Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid settled $58M lawsuit over alleged consumer data sharing

finledger.com

Post reply on HN
Print view View original

141–150 of 156 posts

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#141

Post by swiley »

madamelic wrote: post #138
swiley wrote: post #130

Earlier quoted context omitted.

Isn't there a standard API used in the US? GNU cash talks about it some in their documentation but I've never tried using it.

Nope! US banks seem to have zero interest in doing so because it doesn't bring them money and Congress isn't interested in forcing them to. EU though is working on a solution between themselves. [0] US banks solutions range between "screw off, no scraping allowed even on your account" to (probably) "here's an undocumented SOAP API last touched in 1998" [0]: https://www.americanbanker.com/opinion/europes-new-api-rules…

Well this is what I was thinking of: https://wiki.gnucash.org/wiki/Setting_up_OFXDirectConnect

I know someone claims my bank supports it but I've never tried.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#142

Post by adrr »

jeandenis wrote: post #82
wheaties wrote: post #56

Earlier quoted context omitted.

I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will…

I understand your point (and yes we are all mere humans who like plain language). Your data goes from your bank to the app that you authorized, via Plaid. It is not sold to anybody.

Did you pull all transactions on plaid auth requests? Did you store that data to build out your risk score product? You’re standard customer(one verifying their account for an ACH pull) more than likely didn’t know all their transactions were being stored and mined. They just wanted to fund their robinhood account. That is the issue.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#143

Post by tzs »

madamelic wrote: post #135
akarma wrote: post #72

Earlier quoted context omitted.

(IANAL either) I understand and agree that part of the issue is that they, allegedly, underhandedly collected this data. My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data. From the article you linked: > Plaid would retain access to their credentials and use them to mine, aggregate and then sell users’ financial tra…

> My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data. They would kind of have to be idiots to do so, to be quite frank. Up until like a year ago, their baseline product was $500 / mo plus $x / user after 100 users (iirc) with a 12 month contract. Plaid has basically no competition, is worth billions and was almost a…

> Oh, also, if people are so terrified of Plaid, they should write to the Congresspeople and ask them to write a bill to force banks to write & provide REST APIs.

Why REST? Yes, I’d certainly rather call rest APIs than, say SOAP APIs, but do really want Congress specifying that much technical detail?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#145

Post by didntknowya »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

i don't get why you'd settle then. is this just denying it on technicalities?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#146

Post by xyst »

Personally, services that ask for your bank account credentials are a “no go” for me. The passwords themselves are likely stored securely, but the fact they are stored at all is concerning.

All it takes is a bad actor within the company to re-write the screen scraping to then impersonate the users and have them wire out money to a foreign bank account. Some anti-fraud systems might catch this activity but for people that use the wire system on a frequent basis it might go unnoticed.

Or they may screen scrape the information and sell it on the black market. Wouldn’t be too hard to target a specific group (elderly, retired) since you already have their bank credentials which subsequently has reliable/verified demographic information and account balances.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#147

Post by thallium205 »

jeandenis wrote: post #81
akarma wrote: post #58

Earlier quoted context omitted.

Thank you for the response — I know you're likely very restricted in what you can say here, but: You just settled a claim that you sold customer transaction histories, and from the article linked, the plaintiffs' lawyers claim that you have agreed to implement meaningful business practice changes to remediate these issues. (1) If you've never sold transaction histories, why settle a lawsuit alleging that you sold tra…

You’re right that I can’t write much (legal, PR team say hello). The bottom line point is, we don’t sell data and that’s not the main allegation. The main allegation is that people didn’t understand that we were part of the flow of connecting banks to apps. We disagree. Before 2017, there was a whitelabel experience of Plaid that didn’t say “Plaid”, didn’t have the Plaid logo, etc. We still stand by our belief that o…

Pre-2017 Plaid was awesome. You were able to just feed in a username and password of a bank account you collected with your own UI and it would spit out its transactions.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#148

Post by d110af5ccf »

drewmol wrote: post #84
ve55 wrote: post #2

It is particularly sad how common scenarios this are for users, especially in the US. I have known how terrible applications like Plaid (and alternatives) were, but at various points have been required to use them to do something like pay my rent (this is also a very common theme in my life: I strongly dislike a certain company or app, but find myself required to use them regardless, even knowing that my usage and in…

> Giving my full credentials and my security question answer in plaintext FWIW: I've resorted to using a formula to derive my security question answers from the real answer (kept secret) and the text of the question itself. This seems to help mitigate the damage of the q's and a's getting exposed.

I don't provide honest answers to them and discourage my family from doing so as well. I simply treat them as an additional set of passwords to be written down using pen and paper.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#149

Post by scottydelta »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

While I have you here, as a developer of a financial product myself and wanting to use something to let my users connect their bank accounts to my product via plaid, let me tell you sir that your pricing strategy sucks. There is no way for a developer to pay for plaid use on per user basis and your service cannot be used without having to pay like minimum $500 to you every month even if I have like 10 users. So basically your pricing is hostile towards startups.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#150

Post by ericwooley »

tzs wrote: post #143
madamelic wrote: post #135

Earlier quoted context omitted.

> My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data. They would kind of have to be idiots to do so, to be quite frank. Up until like a year ago, their baseline product was $500 / mo plus $x / user after 100 users (iirc) with a 12 month contract. Plaid has basically no competition, is worth billions and was almost a…

> Oh, also, if people are so terrified of Plaid, they should write to the Congresspeople and ask them to write a bill to force banks to write & provide REST APIs. Why REST? Yes, I’d certainly rather call rest APIs than, say SOAP APIs, but do really want Congress specifying that much technical detail?

Yes, that would be fine. As long as security is covered. Mandating a standard API would be awesome.
Post reply on HN