Safest Aggregator

[savory]

We have had some discussion in the recent past about the safety of account aggegator like Personal Capital, Yodlee, etc. and payment systems used by FB & Google.

Europe is moving ahead with a solution to protecting our data from accumulators as well as other sharing. I posted as a new thread but I am guessing I did a bad job of describing how this can help people. Given our previous conversation, I thought I would share it here.

In the PSD2 world (the approach being introduced in Europe), there will be a 'read only' password that will be shared. So when Yodlee downloads your accounts or you make a Google Pay purchase, they will use a 'read only' password connected to your account. it will not be the actual password as it is today. Another layer of protection.

This is info from the link: "In short, PSD2 enables bank customers, both consumers and businesses, to use third-party providers to manage their finances. In the near future, you may be using Facebook or Google to pay your bills, making P2P transfers and analyse your spending, while still having your money safely placed in your current bank account. Banks, however, are obligated to provide these third-party providers access to their customers’ accounts through open APIs (application program interface). This will enable third-parties to build financial services on top of banks’ data and infrastructure.
Banks will no longer only be competing against banks, but everyone offering financial services. PSD2 will fundamentally change the payments value chain, what business models are profitable, and customer expectations. Through the directive, the European Commission aims to improve innovation, reinforce consumer protection and improve the security of internet payments and account access within the EU and EEA. "

In some ways this is like the pin & chip launch in Europe, leading the USA in a better approach. I wanted to put the PSD2 out there to inform people that there might be a safer approach that would be helpful to many of us. But, we may have to ask for it to accelerate its USA adoption

BTW, if there are people out there that can provide a better explanation than I provided, you will not hurt meyfeelings if you share. I know enough to be dangerous.

https://www.evry.com/en/news/articles/psd2-the-directive-that-will-change-banking-as-we-know-it/

 

[wmc1000]

davef thanks for the informative explanation - be advised the link you show does not work

 

[savory]

davef thanks for the informative explanation - be advised the link you show does not work

Thanks. I edited the post and think I fixed it.

 

[wmc1000]

ok works now - Thanks!

 

[cathy63]

We have had some discussion in the recent past about the safety of account aggegator like Personal Capital, Yodlee, etc. and payment systems used by FB & Google.

Europe is moving ahead with a solution to protecting our data from accumulators as well as other sharing. I posted as a new thread but I am guessing I did a bad job of describing how this can help people. Given our previous conversation, I thought I would share it here.

In the PSD2 world (the approach being introduced in Europe), there will be a 'read only' password that will be shared. So when Yodlee downloads your accounts or you make a Google Pay purchase, they will use a 'read only' password connected to your account. it will not be the actual password as it is today. Another layer of protection.

This is info from the link: "In short, PSD2 enables bank customers, both consumers and businesses, to use third-party providers to manage their finances. In the near future, you may be using Facebook or Google to pay your bills, making P2P transfers and analyse your spending, while still having your money safely placed in your current bank account. Banks, however, are obligated to provide these third-party providers access to their customers’ accounts through open APIs (application program interface). This will enable third-parties to build financial services on top of banks’ data and infrastructure.
Banks will no longer only be competing against banks, but everyone offering financial services. PSD2 will fundamentally change the payments value chain, what business models are profitable, and customer expectations. Through the directive, the European Commission aims to improve innovation, reinforce consumer protection and improve the security of internet payments and account access within the EU and EEA. "

In some ways this is like the pin & chip launch in Europe, leading the USA in a better approach. I wanted to put the PSD2 out there to inform people that there might be a safer approach that would be helpful to many of us. But, we may have to ask for it to accelerate its USA adoption

BTW, if there are people out there that can provide a better explanation than I provided, you will not hurt meyfeelings if you share. I know enough to be dangerous.

https://www.evry.com/en/news/articles/psd2-the-directive-that-will-change-banking-as-we-know-it/

Many U.S. financial institutions already provide read-only access to your financial information via an implementation of OFX or a Quicken-specific API. That's how aggregators get the data. They're (mostly) not logging in to your bank's or broker's website and then scraping information off the pages.

The security concern is that the financial institutions have chosen to use the same login/password for the APIs as they use for direct website access, so if your login info gets stolen from the aggregator, the hacker can then use it in other contexts where they would be able to do harm. Your financial institution could choose to require separate logins for their read-only API and their website if they wanted to. If they haven't done so, it's because they have found ways to offload the risk or they haven't decided it would give them a marketing advantage.

I don't see a future where Congress passes a law that says U.S. banks have to implement PSD2. The article you linked points out that the banks in Europe have to absorb all the costs of implementation (which will be massive -- certainly in the billions of dollars); they are responsible for the security of the data they're being forced to share; and then they will lose 9% of their transaction revenue. It uses the word "monopoly" a lot, and I don't know enough about European banking to know whether that's an accurate characterization, but I don't think that applies in the U.S. and it would be very hard to get anti-monopoly legislation targeted at a specific industry passed when there is no monopoly to break.