvited, I feel like the more realistic mythological analogy for hypothetical AI doom is actually dining with faeries: Nobody's forcing you too, but their food just looks sooo delicious... Or, to stick with the symbolism of open doors, it'll definitely be us having invited the vampires across our thresholds.
I read about a post that in dn42 community where a dude set up an AI agent with access to his Amazon API, which eventually deployed servers generating a bill of $6000.
We're not trying to run as fast as possible towards anything. It's a bunch of investors trying to run as fast as possible towards the AI controlled disaster, or as they see it, an AI controlled unlocking of value.
Honestly, given that your bank most likely is processing your data using AI/LLMs anyway (after all, credit scores were one of the first applications of "big data" and "machine intelligence", back when that was mostly logistic regression over a handful of data points), why should I not also reap the benefits of that?
I think until proven otherwise, it's fair to consider financial data public information at this point. If we want to change that, I think it'll take way more than just not granting ChatGPT access to your bank account (although it'll definitely include it).
Most people don't care at all about their privacy. Apps like Venmo by default will share basically who you are spending time with and what your doing, Strava basically exposes where you live and your sleep/ workout schedule by default.
I wouldn't want to share my financial data with OpenAI but for the average consumer the ship has sailed.
Man, I remember when the common wisdom was that there would NEVER be enough people willing to put their credit card into a web browser to support a business.
Uh, debit cards are the worse as they (technically) don’t allow you to dispute charges like in a credit card. Money comes right out of your account first, and then you have to try to get it back.
All set for a perfect storm with a single exploit down the line. Which could take out so much and OpenAI with it. What a way to burst the bubble, not an if, more a when as so many eggs in that basket and they have yet to invent a solid lid.
I guess I’m not seeing the systemic failure mode with a Plaid hook-up? The worst case is it sends a bunch of peoples’ money into the aether. That sucks for them and for OpenAI. But I’m not seeing it e.g. collapsing a bank.
It won't go wrong if you don't wanna use this feature but if you do then its upto you that you''re trusting a for profit company that much that you provide them with your confidential data.
Little doubt the true motivation behind this is the advertising angle. What better way to advertise to consumers than seeing exactly what they're spending money on, historically and in near-realtime?
It seems like every three years or so I need to use a tool with a plaid link feature, I try it, it gives some internal plaid error, then I find some other way of solving the issue.
Plaid is glitchy enough that whenever I hit a workflow that has no alternative, I just call the customer support line and tell them I get an error when trying to link my account via plaid, and they invariably have a manual way to do the thing on their end.
Until every web site and bank requires you to use it because their CTO saw an ad in an airport that said it was a good idea and makes line go up.
"Leadership" today is monkey-see, monkey-do.
See also: Sign in with Google on every web site, even if you don't have a Google account; and Cloudflare interrupting your web surfing every six minutes to make sure you haven't be absorbed by the Borg.
I feel like every single day OpenAI and Anthropic are entrenching their slopware in everyday products and workplaces with little to no way to opt-out. This is getting dystopian.
I now think AI is a virus, which infects whatever it touches. Not just software, but the books (there're already slopbooks printed, and I'm not talking about fiction books, but rather real textbooks, history, music, art, etc...). In XX years what can you even trust? We will adapt and get around it, but I'm not yet sure how.
While openai's use of Plaid's spying on bank accounts is framed as a service it's real use case will be identification. Very few people if any will sign up to use this voluntarily. But it is a way to get users used to Plaid's spying and start slowly boiling the frog.
The endgame I see is that it will be illegal to communicate on the internet without having a proven bank account. At least in the USA where all ID verification is settling on banks (ie, Plaid). And the banks will tolerate 10,000 false positive denials of service to avoid a single false negative and be happy about it. Plaid even more so. Human beings will have no recourse as they are private companies. This really should be a service that the states of the federal government provide. It's a dark future we're speeding towards.
For example, Coinbase requires logging in with Plaid to... setup auto-pay for their credit card statements. No way to just provide account/routing numbers the good ole way.
There's lots of issues with Plaid but one big one is that banks (e.g big ones like BofA) can lock your account due to suspicious login with Plaid.
https://x.com/kanateven/status/1973793740331368841
Needless to say that it was my last stay with Airbnb.
