Big Banks Lock Horns with Personal-Finance Web Portals

http://on.wsj.com/1iDRXGf

by andore_jr • 11 years ago

78 103 11 years ago

on.wsj.com

This is the major difference between the US and EU. In the EU this isn't the "bank's customer data" this is the "customer's data." The customer actually has a legal right to see what data is held about them by the bank, and the bank has a legal obligation to make sure that data is accurate and up to date.

elthran• 11 years ago

the bank has a legal right to make sure that data is accurate and up to date

Sorry to nitpick, but the bank has a legal obligation, not right - they don't have a choice other than to make sure data is correct

ChuckMcM• 11 years ago

In the US they also have a fiduciary requirement to protect your money to the best of their ability. I appreciate that some of the larger banks might actually consider the impact of a data breach at an aggregator but reading this a couple of times it really sounds like a whine that they feel they have to provision more capacity for both their user base + the load put on by the aggregators their user base is using. They don't have a way to charge the aggregator for their use like they do the customer.

If the latter is the real reason they are whining then I expect they will push for a fee than can charge people who access their account through an aggregator much like they charge people who access their account through Quickbooks.

toomuchtodo4• 11 years ago

I'd just change banks though. Its trivial when you only have a few bills that need ACH/EDI, and the rest of your payments are on auto-pay on a credit card (which you pay from your checking account). BankSimple (now Simple) let me down so many times during their tech upgrade, I simply moved over to Fidelity for my checking account needs. It took ~15 minutes to change my direct deposit online with my employer, and re-create my bill pay setup.

As a bank, you are a commodity. You simply store the bits that say how many resources I can consume over a moving window of time.

KirinDave5• 11 years ago

I appreciate that some of the larger banks might actually consider the impact of a data breach at an aggregator but reading this a couple of times it really sounds like a whine that they feel they have to provision more capacity for both their user base + the load put on by the aggregators their user base is using. They don't have a way to charge the aggregator for their use like they do the customer.

They absolutely charge their aggregators. Most of the aggregators can't screenscrape without permission of the aggregators. Why on earth would you think they can't? Why do you think Mint doesn't need to do MFA for so many banks and can just get away with a user-pass challenge?

This is about holding control of their customer base, plain and simple. They know everyone else, even other banks, are eager to dis-intermediate their customer base. They're spending too much money maintaining branches and offering inferior savings products to compete digitally, so they would rather delay that as long as possible.

snuxoll2• 11 years ago

The dumb part is banks are more than willing to support Quicken's Express Web Connect, which literally stores your username/password on Intuit's servers, logs into your online banking portal and downloads the .qfx files you would get if you did it by hand. This is the same company that owns Mint, and it's literally doing the same thing!

Oh well, until banks decide to stop allowing users to manually save .qfx files the worst they can do is make life inconvenient.

avemg• 11 years ago

As a (reluctant) Quicken user, I was not aware that Express Web Connect credentials are stored on Quicken servers. Do you have anything to back that assertion up?

ryanhuff• 11 years ago

Intuit owns Mint. Not sure how the banks are going to know the difference between Mint users and Express Web Connect users. Maybe they shut them all down?

curun1r• 11 years ago

I'm not sure about Quicken (which, incidentally, is being divested, so it won't be part of Intuit soon enough), but Mint uses the same internal service for communicating with financial institutions as Quickbooks and TurboTax.

By tokenizing each account, it ensures that if a breach of any of those products were to happen, the bank authentication credentials won't be leaked.

icebraining• 11 years ago

Well, while that's true, the bank isn't obligated to send it in a easily processable format; they could send you a pile of paper with the statements.

davidu• 11 years ago

If the banks cared they would provide either token-based API like oAuth or at the very least, a read-only password for users to give these sites that aren't fully credentialed.

Customers will always want to extract their data.

chuckcode• 11 years ago

Completely agree! I think it is ridiculous that financial institutions don't have a read only password for sharing with accountants, tax advisers and other programs.

ac29• 11 years ago

Mine (US) bank does just that.

sanderjd4• 11 years ago

Which bank?

imgabe• 11 years ago

Exactly. Of course it's going to flood their servers if Mint has to crawl through the megabytes of "special offers" bs that banks bombard you with when you log in to the website. Provide a separate API that just delivers account information in a few K of JSON. Problem solved.

