Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teller – API for your bank account

blog.teller.io

Post reply on HN
Print view View original

211–220 of 282 posts

Re: Teller – API for your bank account

#211

Post by vidarh »

chrisallenlane wrote: post #77
Spivak wrote: post #34

Earlier quoted context omitted.

Not without pushing out an update to all of their clients. Which presumably they would know about.

It seems like they would only find out after the update has been pushed, though - ie, after the app has been broken. Unless they have relationships with the banks now, and would be given a heads-up. Perhaps that's the case. It sounds like it may be.

Consider that e.g. Barclays randomly breaks their own mobile app for substantial subsets of their own customers. Over the last 4 years or so, the app has been broken for me more than 2 of them because they apparently consider it acceptable to whitelist phones based on their own whim (if you have one of the big brand phones, presumably it usually works, but e.g. even users of relatively well known brands like Huawei can often find their new phones won't work with Barclays for several months before it gets whitelisted).

In other words, many of the big banks have such a dysfunctional relationship to internet banking that customers of many of them have learned to deal with not being able to use the apps for long periods of time - it's hard to imagine that a third party will be perceptibly worse.

Re: Teller – API for your bank account

#212

Post by vidarh »

jorblumesea wrote: post #70
sjtgraham wrote: post #54

Earlier quoted context omitted.

It's takes banks 6-12 months to get anything into production. Also breaking APIs to thwart me has to compete with delivering new features to users. When they do change the contract, we know about it. We watch for new app releases, and proactively check.

How do you guarantee SLA uptime with that model? You won't know of any breaking changes until it hits production and when it does you will have to fix it. This may be an easy 30 minute fix and you pause transactions, or it may be a 24 hour fix and your world is broken for "forever" in api standards where 99.9X% is generally standard uptime requirements. It seems to be that any service that consumes private APIs is go…

I'm not sure you need to guarantee an SLA for this to be attractive. E.g. I've badly wanted to get automated access to my statements for ages, but not had the time to work out an approach. I'm used to my bank (Barclays) being so insanely backwards, that if Teller's API suddenly tells me "sorry, broken because your bank are morons" and the API is down for a couple of days while they work around it, I'll blame my bank, not Teller.

For comparison: I've been unable to use Barclays own mobile app for about half of the last 4 years in chunks because their app seems to whitelist phones as they decide it's worth it. On a relatively random subset of my phones over the last 4 years, it just shuts down. No error, no nothing. Their support insists nothing is wrong. Nobody at Barclays appears to give a shit that they lock customers out. The Play store is full of thousands of one star reviews from people affected. My current phone took 6 months before it suddenly started working.

In other words: If you bank with Barclays, either you accept that you'll need to have a pinsentry device on standby when you get a new phone, or you'll stand a good chance of being unable to use their service for months on end.

When I signed up for Xero for my business account, I had to provide them with a document that they had to fax to Barclays to get them to pass on transaction info. It took about 10 days to get it enabled. If only I could get my personal statements electronically as easily (maybe Teller can finally solve that).

The banks have made sure peoples expectations of them is so low that any third party service that's remotely transparent is likely to find customers are very tolerant of bank problems.

I mean, the only reason I'm still with Barclays given the above is that most of the alternatives are shitty too, and I have locked in a mortgage rate with them that I "can't afford" to give up as long as the Bank of England rate is as low as it is (tracker rate that means I pay well below inflation).

Re: Teller – API for your bank account

#213

Post by vidarh »

dabeeeenster wrote: post #13
lookingfj wrote: post #9

How does it work if not by screen scraping?

Most UK banks require a 2 factor device so probably not. Maybe there is direct access?

Many do, but the key is that the mobile apps generally only require access to 2FA for registration, so if they implement the mobile app interface they can get away with having users use the 2FA device once.

This is the case for Barclays, for example, where in fact once the mobile app is registered, that can be used as a Pinsentry (2FA) device replacement.

Re: Teller – API for your bank account

#214

Post by fweespeech »

djsumdog wrote: post #153
viraptor wrote: post #134

Earlier quoted context omitted.

> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" This response makes me angry. Every service worth attacking will have security problems at some point. You're running a store of bank credentials, which you have to have access to (as opposed to password managers for example which can store user encrypted data). Given enough time, one of these services wi…

This is what always worried me about services like Mint.

Tbh, its only worth considering for pure "credit card" services where its essentially read-only already and any damage can be attributed to fraud you can perform a chargeback against.