I'm not the most privacy-focused individual, not nearly as paranoid as I could be, but Plaid's model is an OBVIOUS step too far.
Could be wrong though, as I never considered it'd be used for payments at all.
At least there is a process for unauthorized ACH debits. For this blatant breach of privacy, there is nothing.
Requesting full account access for anything other than maybe budgeting software should just not be legal.
It's usually still persistent full access, and given that, the question of whether the user's password also leaks in the process is almost besides the point.
Of course, you're not obligated to use Plaid but I do find the concerns around this quite strange since you're likely exposing account information already.
Also, the routing+account numbers just let them deposit/withdraw money, not snoop on all my transactions and harvest my data...
In retrospect, they were maybe right on the competitive part, but the data privacy impact was disastrous.
HR just sees a single savings account that I strictly use for direct deposit. They don’t see my actual savings account or my other purpose-specific checking accounts.
As an aside, I think each permission has to be granted explicitly in Plaid so it's not just getting "root" access to do simple transactions (unless you grant it)
This is far more valuable, they can see what political affiliation you have based on your campaign donations, predict things like cheating on your wife & the impending divorce, what vices you have and they can also build shadow profiles of all the people you give and receive money from even if they don't use the product.
The difference is that banking records are harder to falsify, so there’s that.
You can get a pretty good estimate just by looking at other demographic factors like age, education level, income, and zip code. Moreover, how many people actually donate to campaigns?
>predict things like cheating on your wife & the impending divorce, what vices you have and they can also build shadow profiles of all of the people you give and receive money from even if they don't use the product.
Google has all this capability for at least a decade. What concrete harms have actually materialized?
These things already exist and happen, it's about the data getting better and not having to build tools to query it and make projections, since you can just type a query into a box even if you're not a data scientist.
Whenever I've been forced to use Plaid, I use a throw away "free-checking" bank account that has $1 in it.
I guess birds of a feather flock together.
https://www.gao.gov/products/gao-21-36
Rather than Skynet grabbing all access it can uninvited, I feel like the more realistic mythological analogy for hypothetical AI doom is actually dining with faeries: Nobody's forcing you too, but their food just looks sooo delicious... Or, to stick with the symbolism of open doors, it'll definitely be us having invited the vampires across our thresholds.
BUT there’s just things that nobody should be doing ever, like give it access to your production system or bank account.
I think until proven otherwise, it's fair to consider financial data public information at this point. If we want to change that, I think it'll take way more than just not granting ChatGPT access to your bank account (although it'll definitely include it).
Nothing wrong about with giving them access to your bank or savings accounts /s
This exactly the same shit Zuck did with Facebook. Hell with them all.
I wouldn't want to share my financial data with OpenAI but for the average consumer the ship has sailed.
OpenAI is just a new-ish player.
I never expected to be nostalgic for those days.
Don’t use debit cards online.
Reminds me of the underpant gnomes in many ways
Collect underpants ???AI??? Profit
I guess I’m not seeing the systemic failure mode with a Plaid hook-up? The worst case is it sends a bunch of peoples’ money into the aether. That sucks for them and for OpenAI. But I’m not seeing it e.g. collapsing a bank.
But yeah, can't have a systemic failure in the grift economy.
If it needs to see transactions, just have your salary deposited there, then an automatic transfer the same day to your real account?
"Leadership" today is monkey-see, monkey-do.
See also: Sign in with Google on every web site, even if you don't have a Google account; and Cloudflare interrupting your web surfing every six minutes to make sure you haven't be absorbed by the Borg.
It feels like an arms race on who’s gonna become the Microsoft of the 90s, trying to own and provide everything.
I think it will play out in the same way
The endgame I see is that it will be illegal to communicate on the internet without having a proven bank account. At least in the USA where all ID verification is settling on banks (ie, Plaid). And the banks will tolerate 10,000 false positive denials of service to avoid a single false negative and be happy about it. Plaid even more so. Human beings will have no recourse as they are private companies. This really should be a service that the states of the federal government provide. It's a dark future we're speeding towards.