Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fintech startup Plaid raises $250M at a $2.65B valuation

techcrunch.com

Post reply on HN
Print view View original

101–110 of 143 posts

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#101

Post by astura »

xtrapolate wrote: post #48
chatmasta wrote: post #29

Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…

> "you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account" So your username and password are just kept in some internal database somewhere? The scrapers probably decrypt the credentials in-memory. Also - "scraping" data off of an undocumented API sounds risky. How can I guarantee a "scraper" won't accidentally mess something up for me?

Well Mint messes up all the time, transactions are not updated even though Mint says its up to date, transactions are listed multiple times, etc. It's mildly inconvenient, but not really "risky." Is Plaid and other bank scraping services used for anything important?

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#102

Post by astura »

pmart123 wrote: post #47
whockey wrote: post #14

Earlier quoted context omitted.

Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/

I do think these aggregated services are a net benefit to the fintech ecosystem overall. However, any service that uses a Plaid type service still could be selling transaction data to third-parties. For instance, Acorns: https://www.acorns.com/privacy/ >>> Acorns uses Plaid Inc. (“Plaid”) to gather your data from financial institutions... >>> Acorns and Empyr will use transaction information from your Acorns debit ca…

That means they are only sharing data from your Acorns debit card, not your external bank accounts. The Plaid part is separate from the debit card/Found Money Plus part.

You also omitted a key quote:

>when you activate your Acorns debit card, you will be asked to enroll in Found Money Plus, a card-linked offer program offered in partnership with Empyr.

The Found Money Plus program is only for transactions on the Acorns debit card, and it is small bonuses for specific spending, for example, 10% cash back at Starbucks. It looks like a company called Empyr organizes these campaigns for the card link offers.

The Acrons debit card is also optional.

If you're getting cash back on a transaction you know the price is sharing your purchases, this concept isn't really new.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#103

Post by astura »

root_axis wrote: post #73
whockey wrote: post #14

Earlier quoted context omitted.

Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/

The product is obviously amazing, and I know for a fact that it's creating credit opportunities for consumers with credit history that may not accurately reflect their current financial status, but there is an insidious aspect to the product: the 6 months of future access to transactions and banking information. Most consumers don't realize they're giving this up when they use your product and I believe they would be…

> the 6 months of future access to transactions and banking information. Most consumers don't realize they're giving this up when they use your product and I believe they would be much less likely to use it if they were aware.

Can I ask what makes you believe that? Why would someone be A-OK with sharing the previous six months of account transactions but balk at sharing the next six months of account transactions?

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#104

Post by sjtgraham »

writepub wrote: post #70

It seems disingenuous for the banks to not provide an API spec, and then invest in and present Plaid as an alternative. This is not a technology problem, this is about entrenched players making a buck wherever possible, without doing the logical thing. I'm glad Europe has defined an API for it's banks to avoid this from happening there

> I'm glad Europe has defined an API for it's banks to avoid this from happening there

Except it hasn't. If you're referring to PSD2, that is not what that is at all.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#105

Post by ceejayoz »

kerryfalk wrote: post #100
bdcravens wrote: post #86

Earlier quoted context omitted.

It fits 100% in what he's saying. The API grants the developer of the application access to the account history of whoever's logged in. This in no way establishes they are selling anything to any third-parties.

The developer pays for that access. The developer is a third party. They're buying transaction data. It's explicitly stated within their sales page and directly contradictory to the statement he made above.

That's a silly framing.

The developer is purchasing the technological infrastructure to deliver the data a single specific user has opted to provide to them.

Claiming the developer is a third party is like claiming I'm a third party when I order off Amazon, and that the USPS is the actual customer.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#106

Post by ceejayoz »

nitrogen wrote: post #66
rco8786 wrote: post #57

Earlier quoted context omitted.

What write access would there be? Obviously this is a hugely sensitive service, I’m not denying that. But there’s a way to do it right and it seems that Plaid is attempting to do that. So I’m not ready to declare them evil before they actually do anything evil.

Many (most?) banking websites allow transferring money through the UI. A screen scraper technically has the same access. Unfortunately the current approach of the major aggregation players is the only way to motivate the banks to give customers access to their own data through more reliable means.

> A screen scraper technically has the same access.

Sure, but the developer using Plaid's services doesn't.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#107

Post by ceejayoz »

randomacct3847 wrote: post #59
hn_throwaway_99 wrote: post #30

Earlier quoted context omitted.

Edit: I stand corrected, I didn't think you get full account number access but you do. Leaving original comment below. They don't expose bank numbers though, that's kind of the point. Developer access is all tokenized. That said, plaid does give you access to tons of detailed financial transaction data, and it's easy for companies to tie this to PII in their own systems, and I'm sure many of those companies have less…

Nah that’s not true. https://plaid.com/products/auth You get the full routing and account number with the Auth product - that is how you push and pull funds as a developer to a customer’s account.

I'd note that you give those same numbers to every yahoo you ever write a check to. The US checking system is terrifyingly insecure in that regard.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#108

Post by sjtgraham »

jaymzcampbell wrote: post #71
chatmasta wrote: post #29

Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…

It always blew my mind that services like Yodlee ( https://www.yodlee.com ) worked that way. I can understand it from the point of view that no traditional bank was set up to allow structured access but it never felt right to me. In the UK there is a big push around "open banking"[1] which will bring this into the 21st century and allow for proper programmatic access to data. It's still in it's infancy but the sector…

Open Banking and PSD2 are both complete failures. Who is in market with a decent product built on it? Nobody is. What people need to realise is that 1st party APIs are completely at odds with the incentives to maintain the status quo, i.e. they pose an intermediation threat and in the worst case relegate banks to mere utilities with zero margin. Furthermore a bank will never use it's own public API in it's own products, hence there being zero downside for exposing a shitty one. The only way this is will happen is if 3rd party companies in the market force it to.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#109

Post by sjtgraham »

smnrchrds wrote: post #60
SilasX wrote: post #36

Earlier quoted context omitted.

That ... sounds like it violates every bank's ToS out there, and not the abusive buried-in-fine-print part, either. Every bank could, quite reasonably, cut off your access for this.

> bank could, quite reasonably, cut off your access for this. It's worse than that. Sharing passwords with third-parties typically "voids the warranty." If money is stolen from your account, the bank can deny reimbursing you because giving a third-party your password voids their zero-liability guarant guarantee.

This is actually false in many jurisdictions, including the entirety of Europe.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#110

Post by astura »

elvirs wrote: post #68

I looked into plaid+stripe solution for our ACH payments need and after playing around with it a little I just didn't feel like I can put that in front of my clients and tell them 'Yeah put in your bank login and password on our website to make the payment, we promise it's secure'. Their solution didnt sell with me and I went for Stripe ACH where they make microdeposit and customer has to verify the amounts. Even Pay…

Every service I've used where you can verify your account with your bank's username/password had it as an option, not required.
Post reply on HN