Teller – API for your bank account • Hacker News Board

Re: Teller – API for your bank account

#31

Post by thibaut_barrere » Wed, Jun 21, 2017, 5:48 PM UTC

alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

It's the same in France, yet some aggregators (e.g. Bankin) are using those credentials directly (and afaik the risk is handled via some sort of insurance).

I'm personally waiting for the PSD II law to be deployed (see https://blog.teller.io/2016/04/26/tauth.html) in order to have clear-cut protections & boundaries, before leveraging Bankin or similar (Teller) as a SaaS product builder.

Re: Teller – API for your bank account

#32

Post by jorblumesea » Wed, Jun 21, 2017, 5:50 PM UTC

sjtgraham wrote: post #15

lookingfj wrote: post #9

How does it work if not by screen scraping?

It works by using the same private APIs that the bank's own mobile app. We reverse engineer their app, work out the API contract, implement our client, and normalize the data. Reverse engineering mobile APIs is a superior strategy to screen-scraping because: - they already return structured data - the security model for that channel is different, e.g. no need for 2FA all the time so truly unattended use cases are pos…

Wow, really? Do the banks know about this? What's to stop them from changing the contract?

This is so insanely risky...

Re: Teller – API for your bank account

#33

Post by sjtgraham » Wed, Jun 21, 2017, 5:50 PM UTC

alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

Hi,

Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping"

Secondly, we have ongoing dialogue open with every major UK bank at very senior levels, from C-level down. We want to help banks deliver these APIs. Formal agreements with banks are a key strategic objective for Teller, but they only started returning my calls once I'd broken their apps and took their APIs. The market can't wait for the banks, developers and users want new choices, apps and service now.

Re: Teller – API for your bank account

#34

Post by Spivak » Wed, Jun 21, 2017, 5:51 PM UTC

Alupis wrote: post #27

clappski wrote: post #20

Earlier quoted context omitted.

This all sounds like it could potentially be illegal, have you spoken to a lawyer and cleared it all?

Or potentially broken easily - since these are private API's that the bank is free to change whenever they feel like it.

Not without pushing out an update to all of their clients. Which presumably they would know about.

Re: Teller – API for your bank account

#35

Post by llsf » Wed, Jun 21, 2017, 5:52 PM UTC

sjtgraham wrote: post #10

jsk2600 wrote: post #7

This is interesting and has great potential to grow when PSD2 goes live in EU (early 2018). I wonder what authors plans are regarding this.

My hypothesis is that PSD2 will not be the golden opportunity everyone hopes. Banks are an oligopoly and unfettered open access to their customers via open APIs is potentially a disaster for them. They have little to gain and everything to lose. When you consider this and then expect incumbent banks to act in their self-interest it follows that they will act to subvert the impact of PSD2, e.g. by fragmentation, lobby…

Removing roaming fees for all European telecom operators was also a something that they had little to gain and everything to lose. But, here we are. From my understanding SEPA is getting implemented. I could see PSD2 following the same path. Some banks will drag their feet, but it is a pandora box situation, as the banks that will implement PSD2 first might get all the apps attention and love, potentially driving new customers. Let's see next year how PSD2 adoption pans out...

PSD2 explained: https://transferwise.com/gb/blog/what-is-psd2

Re: Teller – API for your bank account

#36

Post by problems » Wed, Jun 21, 2017, 5:52 PM UTC

sjtgraham wrote: post #15

lookingfj wrote: post #9

How does it work if not by screen scraping?

It works by using the same private APIs that the bank's own mobile app. We reverse engineer their app, work out the API contract, implement our client, and normalize the data. Reverse engineering mobile APIs is a superior strategy to screen-scraping because: - they already return structured data - the security model for that channel is different, e.g. no need for 2FA all the time so truly unattended use cases are pos…

I've used similar to scrape real estate data. Reverse engineering mobile APIs is often the most consistent way to get programmatic data access these days. Just grabbing a bit of data as a user this isn't a big deal - but I wouldn't want to base my business around it, it seems like there are too many opportunities for that to blow up in your face.

What happens if the banks realize you're doing this and just block your IPs? What happens if they decide to go after you legally because you reverse engineered their applications and are benefiting from it commercially - you'd have a decent argument, but are you prepared to go to court with it?

Then again I guess the screen scrapers have gotten away with it for a fairly long amount of time, so maybe it's not a concern...

Re: Teller – API for your bank account

#37

Post by drglitch » Wed, Jun 21, 2017, 5:54 PM UTC

JohnnyMneunomic wrote: post #29

foodstances wrote: post #19

How is this different than something like https://plaid.com/ ?

Or any different from Quovo ( https://www.quovo.com/ ) if you were pulling both bank data and brokerage data?

Teller is for UK, whereas both of these are in US. As GP points out Plaid currently does not have any brokerage data (beyond simple account balances) - only yodlee and Quovo do.

Re: Teller – API for your bank account

#38

Post by markbnj » Wed, Jun 21, 2017, 5:58 PM UTC

foxylion wrote: post #22

As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.

As an American who founded a software company in the online banking sector 20 years ago I can tell you that my experience at that time was that banks here had no interest in making it easier for 3rd parties to get between their customers and their own branded offerings. Microsoft and Intuit tried to promote a standard "API" for banking back then (OFC/OFX) that got very little support from institutions at the time and since. I think basically the only way this would come to pass in the U.S. is through regulatory action, which seems unlikely in the current political environment.

Re: Teller – API for your bank account

#39

Post by pricechild » Wed, Jun 21, 2017, 5:58 PM UTC

sjtgraham wrote: post #33

alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

Anecdotally, I've seen banks claim the reason for $something_bad was a virus on a chromebook.

Whether or not there's 'been a single case of fraud or loss attributed to "screen-scraping"', I believe most banks are more than happy to blame you by default and make it difficult/expensive to resolve.

Re: Teller – API for your bank account

#40

Post by mistermann » Wed, Jun 21, 2017, 5:59 PM UTC

foxylion wrote: post #22

As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.

You should come visit Canada, the level of service we get from our oligopoly of banks would make you cry. They would NEVER support a service like this as it would possibly make their customers happy.