Is Plaid, a service which collects user’s banking login information, safe to use?

Question

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid, not their bank. Then, Plaid accesses the user’s bank account with those credentials on the user’s behalf to get information. Plaid provides an API for websites and apps to easily access this banking information.

In addition to Privacy.com, plenty of other popular services use Plaid, including Venmo, Robinhood, and Coinbase.

Despite the popularity, this service appears to break two "fundamental" Internet security rules:

1. Never give credentials to a third party. The standard is to redirect the user to a login page on the website of the service providing the login. Plaid doesn’t do this, instead providing the login form on their own website. Even worse, Plaid allows services to embed the form in their websites (as an iframe). It’s not possible for casual internet users to tell the difference between this and an “unsecured” form on some random website, so this appears to be encouraging bad security practice. Worse still, Plaid provides a login page that looks very official, showing the bank logo and using the bank’s color scheme.
2. Never store passwords in plaintext. The only way for Plaid to access bank account details is with the password, and since my banking password was only required by Plaid once, they must be storing it in plaintext, or "encrypted" but convertible to plain text, so they can continue to use it to access my account.

The problem seems to be that most banks do not provide an API to retrieve customer data, so a service like Plaid (and all the services that use Plaid) simply wouldn't be possible without breaking these "fundamental" security rules. But I'm not convinced that's justification for breaking them. If it's not possible to do it securely, should it be done at all?

My confusion here is that all of these services are "legitimate". None of them are scams; they're all providing a valuable service and have a solid reputation. Plaid has raised billions in funding!

I would think with Plaid using bank logos to make their “fake” bank login forms look legitimate, banks would be after Plaid with lawsuits. But apparently some of them are investors! On Plaid’s website Citi, American Express, and others are listed as investors. It appears that banks aren’t against this bad practice, and are, in some cases, actually encouraging it.

This makes me think that I might be missing something. Maybe Plaid has some special access to banking systems and it isn’t as bad as it seems. On the other hand, maybe Plaid’s reputation is held up only by the fact that they haven't been hacked yet. If (when) they are hacked it will be devastating, since the worst case scenario means the leaking of millions of user's active bank usernames and passwords. Also, many banks don’t protect users if they knowingly gave their credentials to a third party, so a lot of people could lose a lot of money. But if that's the case, wouldn't banks be working to stop Plaid and protect their customers?

I think many of the services provided by Plaid are neat and would like to use them, but if my suspicious here are correct I don’t think I can do so while remaining secure. Of course, I hope I’m completely wrong here and Plaid has some way to operate securely.

So, does Plaid have some special access to banking systems, or is it using user passwords to log in to bank accounts, which requires storing them in plaintext (or convertible to plaintext) and convincing users to give their credentials to a third-party, encouraging bad security practice?

If it’s the latter, I’m afraid I’ll have to pass on Plaid services for now and consider my banking password compromised.

Answer 1

I want to point out that despite Plaids apparently honest attempts at security, their approach is a privacy nightmare, as you give full access to Plaid, to all and every single information your bank has on you, including loans, funds, investment accounts, credit card statements, address, etc. This makes Plaid differ substantially from other payment services, such as PayPal, as they only have your account number.

If you don't believe me, here's their data collection description from their privacy statement (Effective Date: February 22, 2021, my italics):

Information we collect from your financial accounts. The information we receive from the financial product and service providers that maintain your financial accounts varies depending on a number of factors, including the specific Plaid services developers use, as well as the information made available by those providers. But, in general, we collect the following types of identifiers, commercial information, and other personal information from your financial product and service providers:

• Account information, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, account number, routing number, and sort code;

• Information about an account balance, including current and available balance;

• Information about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;

• Information about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;

• Information about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;

• Identifiers [NB: SSN?] and information about the account owner(s), including name, email address, phone number, date of birth, and address information;

• Information about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction; and

• Professional information, including information about your employer, in limited cases where you’ve connected your payroll accounts or provided us with your pay stub information.

• The data collected from your financial accounts includes information from all accounts (e.g., checking, savings, and credit card) accessible through a single set of account credentials.

Also note how the scope of the information collected has expanded over time, by looking at the previous revisions of this answer.

To make matters even worse, they can share all that information with their customers, i.e., the company that wants you to link with them. That means that when, e.g., your rent is paid via Plaid (my landlord uses a service that relies on Plaid), all of that information may be shared with that service! And while they, in turn, may not distribute that data further, you now have to trust another party that they are able to keep your data safe.

