This is true for even some small-town banks. I switched to Windows Phone last year and built a personal banking app that would display my financial details on a live tile. While using Fiddler to figure out the necessary API calls, I discovered that my tiny bank's Android and iOS API was actually provided and maintained by a much larger bank.

It turns out that the bigger bank has dozens of smaller banks using the very same API, and its a trivial matter of switching a URL slug to make my makeshift API work for these other banks.

It was an interesting learning experience, but I did manage to get myself locked out of my own bank account a few times while replicating the login process.

Yep, a friend of mine is building a product that exposes the private APIs that banking apps use in a developer-friendly way: http://teller.io/

That said, using your account data in that way with third parties is often against the terms of service that a customer has with their bank.

> I'm pretty sure that those are for private use

.. And do you do everything you're told? ;)

I think we put far too much weight into magic documents like Privacy Policies and Terms of Service, etc.