Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Secret API of Banks

gduverger.com

Post reply on HN
Print view View original

61–70 of 257 posts

Re: The Secret API of Banks

#61

Post by yurishimo »

Posts like this make me pretty excited to be a customer of a "tech-y" online bank. (In my case, Simple, not shilling, I just like them)

Theoretically, these banks with great mobile apps are one step away from giving you API access once it's needed/wanted by enough consumers. Technically, your phone is doing it under the hood already.

Simple uses React for their web interface, so I imagine they have nice JSON APIs for all of the data already.

There was a site advertising developer managed bank accounts last year, https://root.co.za/, I think it's also a cool idea.

Re: The Secret API of Banks

#62

Post by solenya »

sjtgraham wrote: post #59
solenya wrote: post #56

Earlier quoted context omitted.

"...the regulation does not mandate any kind of API format.." That isn't true. Anybody which wants to be in the UK Open Banking Group (mandatory for the 9 biggest banks) must follow these very strict specs: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...

Not true. The spec is loose, many fields are not mandatory, and the "conformance suite" only tests the security profile, not anything related to the schema. Even with that minimal level of scrutiny as of last month none of the CMA9 were compliant with the CS.

Sounds like a problem with the conformance suite then?

A number of the CMA9 were given a deadline extension, so there is no reason for them to be compliant yet.

Re: The Secret API of Banks

#63

Post by technofiend »

I've had to do something similar when a bank decided that CSV history was limited to a much shorter time period than PDF documents. Nothing a little python-driven OCR can't handle. But it was stupid I had to employ such measures in the first place.

Re: The Secret API of Banks

#64

Post by achandlerwhite »

Look into OFX for pulling down account and transaction data It’s the api that TurboTax, Quicken, and others have used for years and you can use it too. It’s a little outdated in its design and implementations are hit or miss on the banking side. But for most large banks it works.

Re: The Secret API of Banks

#65

Post by Nursie »

Rjevski wrote: post #42
dewey wrote: post #8

For those in the EU there's something interesting coming next year, banks need to provide open API to interact with each other: https://thenextweb.com/worldofbanking/2018/06/27/openbanking... Already right now in Germany there are a lot of banks that share a common API format which is why there are a lot of banking apps where you can just log into your bank and don't need bank specific apps. It's called HBCI / FinTS…

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

So you need to be vetted and approved before being allowed access to some of people's most private and secure data.

Why is this a problem exactly?

Re: The Secret API of Banks

#66

Post by sjtgraham »

solenya wrote: post #62
sjtgraham wrote: post #59

Earlier quoted context omitted.

Not true. The spec is loose, many fields are not mandatory, and the "conformance suite" only tests the security profile, not anything related to the schema. Even with that minimal level of scrutiny as of last month none of the CMA9 were compliant with the CS.

Sounds like a problem with the conformance suite then? A number of the CMA9 were given a deadline extension, so there is no reason for them to be compliant yet.

It's a problem with governance.

Re: The Secret API of Banks

#67

Post by orf »

bhhaskin wrote: post #60
orf wrote: post #38

Earlier quoted context omitted.

*in America Banks provide an API in Europe. In fact it's a legal requirement that's coming into force in 2019, and there are a lot of 'mobile-first' banks like Monzo and Revolut which make this entirely un-needed in the first place (providing spending exports, decent analytics, push notifications, etc etc). Welcome to the future. Contact your local politician if you want to join us. Maybe also ask about chip and pin…

Sure, but as other users like Rjevski have pointed out the PSD2 API is going to be nearly impossible for the common person to use. Unless you want to become pretty much PCI-DSS certified.

So you're surprised or concerned that applications that wish to extract financial data abour consumers programmatically from their bank accounts need to conform to regulations regarding the storage of said data?

Oh no. What a travesty.

Re: The Secret API of Banks

#68

Post by sjtgraham »

Nursie wrote: post #65
Rjevski wrote: post #42

Earlier quoted context omitted.

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

So you need to be vetted and approved before being allowed access to some of people's most private and secure data. Why is this a problem exactly?

Do you think it's appropriate an app doing something as trivial as calculating much you spend on Starbucks each month is now a regulated activity? I don't.

Re: The Secret API of Banks

#69

Post by baloki »

sjtgraham wrote: post #68
Nursie wrote: post #65

Earlier quoted context omitted.

So you need to be vetted and approved before being allowed access to some of people's most private and secure data. Why is this a problem exactly?

Do you think it's appropriate an app doing something as trivial as calculating much you spend on Starbucks each month is now a regulated activity? I don't.

If that app has access to all my other transaction history, maybe a little, yes.

Re: The Secret API of Banks

#70

Post by avianlyric »

orf wrote: post #38
misterbwong wrote: post #18

This is very clever but makes me sad. It’s 2018 and the best, cleanest way of monitoring and storing my own transactions programmatically is by scraping an email.

*in America Banks provide an API in Europe. In fact it's a legal requirement that's coming into force in 2019, and there are a lot of 'mobile-first' banks like Monzo and Revolut which make this entirely un-needed in the first place (providing spending exports, decent analytics, push notifications, etc etc). Welcome to the future. Contact your local politician if you want to join us. Maybe also ask about chip and pin…

With Monzo you can just use IFTTT[1] for simple stuff like this, and the API[2] for complicated stuff.

I personally use the API to automatically add flat bill directly to Splitwise.

[1] https://monzo.com/features/ifttt/ [2] https://docs.monzo.com

Post reply on HN