I'm surprised, because Plaid is far from the first mover in the "scraped banking data API" space. Mint (now Intuit) and Yodlee come to mind, and they use essentially the same sign-in flow and come with the same limitations.

There are organizations and companies that are trying to do this legitimately, through open standards and real incentives to both FIs and customers to share information in exchanges:

- Open Banking Project: https://www.openbankproject.com/

- MX: https://www.mx.com/

P.S. Can we get real Markdown support already? The fact that the Markdown URL format isn't supported is extremely user-hostile.

You're right, they aren't the first. That said, when I use accounting software, it's pretty obvious to me that I am going to be sharing my transaction history with the accounting software. When I connect my bank account to Venmo, it is absolutely not obvious to me that I'm sharing my entire transaction history with Plaid. Replicating the appearance of my bank's login screens is critical to the illusion.

Even if I did understand that they are storing and using my credentials, I should be able to expect from a reputable business that they are not scraping irrelevant transaction data and then using it for purposes that don't explicitly support the app I am using. Selling my transaction history definitely isn't supporting the use case I'm authorizing.

Fortunately, Plaid doesn’t sell your transaction history, so this isn’t a concern.

READ: https://plaid.com/legal/#consumers

Any chance you could point me to something more specific? From your link I found this:

> We do not sell or rent personal information that we collect.

Alternative title to this thread is "Plaid fails to sell customer data to Visa" (along with code, and the rest of the company). Consumers, as well as Plaid, have no idea where this data is going to end up ultimately, depending on who winds up getting control of Plaid. What are the odds of Private Equity acquiring Plaid and "leveraging synergies" with the pay-day loan company in their portfolio? I think the odds are greater than zero.

“We may collect, use, and share End User Information in an aggregated, de-identified, or anonymized manner (that does not identify you personally) for any purpose permitted under applicable law.”

Going by what was posted further up in the thread, that seems to be what TD Bank alleges in their suit?

If you authenticate with <mortgage broker> via Plaid, then the broker pays plaid money and the broker gets your bank information. So I suppose in a sense that's "selling your data," but I don't think that's what people are concerned about: You explicitly sign into the mortgage broker to give them data!

What Plaid has said on record they DON'T do is take that data they provided to the broker, bundle it up, and then sell it to marketing firms or hedge funds or other random third parties for which the user didn't explicitly ask their data to be shared.

See: https://www.americanbanker.com/news/lawsuit-against-plaid-he...

“Plaid does not sell and has never sold consumers’ personal information or data. Consumer data is obtained and used with consumer consent. Plaid believes strongly that consumers should have permission-based access to and control over their financial data, and embodies these principles in its practices."

That's pretty strong language.

From the press release: "Plaid is a financial services company that operates the leading financial data aggregation platform in the United States"

I love the way they are literally defined as "the leading financial data aggregation platform in the United States", rather than "the leading financial integrations platform".

Seems like Justice does know their real business. And they don't seem to care.

Re: formatting, I strongly suggest using markdown's [reference link syntax], which is much more readable when rendered as plain text.

[reference link syntax]: https://daringfireball.net/projects/markdown/basics

> There are organizations and companies that are trying to do this legitimately, through open standards and real incentives to both FIs and customers to share information in exchanges:

That is never going to work. The reason the world works the way it works is because banks dont want to give easy access, so market opportunity for companies like Plaid exists.

It works in the UK where open banking is regulated by the FCA:

https://www.openbanking.org.uk/customers/what-is-open-bankin...

Open Banking is the result of the EU PSD2, so unfortunately is no longer guaranteed in the UK. UK firms have already lost passporting rights, and it's yet unclear whether the UK will align with EU regulation going forward.

I think it would be highly unlikely the UK would regress on open banking. It's been a cornerstone of a lot of govt policy for banking.

I guess the question is what you mean by "open banking". Initially, in the UK, that phrase referred to the FCA's implementation of the PSD2 requirement for banks to allow a secure mechanism of access to third parties. I think that this definition of open banking has already regressed post-Brexit, from the absence of passporting. UK firms and banks are no longer able to interoperate with EU firms and banks, and PSD2 no longer applies to them.

Another definition may be domestic API access to bank accounts, which I agree will continue to be policy in the UK. It won't be PSD2 open banking, though.

PSD2 still applies. That was integrated into U.K. law long before Brexit. It would take an act of parliament to unwind.

Additionally the U.K. has generally been on the leading edge of open banking, which is why our standards weren’t identical to the EUs for a while. It’s going nowhere, and pass-porting will make no difference.

The only real impact of Brexit is the open banking entities will need to register separately in the U.K. and the EU, and be subject to two different regulators. But that’s just paperwork for the most part.

