Oh well, until banks decide to stop allowing users to manually save .qfx files the worst they can do is make life inconvenient.
By tokenizing each account, it ensures that if a breach of any of those products were to happen, the bank authentication credentials won't be leaked.
When using Express Web connect to automate Web connect downloads from your financial institution's Web site, your user name and password are encrypted and, depending on your financial institution's procedures, will be stored on our firewall-protected servers or in your Quicken software. Your financial information is transmitted using secure socket layer technology and is encrypted, so it is unreadable during transmission. It is then stored on our firewall-protected servers and is securely transmitted directly to your desktop computer when you initiate One Step Update. Your information is confidential and is not used for anything other than providing and maintaining the One Step Update service.
http://quicken.intuit.com/support/help/account-transaction-i...
The entire world of aggregation is simultaneously really interesting and rock-boring stupid. I'm surprised we don't see more fintech startups using it more aggressively, even as I am happy this made my former endeavor more acquirable.
Expand the "Express Web Connect / Quicken Connect - Details" section underneath the comparison matrix and you will see this:
* Your login credentials are stored on Intuit-hosted servers. This makes updates faster for you.
* Your financial data is stored on Intuit-hosted servers. This provides a more complete history of your financial transactions than is typical for data stored on financial institution servers.
* We use state-of-the-art security measures to protect your login credentials and your financial data.
----
This is half of why I pay $9.99/mo to use Direct Connect with my Wells Fargo account (that, and having bill pay within Quicken is pretty handy).
Sorry to nitpick, but the bank has a legal obligation, not right - they don't have a choice other than to make sure data is correct
If the latter is the real reason they are whining then I expect they will push for a fee than can charge people who access their account through an aggregator much like they charge people who access their account through Quickbooks.
As a bank, you are a commodity. You simply store the bits that say how many resources I can consume over a moving window of time.
They absolutely charge their aggregators. Most of the aggregators can't screenscrape without permission of the aggregators. Why on earth would you think they can't? Why do you think Mint doesn't need to do MFA for so many banks and can just get away with a user-pass challenge?
This is about holding control of their customer base, plain and simple. They know everyone else, even other banks, are eager to dis-intermediate their customer base. They're spending too much money maintaining branches and offering inferior savings products to compete digitally, so they would rather delay that as long as possible.