Hacker News Reader

Comment by sangnoir | Hacker News Reader

If you ever added your US bank account to Coinbase by giving it your online banking credentials(!)[1], you might want to know that your financial/banking information was crawled (income, costs, average balance), and is available for resale[2] to 3rd parties.

1. This is very, very, very bad for security, but is only possible because US interbank transfers are way behind the rest of the world (including 3rd world countries). Everywhere else, all you need to transfer money is the name of the bank, account holder and account number.

2. see "Products" on https://plaid.com. Plaid provides Coinbase's bank integration.

View on HN

Plaid co-founder here. We don't resell data. In the case of Coinbase, they're setting up ACH transfers (see Auth on our products page), to avoid the 3-5 day delay in connecting a bank account for ACH.

> We don't resell data.

There must be some confusion on my part, because I consider this product (https://plaid.com/products/income/) as selling the income data, I'm guessing it's unrelated to Coinbase.

In any case, are you able to unequivocally state that you do not collect this data for coinbase users, even if it's not for reselling? I know you might have good intentions, but there's no telling where that data will end up once it's collected (past the point of your 'exit' event).

Our Income product is distinct from Auth, and not used by Coinbase. The only way for a consumer's Income data to be collected, analyzed, and sent is when the consumer directly permissions an application to receive it.

Let's say you're applying for a loan via a lender that's a Plaid customer and you want to verify your income. In that case, you'd have to link your bank account with that lender (via Plaid), giving that lender permission to collect data about your Income. There's no way for that lender to get your income (or any other) data from Plaid without you explicitly connecting your account.

> Everywhere else, all you need to transfer money is the name of the bank, account holder and account number.

Actually here only the IBAN account number is required (and it's used everywhere). Bank is inferred from that and it's not stricly necessary to give account holder's name.

> Everywhere else, all you need to transfer money is the name of the bank, account holder and account number.

I'm curious where you got this bit of information? All I need to transfer money in the US is a routing number and account number.

> All I need to transfer money in the US is a routing number and account number

While this is true, Routing + account numbers are less useful as this information can only be shared with trusted parties because anyone with this information can trigger a debit(!) against your account. For all the other countries I know, the worst anyone can do is deposit money into your account.

Reply on news.ycombinator.com