> PSD2 still applies. That was integrated into U.K. law long before Brexit. It would take an act of parliament to unwind.

It's not that simple. The FCA is no longer an EEA National Competent Authority and UK Third Party Providers must register with an EEA NCA to continue to operate in the EEA. Domestic legislation which put PSD2 in force is of course still UK law, and domestic TPPs and Account Servicing Payment Service Providers can continue to operate together (even using the same eiDAS certs), but they cannot engage in open banking with the rest of the EU/EEA.

PSD2 and its supporting institutions (EBA, EPC, ECJ) no longer apply to the UK.

> Additionally the U.K. has generally been on the leading edge of open banking, which is why our standards weren’t identical to the EUs for a while. It’s going nowhere, and pass-porting will make no difference.

Internally, maybe, but UK TPPs and ASPSPs can no longer interoperate with EU/EEA TPPs and ASPSPs unless they register with an EU/EEA NCA, and thus become subject to EU Directives. Again it comes back to your definition of "open banking". If you mean only UK banks and firms being able to operate an open banking scheme, then you are correct that this will continue. If you mean open banking as defined by PSD2, it has already come to an end in the UK.

> The only real impact of Brexit is the open banking entities will need to register separately in the U.K. and the EU, and be subject to two different regulators. But that’s just paperwork for the most part.

So either UK TPPs and ASPSPs have to abide by EU Directives (if possible - the UK legislature may diverge from the EU in unreconcilable ways), or the UK has to maintain alignment with the EU indefinitely. Doesn't seem like just paperwork to me.

"Open banking" and "cross-border banking" are two different things. The UK will definitely continue to have open banking. The UK-EU banking relationship is still up for negotiation. (I'm not hopeful though.)

> The UK will definitely continue to have open banking.

As discussed elsewhere in this thread, this requires a definition of "open banking" which is separate from PSD2 and not what the phrase commonly meant until now. The distinction isn't between "open banking" and "cross-border banking" - the distinction is between:

* PSD2 compliant "open banking" between TPPs and ASPSPs,

* Some banks in the UK must have APIs "open banking".

Up until January 1st, the phrase "open banking" referred to the former. The latter may become accepted as the definition in the UK, but it is materially different to the original meaning.

It doesn't really work. Open Banking doesn't seem to enforce a consistent API which means you either need to implement a client for each bank (and their data model) individually or use something like Plaid (in the UK our equivalent is TrueLayer) to aggregate all the different banks into a single API.

This is just not true, for Open Banking in the UK. API standards are published and banks must implement them.

There was a get-out, but it was a bad one for the banks - if any bank did not provide a compliant API by a specific date (IIRC sometime last year) then they would have to keep their web sites entirely unaltered in order to support scraping.

PSD2 doesn't even mandate APIs as the mechanism of access!

The fact that the Markdown URL format cloaks URLs is user-hostile.

Markdown doesn’t cloak URLs; HTML does. We seem fine with that on every other webpage.

>P.S. Can we get real Markdown support already? The fact that the Markdown URL format isn't supported is extremely user-hostile.

Hear hear! Markdown is definitely the new formatting standard, and it's amazing (I even take notes in .md files).

A lot of these banks never had any APIs. Plaid made its name basically scrapping the html of account pages. Companies used it because there were no alternatives (no apis)

I understand the situation. Another of Plaid's investors is Goldman Sachs. I naively assumed that Plaid's ability to build their product was likely based on access to private APIs available to them based on their relationships and backing.

If someone came to me and asked me to build what Plaid has built, I would decline the work. I would assume that impersonating a bank would be illegal. I would assume that the banks I am impersonating would treat me as a malicious actor. I would assume that I would go to jail for building a system like this.

Absolutely unbelievable.

Plaid does have real integrations with some institutions, using OAuth and the works. The list is relatively miniscule compared to the vast majority of institutions that still consider customer data their asset and not their customers'.

On the other hand, Plaid’s behaviour means that your data is not yours either, but is up for grabs by a 3rd party for which you may not have given consent to. Plaid is no Robin Hood (the story not the app) here.

Plaid is equivalent to a carrier, right? They merely provide the data to their client (whatever service/app you're signing into) and it's up to that client to decide how to use it.

Back when I used to run a web scraping shop, we had this exact request. I didn't know it was illegal at the time but we ultimately didn't do it because lot of people just want to pay as little as possible for scraping without considering the amount of work that goes behind it.

Web scraping is not illegal per se. Though it may be against the specific terms of service of the site you are scraping.

that was before the 2018 ruling this was back in 2012, I remember Craigslist sued someone for scraping under CFAA.

Thanks to EFF, this scummy tactic used to kill Aaron Swartz is no more.

