Hacker News Reader

Comment by dewey | Hacker News Reader

This is pretty common, another one is (https://www.sofort.de) where you have to enter your bank login information on a domain that's not your bank's domain.

I'm not sure how this exists when it was common sense to tell people to not use their banking information on a site that's not the one of the bank.

View on HN

Yes, they exist for many years already, and depending on the bank they actually used to log in to your bank's web interface to do the transaction, which is the reason I avoid them like the plague. I haven't followed whether they still do that.

Doesn't Sofort actually log in to your bank website and use it as if it were a human?

As I've said in another comment it's part of an European Directive : PSD-2. Think of it the equivalent of the cookie wall but for banking.

PSD-2 does in no way, shape or form require people to enter, nor mandate banks to support people entering their banking information on third party sites.

* Strong Customer Authentication (SCA) is a new requirement of the second Payment Services Directive (PSD2), ... It will require banks to perform additional checks when consumers make payments to confirm their identity. To do this, banks may ask for a combination of two forms of identification at checkout. Examples include: Something they know (such as a password or PIN).*

[0] https://www.visa.co.uk/partner-with-us/payment-technology/st...

This is different and sofort pre-dates these requirements. They actually take your username / password and log into the bank website. It’s not just about asking some additional parameters for security or require 2FA.

Wise manages it via push notifications to their app, no need for you to enter a password or similar on a third party domain.

La Banque Postale recommends doing it with an app, this is the workaround for people without an app.

> Think of it the equivalent of the cookie wall but for banking.

That comparison doesn't really make sense. Cookie banners exist to inform you about data sharing agreements. PSD-2 regulates how third party providers and banks can work together and providing more open APIs between banks and consumer apps.

SCA is not only about card payments but it is also about paying using your bank acct for example

That being said nobody is asking passwords for paying with cards (now if you're doing a payment through your bank that's a different issue)

Reply on news.ycombinator.com