Hacker News Reader

Comment by rendall | Hacker News Reader

I didn't understand that article. Maybe I don't have enough context.

"share their bank data with other parties"

What? Who wants to share their what now with whom? Why would they do that?

"Fintechs like Plaid, TrueLayer and Tink have founded their businesses on providing access to regulated banking data for a fee.."

What data? Aggregated? Individual banking? What regulated data? What regulations?

"Under current banking regulation, raw data must be provided for free to consumers via an official application programming interface (or API). As a result, the apps pick up the cost on behalf of their users."

What? My bank doesn't offer an API. I have no idea what that last sentance even means. What cost?

It really seems like the article assumes a lot of background knowledge. Anybody have an ELI5 link?

View on HN

All banks in the EU must offer a data and payments API. The APIs are standardised and must allow third party service providers - which themselves must be regulated - to be able to build services using these APIs. With a user's authorisation, said service provider can view transaction data or initiate a payment, for example. The specific regulation is called "payment services directive 2".

This is exactly what I miss about PSD2, a small company still can't just use an api to do it's banking, checking what money comes in and optionally (semi) automate payments. You still need to lobby your country's ministry of finance to get a license. Great for all the hot customer payments startups but useless for a company that just want to do IBAN and cut out the middle man.

This is exactly why I hate the name "Open" Banking.

Truly we need two tiers of API access, one which will only work with bank accounts we link to our API developer profile, which is easier to get access to, and another that is meant to handle third party bank data which requires ministry compliance and may need to wait longer for.

What's to stop people from building an integration that requires the API keys from the self-serve access flow? e.g. in the US people are OK with giving their password to Plaid?

> in the US people are OK with giving their password to Plaid?

They absolutely shouldn't be.

There are/were services like that here too, but what trust (or usefulness to be honest) they had will/has erode/d as a consequence.

Also you don't have to be a literal bank, the better (/with enough of an EU/UK focus) services like that will just offer the proper authentication method instead, now (since 2016 I think?) that it's available.

You can get that via banks directly, in whatever proprietary format, if they wish to provide it.

e.g. Monzo in the UK (&US?) offers a personal-use-only 'beta' API (it predated 'open' banking requirement, and they continue to say it's a developer API in beta, don't share access keys yet but one day, but basically it seems to be vapourware at this point). PSD2's 'open' banking is.. I don't know, it's something, but it's not what anybody here wants, or imagines it is from the name if they've not previously heard of it.

It might as well be a standardised Industry COBOL Interchange Specification, a copy is yours for just £25k today! Or join the 2022 edition working group for a mere £250k, and help define next year's mandatory update.

Since you mention COBOL, a lot of work is being done in COBOL to export JSON feeds exactly for this. Since the late 2000s and 2010s back-end core banking space (in larger banks) was largely about moving from disparate code to a common trunk, this, at least for friends 'lucky' enough to be connected to this, seems to be implemented as a general solution so should XTZ country decide to do their own regulatory implementation of Open Banking/PSD2 a lot of the ground work will have been done.

Indeed, why should it require an intermediary at all? Even individuals should be able to access their banks' APIs directly from their own devices.

Cofounder of Nordigen here. We built a completely free API to allow small companies check what money comes in, no additional license needed (it's done on the back of our AISP licence). We're connected to more than 1,000 banks in Europe. Here's the link: https://nordigen.com/en/products/account-information/

> What? Who wants to share their what now with whom? Why would they do that?

Accounting or budgeting services for example.

> What data? Aggregated? Individual banking?

TrueLayer & Plaid are gateways that translate bank's individual APIs into a single common one, and their clients pay them for the privilege (typically a monthly fee per active account connected).

> What regulated data? What regulations?

There are EU regulations that force each bank to provide an API to any AISP (account information services provider) or PISP (payment initiation service provider). The (A|P)ISP can request the end-user's consent (typically via OAuth) to access this data.

> My bank doesn't offer an API.

This is why I dislike the name Open Banking. It's not actually open. You have to either to through tons of regulatory BS to become an AISP or go through a gatekeeper like TrueLayer or their competitors (which will happily "lend" you their AISP license). Fortunately, there are modern banks such as Monzo or Starling which allow the end-user to use the API to access their own account, but technically this has nothing to do with Open Banking (even though it's often the same API).

