Plaid settled $58M lawsuit over alleged consumer data sharing
1–10 of 156 posts
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#2It is particularly sad how common scenarios this are for users, especially in the US. I have known how terrible applications like Plaid (and alternatives) were, but at various points have been required to use them to do something like pay my rent (this is also a very common theme in my life: I strongly dislike a certain company or app, but find myself required to use them regardless, even knowing that my usage and information will be abused).
Giving my full credentials and my security question answer in plaintext to a third party in order to 'link my bank accounts', and then having them scrape every bit of information they can from my personal banking statements and sell it is... nothing short of a nightmare scenario, from many standpoints (user security, user privacy, user education, anti-phishing, and so on).
I guess it's nice to see this class-action lawsuit, but that it amounts to an average of $0.60 per affected user is, well, not particularly inspiring with respect to my hope that things will ever get better here.
Plaid is used by many industry leaders including Venmo, Robinhood, and Coinbase. When it's not used, usually a similar alternative is. Perhaps the most frustrating part of this is that placing blame on these companies is difficult, as there's no interoperability or open banking APIs that can be used as an alternative.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#3Plaids terms are really concerning to me as a user and I’m not willing to give them my bank credentials. My main fear is that they get hacked and my credentials are used to drain my accounts. Plaid waives any liability and my bank doesn’t do much if my credentials are used to do stuff like initiate wire transfers.
Venmo is doing this weird thing where for some transactions they are saying they require plaid to get my bank credentials to log in and “verify.” Of course that breaks my first issue. But it also allows them to suck up and use all of my bank transactions forever.
Seems like a shitty tradeoff just to Venmo money to people.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#4I recently received a helpful reply about liability from an HN user who says they're a Plaid employee. Thanks @phoenixy!
https://news.ycombinator.com/item?id=27982516
While I'm still trying to understand the bigger picture implications, maybe you will find this helpful too.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#5It is absolutely crazy that in 2021, banks still don't have proper secure APIs for other software to interface with. Plaid is a major disaster waiting to happen.
Are there any banks moving in that direction? I know of exactly zero in Canada.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#6it's so frustrating that this sort of shit keeps happening.
1. banks create gap in market by not providing useful access to their customer's data by...their customers
2. regulators don't step in to fix this market failure
3. some company steps in! yay!
4. company decides that charging customers for providing a good and/or service is insufficient, they need to do something creepy with selling off the customers data
5. lawsuit after the fact to maybe stop them being dickheads and definitely enriching a lot of lawyers
why hasn't the FTC or something stepped in to make banks provide some secure read-only access?
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#7I think companies should still provide a way to link accounts via small deposits. It takes a few days, but at least you don't have to share your credentials. (This applies to US accounts, maybe there are better solutions elsewhere.)
If you use Plaid, I think it should only be if there's no other option and you change your credentials after. I've always thought giving away your credentials to a screen scraping company like Plaid was crazy.
In terms of the class action lawsuit, the only one who will see a meaningful payout from this are the lawyers.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#8Plaids terms are really concerning to me as a user and I’m not willing to give them my bank credentials. My main fear is that they get hacked and my credentials are used to drain my accounts. Plaid waives any liability and my bank doesn’t do much if my credentials are used to do stuff like initiate wire transfers. Venmo is doing this weird thing where for some transactions they are saying they require plaid to get my…
I would recommend considering a bank that supports Zelle payments. Cut out the middleman (PayPal/Venmo). Fed Instant Payments are around the corner (2023), at which point instant payments should be available ubiquitously.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#9It is absolutely crazy that in 2021, banks still don't have proper secure APIs for other software to interface with. Plaid is a major disaster waiting to happen. Are there any banks moving in that direction? I know of exactly zero in Canada.
The UK and EU have both adopted effectively what you describe under PSD2 - the UK banks in particular were forced by their competition and markets regulator (CMA) to adopt open interoperable APIs.
The end result, now it's available, is that you have 2 levels of API access. One is for access to account information (I tend to think of this as read-only access), and the other is to allow for "payment initiation" (think of it as write access, although not a perfect analogy).
An account information service provider (AISP) can do things like aggregate bank accounts into one view, across different banks. A payment service initiation provider (PISP) can create payment gateways and initiate payments against a bank account using an authenticated session (enabling direct bank payment online, without needing a debit or credit card and the associated infrastructure around that).
You can't just rock up and access the APIs though - I believe you need to get your application approved and engage with the regulator, which is probably for the better, to avoid the "app store problem" of loads of apps springing up in the API ecosystem, asking for permission, then just leeching data to third parties after you apparently consent on page 46 of their terms.
Re: Plaid settled $58M lawsuit over alleged consumer data sharing
#10It is particularly sad how common scenarios this are for users, especially in the US. I have known how terrible applications like Plaid (and alternatives) were, but at various points have been required to use them to do something like pay my rent (this is also a very common theme in my life: I strongly dislike a certain company or app, but find myself required to use them regardless, even knowing that my usage and in…
Part of the challenge is there is no great way to easily get my data out of banks and accessible in one place.
Business model aside, they do solve a real problem in a space where there are no real incentives for banks to provide their own solution.
I'd love to see a subscription-based, privacy-focused option with API access targeting the consumer personal finance crowd. I think Tiller may get some of the way there, but I'm not sure how secure they are.