Why break? They’re leveraging PSD2, not breaking it

Thanks Europe for using regulation (PSD2) to open up banking to fintech startups. Would anyone be interested in joining me in championing similar legislation in the US through congressional representatives, the Federal Reserve, and FDIC?

I don't know PSD2 fully but I know that my bank rolled out support for it and as far as I gather, applications should not have to ask for my username/password via their own UI (which after testing Plaid, they do), but rather use the authentication systems from the banks to authenticate. Maybe I used it wrong though.

Your understanding is correct. It's an OAuth2-type mandate for banking services providers.

https://transferwise.com/gb/blog/what-is-psd2

FYI, a lot of banks open banking apis are broken most of the time.

Having said that, for plaid in the UK, they do offer both an open banking integration and a scraping integration for most banks.

Isn't this the same company that phishes its users by asking them for their banking login and 2FA information directly in third party apps? I'm not sure if this is the sort of regulatory barrier breaking worth celebrating.

I came across Plaid for the first time today and when trying to make a transfer through Transferwise. When asked for my bank username and password at a website !my_bank I was like hell nope. Ended up having to use a credit card instead which had the highest fee... :( I hope this kind of garbage disappears.

I would rather have entered my logins and then changed the password if I was that concerned about entering my bank logins rather than pay those credit card fees. Or change the password first, login, and change back to your old password.

They can pull all go your transactions in that time, changing your password after is still too late.

If you're happy to hand out your credit card details to Plaid and trust them enough to properly secure it, personally I wouldn't be concerned about them flagrantly and illegally retrieving my past transactions. There is no such thing as trust less financial services that deal with fiat currency.

A credit card number/CVV/Expiration Date allows you to make transactions, but doesn't give you transaction _history_. Online banking username/password do give you full transaction history. My point was that giving away username/password is a terrible idea from a privacy standpoint compared to entering your CC.

>My point was that giving away username/password is a terrible idea from a privacy standpoint

I'm sure you know well the reasons for this. It is not practical to move large amounts of money via credit card due to the fees involved.

As for your point on transaction history, you could always create a separate account specifically for these type of situations where you're passing your login. Even if they get your transaction history, it would be very limited.

I don't trust Plaid to handle my credit card responsibly, that's why I'm handing them a credit card number instead of a debit card number. With a credit card I can do charge backs if I'm victim of fraud. If I give out my bank login details and someone empties my account, I'm pretty sure I'm in a quite a different position...

We're going back to square one with the 'empties my account' comment. You can mitigate that but changing your password pre/post transaction so the login you use is one-time. It is inconvenient, but worth it if you do not trust the vendor and want to avoid credit card fees. If you are concerned about them getting your past transactions, you can always create a new account, or even a new bank account just for use for these type of situations. There's still some transaction history, but not nearly as much as a day to day account. I do think there's a lot of value in Plaids services but having said that, it is all a work around due to the abysmal financial infrastructure of the USA and lack of real time payments. Plaid services and requiring bank logins to do transactions does seem a bit whack, but again US payment system is even whacker.

Given that for other ACH transfers I'm able to just hand out my routing+account number and that's all that is necessary to complete the transfer. The fact that companies are training people to input their bank username/password on other websites is completely insane, even if some might know to change it afterwards. If a scammy website did this, I'm willing to bet you money they'll change that password faster than you ever could.