As someone who collects these daily; I'd rather not collect them. The lengths I have to go to to ensure that they're not a major risk for our product? Significant. It's not a hard problem to solve, but the question is: "do banks want to solve it?" There's not much incentive for big banks to DECREASE account stickiness, and a lot of us waiting for great aggregation tools to totally dis-intermediate the big banks from their customers 8 ways till Tuesday.
But to be honest, financial data is all sort of like this. For example, once someone has your ACH routing and account numbers, the only thing that really stops them from building a fraud factory is the fact that it's difficult to get permission to interact with the ACH network. You need to handle those with at least as much care as bank login info.
And then, there was the MASSIVE fraud spree that everyone who didn't implement yellow path validation for ApplePay opened up. I personally had well over 80k stolen from my account in less than 1 day via that outrageous fraud loop. Thanks, Apple Stores and Chase, for pretending that someone else's fingerprint constitutes my biometric permission.
On the subject of Chase, everyone in the industry was completely shut down without warning at the worst possible time by Chase. We're all pretty spicy about how it was handled.
My capital one 360 account does this. I can generate an api key that I give to mint.
I mean, role specific credentials with limited rights seems like it would work perfectly fine with the existing OFX spec.
Is it? My bank requires multi-factor confirmation to set up a new payee for electronic transfers and sends several emails for any transfer. You couldn't actually steal any money just by having online banking credentials.
Sure, but it shouldn't be the bank's decision to keep me from accessing my own customer data because it's insecure.
If they actually wanted to fix this, it would be entirely possible to provide a read-only API.
On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their own data, that they own, not the bank. A bank could create an API service with API keys specifically for these types of aggregate services to use. This could be done at first for just read only access, whereby the API does not allow you to transfer funds, etc. It would be a secure interface to access your data from third trusted third parties or your own apps.
A secure standard API would be beneficial to customers, to third party services, and to the banks that offer them. Freeing information inside of hoarding it, when it doesn't belong to them in the first place.
Credit unions could have a major advantage here if they would start using modern tech.