You are misremembering. CFAA defines criminal acts not civil, so Craigslist could not sue someone under the CFAA. The DA would have to bring charges first and then the civil suit by Craigslist would reference the criminal suit.

Even if it isn’t illegal it can be against the terms of service and void your warranty/insurance

fraudulently obtaining people's banking information can be described many ways. The prosecutors won't call it web scraping and the judge hasn't seen that although he has heard of people who steal users information to hack their banks.

Seems like a bad bet to me.

I've learned that when it comes to banks, assuming things like that is usually wrong.

Let’s not forget the companies that enabled Plaid to do this. One of the worst offenders was Carta. They made you use Plaid to exercise your stock options. So you had to let Plaid scrape your account info to get the stock you worked so hard for. Most people had no idea they were allowing this.

They do integrate natively with some banks, like JPMC:

> When this is implemented, Plaid will access customer information through the bank’s secure API (application programming interface) connection. That will allow customers to share their information more safely and quickly with Plaid and the financial apps it supports while protecting their bank username and password.

and also Wells Fargo:

> The API used in the agreement will utilize a more secure, tokenized “handshake” between the companies’ servers through which customers’ financial data will be shared. Once integrated, the API will allow customers to share their financial data, while also maintaining the privacy of their user credentials. The enrollment process will be easy and designed to work seamlessly within Plaid-supported apps’ user experiences.

I think it would be good to do some quick Google searches before getting (all of) the torches out.

https://media.chase.com/news/plaid-signs-data-agreement-with...

https://www.businesswire.com/news/home/20190919005081/en/Wel...

They're not hiding the fact.

From their website [1]: "When you choose to connect your financial accounts to an app using Plaid, you will be prompted to enter the username and password associated with those accounts. Plaid then links your accounts to the app you want to use so you can share your data."

[1] https://plaid.com/how-it-works-for-consumers/

Disagree, they are hiding the fact by assuming ignorance of most users. A true “link” , would use something like OAuth to have the bank handle authentication and provide explicitly scoped subset of consumer data to Plaid. Instead they are taking the plaintext password and getting total access. Just taking that passwords itself is a security vulnerability. Google doesn’t even know your Gmail password, just the hash, but since Plaid can’t use a password hash to login, it must store your plaintext password to your financial accounts, some of THE most sensitive data. Furthemore they have access to way more data than they should rather than clearly defined scoped subsets of it.

The whole company is a privacy and security disaster. Of course it’s annoying that banks don’t provide reasonable OAuth APIs, but Plaid “disrupts” that by deceiving consumers into dangerous security vulnerabilities with their most sensitive personal data.

You speak idealistically, but the reality is that many of these banks did not having open banking standards nor APIs before. The scraping led to this movement and FSAs all over the world are starting to push for no scraping while financial institutions create APIs and contracts with these platforms.

The fact is pretty much hidden. I tried to link my Toshl (a budget app) account to my bank, to import automatically my movements. I saw that they were using Plaid, and I found that weird. I went to search the page you linked, and I still didn't know how was it connecting to my bank. I used an "application password" with limited permissions from my bank to use with Plaid, and funnily enough it didn't work. In fact, my bank locked my account because Plaid tried to login through the regular user interface with a wrong password several times. It was only then when I saw in forums and such that what Plaid does is to scrape HTML.

When you use Plaid, you don't get the impression that's what they're doing. We're used to dialogs to "give permissions to an app" that don't share our user/password with anybody. Plaid purposefully emulates those dialogs and gives you the impression that you're just logging in with your bank, instead of explicitly telling you "we will store your user and password and use that to log-i with your bank".

"link" to me implies something along the lines of a FB/Google/GitHub OAuth login, not that they steal my credentials.

I guess technically they just say, "you will be prompted to enter the username and password associated with those accounts" and don't specify that they (Plaid) will be using your credentials, but I don't think it's clear enough that you are giving your credentials away!

In the “startup” world, this is simply the only way to do it when your goals are to be everyone’s service. Banks rarely create open APIs, and even when they do they are fragile and subject to whims as the banks are optimizing for security first (plus: they need strong incentives to maintain APIs since it’s not even in their core business).

And since you can’t rely on an API, “there’s no other option” which compounds with the fact that coding up a web scraper for a specific bank takes maybe a dozen programmer-hours. Then throw on a disclaimer to cover legal, and start counting your billions of unhatched eggs.

VC's actually tend to love companies that are a little bit sneaky. Just not too sneaky to have to face consequences.

"Disruptive".

I don't think you are naive at all regarding this but generally people see famous people, name dropping and due diligence goes out the window.

There are people who take advantage of that and are very successful. Disgusting because it is just another form of deceiving people's trust.

It’s clear as day in the privacy policy. You did click on the privacy policy link and read through it right?