I work around this sector. Big banks sell data to data brokers the same as telcos do. It's unlike Facebook selling your data because the people buying it aren't trying to target you specifically. They are looking for market trends. You are usually aggregated around your demographic. Essentially, the banks are selling the spending behaviors of demographic X. This type of anonymous data is important to businesses like Nike and Coke because it informs their advertising messages.

That is incredibly disturbing.

I also know that there are several companies trying to build alternative credit risk models in markets like India and Colombia, where many people do not have a credit history so the usual credit scoring models do not really work. In this case the data is certainly being used to target, or rather score you specifically.

If this is actually true (because it has nothing to do with Open Banking), how does this comply with the GDPR?

It complies because it's aggregated, no individual's data is involved.

> Big banks sell data to data brokers the same as telcos do.

Do they pay me for making money from me?

indirectly, by providing you with 'free' services.

Or low cost, as they are forced to do by the legislation anyway.

I can't find it rn, but I think chase sells individualized data to brokers which can then be linked to online tracking id's. Google has a program for this, it links physical and digital and they use it to verify the effectiveness of their o line ad campaigns.

Facebook doesn't sell your data.

https://www.facebook.com/help/152637448140583/

That's some high quality 1984 level newspeak you got there.

Facebook sells access to you. It's like those safe driving apps. They don't sell your data. But they sell access to conclusions drawn from your data. That's their entire business.

> What? Who wants to share their what now with whom? Why would they do that?

Barclays will send banking data directly to FreeAgent[1] which allows you to categorize the transactions and upload receipts. FreeAgent uses this information to calculate how much VAT and Corporation tax I owe to the government. Couldn't be simpler.

[1] https://support.freeagent.com/hc/en-gb/articles/360006470520...

If memory serves it's an EU directive meant to decouple handling of money from access to banking information by forcing banks to provide APIs that third parties can use on a bank customer's behalf. So you can grant an app permission to see a live view of your account balance, for example. Not sure what applications the lawmakers have in mind. Credit rating seems like an obvious application. It would maybe make it easier to circumvent credit cards for money transfer, maybe? I suspect there's a lot of hand-wavy "startups will figure something out"

> Not sure what applications the lawmakers have in mind.

Accounting and budgeting services are the most common examples.

Not answering your question but, I ran into Plaid recently as Tesla wants you to use it to pay for your car. I said "GTFO" and got a cashier's check

As others have pointed out, Plaid is service that lets people interface with your bank via one API, the Plaid API, Plaid deals with all the various banks. And Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want.

I also found out (and this is old info) that ANYONE can take money from your bank account without your permission. There might be repercussions for them later or maybe the bank has to trust them but I found this out because I signed up for Apple Pay and Apple Pay wants me to pay my bill via ACH.

https://en.wikipedia.org/wiki/Automated_clearing_house

What happened is I gave Apple my info (routing number and account number) and without the bank confirming with me that Apple had permission to take some money, Apple sucked money out of my bank account.

That's crazy to me. Those 2 numbers are on every check I've ever written.

I get that someone can charge money to me with my Credit Card info but AFAIK if it's fraud I'm only out max $50. Plus, it's not my money, it's the CCard company's money since it's effectively a loan and the fraud is their problem, not mine.

I'm sure someone with more knowledge can tell me why the ACH system is safe but I find it super scary ATM.

> Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want.

FWIW I think this is a slight misinterpretation of our privacy policy. The section on advertising basically just refers to our usage of cookies for advertising and analytics. Plaid does not share personal information without your explicit consent: https://plaid.com/how-we-handle-data/

No. You are correct. The US payment system is hopelessly insecure. Anyone who has your numbers can pull money from your account with no further authentication. Knuth had to stop writing checks for his bug bounties because of this.

https://www-cs-faculty.stanford.edu/~knuth/news08.html

Similarly, the PSD2 directive in Europe transformed the bank accounts into credit cards. With limited insurance.

This article does not make a lot of sense.

As you can see it is sponsored by Nordigen, and they try to say that open banking has some ugly and bad aspects in everything that is not the particular points of their marketing offer.

This is all about PSD2: https://www.ukfinance.org.uk/guidance/payment-services-direc...

Reply on news.ycombinator.com