KirinDave5• 11 years ago

The only way that is going to happen is if it is legally required to happen or if banks are financially incentivized to make it happen.

It's absolutely true that offering data migration services decreases bank account stickiness, and that's something everyone is terrified of doing in the finance industry. Customer acquisition costs are so high, I doubt you'd believe me if I explained them to you.

jsprogrammer• 11 years ago

Customer acquisition costs are so high, I doubt you'd believe me if I explained them to you.

Of course we would believe you. When you use a metric like "customer acquisition costs", you can say pretty much whatever you like.

I'd rather hear something like, "We have such little deployed value at the retail level that no one wishes to contract with us unless we spend a lot of money over here (legalized entrapment codes and marketing)."

theptip2• 11 years ago

This. I've been wanting this sort of thing for ages.

It could actually be extended into a very compelling product; imagine being able to issue not only read-only tokens, but a token which authorizes the bearer to withdraw up to $100/month. Parents could issue such tokens to children for emergencies, or other such situations.

amsb• 11 years ago

It's amazing that we can grant revokable, read-only and audited access to our social accounts, but not our bank accounts. Even though the largest aggregators operate under some level of federal supervision (via FFIEC and the OCC), there is an obviously better way. TxPush (http://txpush.org) looks like an initiative in this direction. There will likely be an ongoing need for aggregators to maintain access to laggard financial institutions and possibly to buffer load on the bank servers as consumers use more and more financially connected apps.

jackgavigan• 11 years ago

It's amazing that we can grant revokable, read-only and audited access to our social accounts, but not our bank accounts.

The UK is moving in this direction. The ODI/Fingleton report into Data Sharing and Open Data for Banks[1] recommended creating a open banking API standard and suggested using OAuth, using Twitter as an example (see p24 of the report). Work has begun on defining the roadmap towards creating an API standard[2].

1: https://www.gov.uk/government/publications/data-sharing-and-...

2: http://theodi.org/news/open-banking-working-group-uk-experts...

xirdstl• 11 years ago

This seems like it would backfire. I suspect many people are more loyal to mint.com than to their banks.

jacquesm• 11 years ago

Switching banks isn't easy, unfortunately. Note how banks have very successfully managed to create systems that do not have bank account number portability built in, they even engineered them in such a way that any future desire to implement such portability will meet with very substantial technical roadblocks.

Spooky232• 11 years ago

Why not? I've ditched banks a few times. Checking is a commodity product these days... it's not like a banking relationship matters anymore.

In olden times, it might have been a pain. Now most automatic payments hit a credit card, so you aggregate the account changes at that level.

Last time I flipped to get a 1/4 point off my mortgage. I think I had to redirect my utility account and change a few online payment portals for AMEX, etc. Took about 30 minutes, and saved me about $20k over the life of the mortgage.

bovermyer• 11 years ago

I think the biggest issue with switching banks is that that lowers the average age of your accounts, which affects your credit score.

jburwell• 11 years ago

Switching banks is complete PIA. However, services like Mint could eventually make it much easier to do. Today, they aggregate and analyze data across multiple across multiple accounts. As they start get into executing transactions, it will be become much easier for people to simply "repoint" transactions.

morgante3• 11 years ago

do not have bank account number portability built in

What do you mean? I don't see how one would even conceivably bring an account number from bank to bank, let alone why it would be desirable.

In my experience, it's actually quite easy to switch banks. No more than 30 minutes tops (open account, change credit card autopay).

jarek2• 11 years ago

It's also a regulation / regulatory capture issue. The UK has a switching regulation set up so that all you have to do is go into the new bank and tell them your account number at the old bank. All scheduled deposits and withdrawals switch over with no further effort on your behalf.

(Then again, they also don't have things like paper checks anymore.)