Again, here's the relevant excerpt from that privacy statement (again, my italics):

How We Share Your Information

We share your End User Information for a number of business purposes:

• With the developer of the application you are using and as directed by that developer (such as with another third party if directed by you);

• To enforce any contract with you;

• With our data processors and other service providers, partners, or contractors in connection with the services they perform for us or developers;

[...]

• In connection with a change in ownership or control of all or a part of our business (such as a merger, acquisition, reorganization, or bankruptcy);

• Between and among Plaid and our current and future parents, affiliates, subsidiaries and other companies under common control or ownership;

• As we believe reasonably appropriate to protect the rights, privacy, safety, or property of you, developers, our partners, Plaid, and others; or

• For any other notified purpose with your consent.

Answer 2

So, does Plaid have some special access to banking systems, or is it using user passwords to log in to bank accounts, which requires storing them in plaintext (or convertible to plaintext) and convincing users to give their credentials to a third-party, encouraging bad security practice?

Plaid, and many other services (Mint comes to mind), are storing your passwords and sometimes security questions in an accessible (hopefully, reversible encryption, not plaintext) format.

Is this poor security practice? Yes.

Is there a realistic alternative? No.

Financial systems in the US almost never support any sort of federation or open banking APIs. There is no regulatory requirement or incentive for them to do so. There is no financial incentive for them to do so, as permitting 3rd parties to incorporate their data into value-added services does not benefit them, and may harm them if the 3rd party is chosen over homegrown value-added services.

The good that can be said of Plaid is that by providing a standard middleman service that's used by multiple front-ends and trusted by significant back-ends, they're reducing the number of people trying to re-invent that particular wheel. With no particular evidence, I'd rather someone specialize in this dirty job, if it needs to be done.

You, the consumer, are left with the choice of participating in this less-secure practice, and getting value-added services and inter-operation between accounts, or avoiding these services and the benefits they may offer. Enjoy!

(Actually, with Privacy.com, you have another option - you can link your back-end bank account as an ACH source using your bank routing number and account number. You may need to contact support to set it up, but it is an option. That's about as insecure as writing a check.)

---

Rant:

It's ridiculous. Wells Fargo, for example, allows you to create read-only sub-accounts - exactly what we'd want if we're handing credentials off to a 3rd party! However, those sub-accounts cannot be used with 3rd parties, because of the way their authentication is set up. It's like banging your head against gravel, looking for a financial that has a well-thought-out security and inter-operability model.

I understand that Capital One is actually trying to do this right, but haven't played with it myself.

---

Minor update, 2021: Improved movement towards APIs, in part because it will allow banks to limit what information a third party has access to. Interesting article here.

Answer 3

Plaid has become safer to use with their my.plaid.com portal (in beta as of November 2021), which you can use to manage your connections.

You need to sign up with your phone number, and Plaid will tell you right away if it has any connections linked to it. (I did attempt to sign up and got "We didn’t find apps or accounts connected to XXXX", even though it's the number I use with all my financial institutions, and I do recall giving up on the safer microdeposits option due to time constraints once.)

You can also send a data access or deletion request.

I went through Plaid's access request procedure to see what data Plaid had on me. TL;DR - completely useless.

They had an... interesting KYC process. It requested only sane PII (ID but with the address obscured; no SSN) but not so sane data:

"A complete list of financial institutions (e.g., banks or brokerage firm names) you have currently or previously connected via Plaid."

So they were requesting what I was trying to find out. I've been using all sorts of financial apps for many years. How could I possibly provide a complete list of those I've ever connected via Plaid? Also, they asked for all of this, including the picture of the ID, over insecure email. No secure dropbox was provided.

In the end I received an archive with my data. It was in JSON format (which may be slightly cryptic for those less technical), and... completely useless.

The data Plaid had on me was my own bank accounts. Thank you very much, I know about those. What I wanted to know is what other financial apps and services knew about me, but that was completely missing.

All in all, requesting my data from Plaid was a giant waste of time.

Answer 4

Yes, Plaid is safe. They don't store the password, they create a "bank relation" between the bank account and the service that is using Plaid with tokens. And if the customer changes his bank account password, the bank notifies Plaid of this NOC (notice of change), and you will have to reauthenticate on the Plaid link to get your bank account relation reconnected.