Fintech firm Plaid reaches $65M settlement in class action privacy lawsuit
plaidsettlement.com
plaidsettlement.com
"Plaid has never adhered to the standard and secure OAuth procedure for the critical process of having consumers log into their bank accounts. Instead, for the first several years of Plaid’s operations, Plaid arranged for its fintech clients to collect consumers’ bank login information and then pass that information to Plaid, which then approached the banks directly. In or around 2016, Plaid (belatedly, given the security risks) jettisoned this process for one even more beneficial to Plaid. In or around 2016 Plaid implemented a method to mimic the OAuth procedure, but Plaid’s method differs materially from a true OAuth process. Under this current system, Plaid “directly collect[s]” credentials from the consumer. According to Hockey, the goal was not to eliminate the security risk Plaid itself had created, but to “centralize[] that risk” at Plaid."
and...
"With access to information going back up to five years, Plaid has taken detailed banking information for thousands of transactions for each consumer—3,700 transactions on average— that shows users’ healthcare, educational, social, transportation, childcare, political, saving, budgeting, dining, entertainment, and other habits, with an average of 1,750 unique geolocations to which the transactions were mapped."
Among them is the accusation that Plaid used user's bank account credentials to download and harvest 5 years worth of transaction data on every user, regardless of their need for that info -- then sell it in aggregate. This was purportedly their business model. Apps using their API include Stripe and Venmo, about 200 million users in total.
A couple of HN posts are mentioned in the suit(!)
Related:
https://news.ycombinator.com/item?id=5216710
https://news.ycombinator.com/item?id=11939103
https://news.ycombinator.com/item?id=17692291
Lawsuit doc (PDF):
https://angeion-public.s3.amazonaws.com/www.PlaidSettlement....