7952• 11 years ago

Banks are in a strange kind of transition. For years they acted like a retail operation that treated finance as a consumer product. But actually their purpose in the modern world is as infrastructure, more similar to electricity or water. In that sense their is some similarity to cable companies who are fighting to avoid becoming just a dumb pipe.

laotzu3• 11 years ago

Blockbuster thought they were too big to fail too

debacle• 11 years ago

Blockbuster didn't have legislative scaffolding and bureaucracy throughout the entire world on its side.

JustSomeNobody• 11 years ago

I must be a bit odd. I prefer to manually enter all my transactions in my journal. I don't want it automated. Any time I've automated it, I have become complacent. I feel, in order to properly manage my finances, there must be some pain. Don't get me wrong, I use SW. I just don't use SW that is automated.

mwg986• 11 years ago

I think you're right and that there should be some pain. My version of this is taking a full list of transactions and tagging them individually from electronic exports. This way any expense isn't reconciled until it's tagged. This can be done mostly automatically but some are unrecognized/unique expenses. The unrecognized are the ones that probably matter the most in terms of managing my finances, dinning out, random items from amazon, etc. I have to review and recognize everything which makes me monitor the most important aspects where I might have spent my money poorly.

dwaltrip• 11 years ago

I'm leaving SF to travel around the US for 6-12 months, which means I need to switch off the local credit union that I'm currently using. I may as well choose something that will work for the indefinite future, including whereever I land next (it will be in the US).

Any recommendations? I'd prefer an organization that was less culpable for the financial crisis.

AaronM• 11 years ago

Is your credit union a member of CO-OP? this allows you to bank at any credit union in the nation that is a member. Some stuff can be challenging, like getting a loan, or getting a replacement bank card immediately. I'm living a state away from mine, with very few problems.

balls1876• 11 years ago

Why do you have to switch off the local credit union?

vinceguidry• 11 years ago

The cards generally don't work overseas.

morgante3• 11 years ago

If you're looking for a checking account, I highly recommend Charles Schwab. They've always had excellent customer service, a pretty modern tech presence, and best of all you can use any ATM anywhere in the world without worrying about fees—they'll reimburse you for any fees charged.

guelo• 11 years ago

They should be required to provide a secure token-based API. The fact that Mint has to store your bank password in plain text is asking for trouble.

balls1876• 11 years ago

Why does Mint have to store your bank password in plain text?

breischl2• 11 years ago

They don't have to store it in plain text, but they do need to store it with reversible encryption (as opposed to hashing) so that they can use it to login to the bank's website.

yvesmh• 11 years ago

Because there's no API, so they have to scrape your transactions off the bank's sites, and they have to log-in using your credentials for that.

ethbro• 11 years ago

The fact that Intuit owns Mint was a big part of the reason I finally caved and signed up. They're not inexperienced with dealing with private information.

Yes, on the "banks should be required to provide a secure, open feed" (though good luck in the one chosen resembling any modern format).

But... securing information of this kind is not rocket science. Sharding secrets into multiple tokens split across minimal service machines, etc. It's just that best practices are so rarely followed.

cpwright• 11 years ago

My bank's web portal actually provides a good aggregator service for the checking/savings/investment/loan accounts I have both there and elsewhere. I find it very convenient when I do my monthly "what are the state of my finances" spread sheet.

BankNote• 11 years ago

Banks are ruled by iron fist, old school systems that effectively get a long line of innovation only when needed. Think Cobol, 2000 year issues. Millions were spent on the infrastructure eons ago, and the idea of innovation goes exactly against what they stand up for - stingy, Scrooge type ideals. I don't blame them, but tech eventually moves around ideas like this. Think again of the automotive industry, and why don't we have 1 billion new ideas extended to the most vast product producing machine in the country ... unions, old school profit engines (pardon the pun), and the sticky idea that innovation will disrupt it. Tesla is basically the ONLY car dealer to shake the crust off, because its THAT much better of a tech innovator. Not without the fight from big-auto though. It's just how these machines work, however because banking online and new startup FDIC innovation driven banks work WAY BETTER than these dinosaurs. Lucky for me, my bank doesn't even have branches ... so I get my dough back from the ATMs I use, within reason mind you. Online services are STELLAR, because of the reinvestment into tech vs. traditional banks. Ah, I hope they ALL die to be honest.

jedberg• 11 years ago

This brings up a really important question. Are your banking transactions your's or the bank's? I know in Europe the law says that you own your transactions, but I'm not sure if the US has clarity either way.