That being said, if you run all your spending through your credit cards except obvious notables you update manually you are golden. (i.e. Rent/Mortgage)

Re: Teller – API for your bank account

#215

Post by steingrd »

reviseddamage wrote: post #159
sjtgraham wrote: post #33

Earlier quoted context omitted.

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

>it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal If that is close to explicitly as you have stated then either 1) The senior bank people you talked to are lying to you 2) the senior bank people you talked to really don't know anything about PSD2 3) They mistated to you how PSD2 changes will affect this 4) You misunderstood what they mentioned about P…

Banks are not required to give access to any developer or SaaS, but to authorized third parties.

Authorized in this context means that the third party obtained an authorization from their local financial authorities, and that the authorization is for the type of service they are requesting (Payment Initiation or Account Information).

Re: Teller – API for your bank account

#216

Post by steingrd »

robhu wrote: post #170
jasiek wrote: post #126

Earlier quoted context omitted.

Nope. They just need to provide "an API". Got a hundred banks? That's potentially 100 integrations you'll need to do - the barriers remain in place an everyone is happy.

True, but there are only four 'big banks' Barclays, HSBC;, Lloyds Banking Group, and The Royal Bank of Scotland Group. 100% coverage might be quite time consuming, but getting most the market is not going to be excessively hard.

Perhaps four in UK, but PSD2 covers the rest of EU/EEC as well :) That's a lot of integrations...

Re: Teller – API for your bank account

#217

Post by lysp »

jimmcslim wrote: post #188

Does anyone have any insight into a PSD2-style effort in Australia? I notice that National Australia Bank is experimenting with APIs, they have a developer portal [1], with FX rates and branch location APIs currently available. Authentication, customer details and accounts APIs are 'coming soon'. [1] https://developer.nab.com.au/ourapis

There's also a long running discussion on the commbank forums (since 2013).

https://community.commbank.com.au/t5/NetBank/API-access/td-p...

However, the response is not really understood by those answering the question.

There was talk of them being required by ligislation to have an api by July 2018, but not sure what the progress of that is.

https://www.itnews.com.au/news/australian-banks-told-to-buil...

Re: Teller – API for your bank account

#218

Post by mfrye0 »

tempestn wrote: post #210
curun1r wrote: post #204

Earlier quoted context omitted.

Mint is probably the one you don't have to worry about. The service that stores credentials and scrapes bank sites is the same one that powers TurboTax and QuickBooks. Intuit spends a lot of money keeping that service secure and they're well aware of how catastrophic a breech would be. In short, that service is run out of private datacenters, not publicly available. You'd have to compromise not just Mint/TurboTax/Qui…

I don't know, if the general level of bug-ridden-ness of their products is any indication, I wouldn't put much stock in their security. There are glaring bugs in Quickbooks for example that persist year after year, having been reported repeatedly, even as they continue to release a new version every single year with various visual tweaks and seemingly not much else.

Agreed. I used to work for a division of Intuit (not financial stuff) and a lot of the dev work I saw was pretty shoddy. Lots of weird bugs constantly.

With that said, security is taken very seriously and most of the stuff I experienced was UI related. So hard to say...

Re: Teller – API for your bank account

#219

Post by kondro »

film42 wrote: post #208
kondro wrote: post #195

Earlier quoted context omitted.

Didn't Morningstar just sell you to a bank though? Is your product still going to be on the open market in 6 months time?

MX is not owned by any bank. It's still privately owned startup. We are long term in that we have many 5-7 year contracts with big name banks and add more each quarter. We offer mobile banking solutions, data categorization and budgeting tools to banks, so we Atrium is a product to sell access to the services we built to power our other products. So yes, our product will definitely be on the market for years to come.…

Sorry, don't know why I always get MoneyDesktop and HelloWallet confused. :(

Cool… keep on trucking! :)

BTW, I don't suppose you have Australian/NZ support?

Re: Teller – API for your bank account

#220

Post by ddalex »

EpicEng wrote: post #106
Zenst wrote: post #63

Earlier quoted context omitted.

Would be prudent and indeed consumer friendly if you where to go thru those TOS the banks have in conjunction with your own and provide a simple at a glance list of liability/impact. Reassure people that way and shows, you care and thought this thru beyond saying we recommend reading this and that as people are wary and equally might not understand it. Sure would take time and some effort, but would certainly return…

They'd likely be opening themselves up to huge liability if they did that though.

But they wrote in their TOS that they are not liable....
Post reply on HN