Bunq already has a native api [0], only if you pay sadly, many other functions are free. I like Bunq but their app devellopment is slow, I still can't share iDeal (is iDeal only Dutch? I wonder...) requests through anything other than email and sms. Everybody is waiting for general sharing on Android/iOS.
Teller – API for your bank account
231–240 of 282 posts
Re: Teller – API for your bank account
#232Yeah no thanks. I want a banking API but I want a first party API. No way I'm trusting some random guy on the internet with my banking password.
Re: Teller – API for your bank account
#233Earlier quoted context omitted.
Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…
It sounds to me like you added a lot of detail around a core message of "yes, you may be violating your bank's ToS by using our service, please verify this by reading through page upon page of legalese in your spare time." Well... no thanks. I (and likely many others) would only consider using such a service if I had a guarantee, both from you and my bank, up front. from your ToS: >"We are not liable for any loss or…
At least in the U.K. Banks are starting to provide API's so bookkeeping platforms can securely download bank feeds without having to give a 3rd party login credentials.
Re: Teller – API for your bank account
#234Earlier quoted context omitted.
You write the equivalent info (user+pass+keycode) into a third party app.
Is it me, or does this read like a disaster in the making?
It’s better because going through the same process as the official banking apps means that you should end up using tokens etc rather than actually storing the original credentials.
Re: Teller – API for your bank account
#235Earlier quoted context omitted.
Yeah. "No cases of fraud or loss due to screen-scraping" doesn't mean your service isn't going to be the one that leaks a treasure trove of banking credentials. It's also highly probable that it has happened, it just wasn't attributed properly.
Why do you assume everything has already happened? Do you also assume Gmail passwords have already been hacked? Just asking.
Define 'hacked'. http://money.cnn.com/2014/09/10/technology/security/gmail-ha...
Re: Teller – API for your bank account
#236Earlier quoted context omitted.
http://ec.europa.eu/transparency/regdoc/rep/10102/2016/EN/SW... - see page 32 (ARRPU). Operators in different countries have different profits per user (obvious). If you have someone like T-Mobile or Orange, they'll use the proceeds from say... France, to finance their operations in say... Poland. This will put pressure on other national operators to further lower prices. Lower prices mean lower profit margins, mean…
That would be referred to the competition commission and could be blocked.
This has already happened and no one batted an eyelash. Why?Because, Orange is French and T-Mobile is German.
Re: Teller – API for your bank account
#237Earlier quoted context omitted.
Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…
> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" ...how do you know?
Key word is attributed. I guess he means no a single case proved to be caused by screen-scraping and therefor attributed to it.
I think it is likely there has been fraud like that though. It just doesn't get reported or even found out.
Re: Teller – API for your bank account
#238Earlier quoted context omitted.
To be fair, Monzo isn't either. They don't have any of their own infrastructure yet, it's just a third party rebranded prepaid card.
That's not true. They recently received a banking license ( https://monzo.com/blog/2017/04/05/banking-licence/ ) and they have built their own platform ( https://monzo.com/blog/2016/09/19/building-a-modern-bank-bac... ).
But monzo card is still just prepaid debit card. You don't get a current account.
That might change later this year when they roll out current accounts but for now it's just simple prepaid/travel debit card with mobile app.
Also not sure they have switched from WireCard yet? Last time I heard they have not switched all of their existing users to their own platform but perhaps they managed the transition already?
Re: Teller – API for your bank account
#239Once you have access to someones banking account you can typically make small transfers (up to ~£200) without second-factor authentication. So if your service get's breached attackers will have potentially the means to extract real cash through mules or wreck havoc.
Asking for credentials is no go whatever the bank is. There are ways to get some feeds even now but that requires signing some papers. Besides, I don't want to shoot down the service because this is genuinely a useful service (if it wasn't for the scrapping) but the best way to solve this problem is for banks to implement their own APIs with proper access controls that make sense in the context of the bank and the account.
Re: Teller – API for your bank account
#240Earlier quoted context omitted.
It sounds to me like you added a lot of detail around a core message of "yes, you may be violating your bank's ToS by using our service, please verify this by reading through page upon page of legalese in your spare time." Well... no thanks. I (and likely many others) would only consider using such a service if I had a guarantee, both from you and my bank, up front. from your ToS: >"We are not liable for any loss or…
Yea, unless you're developing jointly with banks, with lots of oversight and liability insurance, this is a disaster waiting to happen.
It wouldn't surprise me if it wouldn't stand up in court either. Short of having a huge banner that says "WE WON'T ACCEPT ANY RESPONSIBILITY FOR ANY LOSSES IF YOU USE ARE SERVICES, TYPE 'I AGREE' TO CONTINUE" I imagine someone could probably claim that the risks weren't sufficiently highlighted.
There's a reason every investment-related advert has to state that "The value of your investment may go down as well as up", etc.