1024core• 11 years ago

The banks care for their customers? Really??

Are these the same banks that used to charge "overdraft" fees of $35+ for a $1.50 overdraft? Where was the concern for customers then??

logn• 11 years ago

These are different departments. The people concerned about Mint come from Risk, Fraud, Security, and IT. They don't decide overdraft fees.

cdnsteve• 11 years ago

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint.

On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their own data, that they own, not the bank. A bank could create an API service with API keys specifically for these types of aggregate services to use. This could be done at first for just read only access, whereby the API does not allow you to transfer funds, etc. It would be a secure interface to access your data from third trusted third parties or your own apps.

A secure standard API would be beneficial to customers, to third party services, and to the banks that offer them. Freeing information inside of hoarding it, when it doesn't belong to them in the first place.

Credit unions could have a major advantage here if they would start using modern tech.

KirinDave5• 11 years ago

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint.

As someone who collects these daily; I'd rather not collect them. The lengths I have to go to to ensure that they're not a major risk for our product? Significant. It's not a hard problem to solve, but the question is: "do banks want to solve it?" There's not much incentive for big banks to DECREASE account stickiness, and a lot of us waiting for great aggregation tools to totally dis-intermediate the big banks from their customers 8 ways till Tuesday.

But to be honest, financial data is all sort of like this. For example, once someone has your ACH routing and account numbers, the only thing that really stops them from building a fraud factory is the fact that it's difficult to get permission to interact with the ACH network. You need to handle those with at least as much care as bank login info.

And then, there was the MASSIVE fraud spree that everyone who didn't implement yellow path validation for ApplePay opened up. I personally had well over 80k stolen from my account in less than 1 day via that outrageous fraud loop. Thanks, Apple Stores and Chase, for pretending that someone else's fingerprint constitutes my biometric permission.

On the subject of Chase, everyone in the industry was completely shut down without warning at the worst possible time by Chase. We're all pretty spicy about how it was handled.

ska• 11 years ago

In my experience (just as a client) Chase is very happy to act unilaterally and without communication. On the other hand, as an ex-client I have the option of just never dealing with them again.

xur17• 11 years ago

On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their own data, that they own, not the bank. A bank could create an API service with API keys specifically for these types of aggregate services to use. This could be done at first for just read only access, whereby the API does not allow you to transfer funds, etc. It would be a secure interface to access your data from third trusted third parties or your own apps.

My capital one 360 account does this. I can generate an api key that I give to mint.

morgante3• 11 years ago

It's a giant security risk that neither company would likely cover if someone got a hold of your login details.

Sure, but it shouldn't be the bank's decision to keep me from accessing my own customer data because it's insecure.

If they actually wanted to fix this, it would be entirely possible to provide a read-only API.

lsaferite• 11 years ago

Isn't that the basic idea behind OFX though?

I mean, role specific credentials with limited rights seems like it would work perfectly fine with the existing OFX spec.

shawkinaw5• 11 years ago

My bank already does this, to a limited extent anyway. I use (slightly) different credentials for OFX login than if I go to the website.

superuser2• 11 years ago

Giving your online account credentials to access your banking information is complete madness. It's a giant security risk

Is it? My bank requires multi-factor confirmation to set up a new payee for electronic transfers and sends several emails for any transfer. You couldn't actually steal any money just by having online banking credentials.

shawkinaw5• 11 years ago

I used Mint for a long time, but eventually decided I didn't like them having all my bank login information, including security questions. So I switched to a setup where I download OFX data directly from my banks using a Python script [1], and use Ledger [2] to track spending, balances, etc.

A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it manually. Mint's "black box" approach is good when everything works flawlessly, but you're stuck doing weird hacks if anything goes wrong or you want to do something it wasn't designed for.

Ledger, incidentally, is from the same one who is now maintaining Emacs, if I'm not mistaken.

[1] http://captin411.github.io/ofxclient/ [2] http://www.ledger-cli.org

mey2• 11 years ago

The advantage I see Mint has is they don't require OFX as they appear willing to scrape sites for content.

shawkinaw5• 11 years ago

Yeah, but the advantage of OFX is that it is read-only and can use different credentials for authentication (depending on the bank.) Another advantage I forgot to mention is that I couldn't use my bank's 2FA with Mint.

sanderjd4• 11 years ago

I have a very similar setup, except using YNAB[0]. I never felt like I really used Mint, besides just going and looking at my balances and (infrequently) thinking, "huh, looks like I'm over-budget again". With this setup, I feel like I'm taking matters into my own hands, which has had a noticeable impact on my spending and planning discipline.

Thanks for the link to your project, looks really useful!

[0] https://www.youneedabudget.com/

comrh• 11 years ago

YNAB recommends the manual entry of purchases to better understand the relationship between the things you buy and your money. This has helped me be much less impulsive and more aware of the large money sinks in my life (lunch!). Whatever setup works for you to help you budget though, it is great software.

shawkinaw5• 11 years ago

Yeah. I actually really liked Mint, before it I had no idea where my money was going. But the security stuff started to bug me, and there were mounting frustrations with Mint's inflexibility that finally pushed me to go a different direction.

Also, the first link I posted isn't my work, just a nice utility I found. I did roll my own Python for converting OFX to Ledger though, been meaning to clean that up and post it but haven't gotten around to it yet.

Terr_• 11 years ago

FYI, if you use YNAB with Chase you might find that QFX payee/memo information is garbled. If so, here's a little script that can repair the file by cross-referencing your transactions against the CSV-copy.

https://github.com/DHager/chase_fixer

jgalt212• 11 years ago

I didn't like them having all my bank login information, including security questions

I that's the sort of concerns that did in the start-up greplin. They would have access to all your password protected data for any service under the sun.

pspeter32• 11 years ago

Do you pay for the OFX access?

shawkinaw5• 11 years ago

No, all my banks/CC companies have free access. I think most if not all banks (at least major ones) do, you can check this site [1].

[1] http://www.ofxhome.com/index.php/home/directory

retube• 11 years ago

It absolutely blows my mind that people are happy to hand over their banking credentials to a third party. I would never in a billion years ever have believed it were possible for a firm to succeed predicated on that basis.

I'm pretty sure that doing that in the UK instantly nullifies any protection you have against fraud etc.

nickpsecurity3• 11 years ago

I assure you all hackers in the late 90's were saying the same thing about the online banking concept. Here we simultaneously had all kinds of Internet-related security problems in media plus banks telling us to connect our money to the Internet. (Annoyed Picard meme here)

jarek2• 11 years ago

Yeah but you technically also nullify your protection against fraud if you write your PIN on a sticky note or tell it to your partner. The question is whether a bank will use that as an argument, not whether they can.

E.g. Barclays:

"You must memorise your PIN or password ... Never give them to someone else or let someone else use them, or do anything that would let someone else use them, such as writing them down in a way that might be recognised by someone else, keeping the letter carrying a PIN, or giving someone else access to a device like a mobile phone on which the relevant details are stored."

"If you have either deliberately or with gross negligence: • failed to keep your card, PIN, password, PINsentry or mobile PINsentry generated codes, device or equivalent secure, or • failed to tell us as soon as possible that you have lost your card (especially if you think someone else might have been able to ind it) we will not refund any payments made before you tell us that it’s been lost or compromised."

baldeagle• 11 years ago

Check out https://plaid.com/ and https://github.kdc.capitalone.com/hhu373/plaid-django-app/tr...

I'm working on setting up my own 'mint' for the purpose of working with my expenses, and this is the service I'm looking into using.

Big Banks Lock Horns with Personal-Finance Web Portals

Related Stories