Source
r/Bitcoin•
cointastical

"To link your bank account, we require your bank account login name and password." NEVER AGAIN

To be able to accept credit card payment for my freelancing work, I signed up for an invoicing/payments service platform.

To get the funds from those customer payments into my personal bank account, this service asked me to provide my bank account's username and password "to verify".

After doing so (after first changing my bank account password to something temporary, of course), I watched the screen show:

"Verifying ..."
"Verifying ... ..."
"Verifying ... ... ..."

There was 30 seconds of this, 45 seconds, .. 60 seconds, and I'm now really regretting my temporary moment of weakness. What was I thinking? Those bastards are sucking the data on every bank transaction I've had over the past several years.

Who are these people? I don't know them. What are they going to do with all my bank history data? I check ... their privacy policy indeed says they pull in my bank transaction history.

Every. single. transaction.

To make things worse, the service they use to suck my bank data, Plaid, says:

We may collect, use, and share information we collect in an aggregated or de-identified manner (that does not identify you personally) for any purpose permitted under applicable law.

Oh, great ... so now I just voluntary gave my "de-identified" financial transaction data to anyone and everyone willing to pay for it, including those who certainly can "re-identify" it with minimal effort.

I feel so violated.

[Update: this is obscene].

[Update 2: Abra Global now has a "Plaid integration".

Posted Apr 20, 2019, 6:45 AM UTC · edited

7143
AdeptOrganizationredditor for 3 months•

Hopefully you learned your lesson.

If you ask them, they might delete the data and your account. Or at least tell you they have.

23
cointasticalOP•

The damage is done. I've changed my bank account password since, of course, even though they claim that they don't save it. All they see from this point forward is the handful of invoices each month I issue through them and the card payments processed as a result.

In hindsight, knowing in advance that they do this (I had glossed right over where it said: "Automatically import transactions to keep your bookkeeping up-to-date"), and if this were the only option, next time I'ld get a separate bank account first ... one of the online banks that charge no fees perhaps, and use that bank account just for this "customer payments" use case.

As a "sole proprietor", it's actually a recommended practice to use a separate bank account for business stuff. I just figured I'ld wait until it was no longer just a trivial amount of activity. But now I have an additional reason to get a separate bank account, ... to protect the financial privacy of my personal financial data.

6
AdeptOrganizationredditor for 3 months•

What you should actually do is use a business that doesn't behave like this.

Saying you'd use a separate account to work around it is like saying you always keep anti venom around for the snake you are dating.

11
cointasticalOP•

Sucks, but you are right. I'm continuing to patronize a service that did something shitty to me.

I've tried asking my customers to pay in Bitcoin. When they eventually realize that I was actually being serious, the answer has always come back "no, sorry". I'm thinking of using BitWage for one where I can get paid via direct deposit and BitWage sends me BTC.

2
AdeptOrganizationredditor for 3 months•

Intermediaries are a necessary burden for the time being.

You could offer a modest discount (or modest price rise for fiat) for bitcoin payment, which might help. Sort of depends on who you're dealing with.

1
cointasticalOP•

Just saw that Abra Global now has a "Plaid integration".

2
LeRoy_Fucking_Jenkinredditor for 2 weeks•

I just recently made a Robin hood account and linked my bank account to it is that bad?

1
BlindlyPessimisticredditor for 3 months•

Just skip a step and tell him you already did it for him.

1
[deleted]•

[deleted]

19
cointasticalOP•

You're not wrong!

4
giszmo•

There's probably no bank in the world without second factor authentication for transactions.

1
TheJudgeOfThings•

It is but services like Plaid use an API that the bank has to allow.

1
ElephantsAreHeavy•

You are allowed to say "fucking" on reddit. Certainly to someone who willingly gave his bank login details to a third party....

"we just need your private key for verification"

0
[deleted]•

[deleted]

1
ottox4•

Sounds like a scam...

12
cointasticalOP•

Just saw that Abra Global has a "Plaid integration" as well:

2
cointasticalOP•

It's a well-known service I use for creating invoices, and they claim to process billions of dollars a year as a merchant payment processor.

I see Venmo uses Plaid to "verify your bank account" as well. As does Gusto payroll.

1
yaemes•

Plaid is not a payment processor, Plaid provides an API to turn bank username and password into information about your account, including all transactions history and bank account and routing numbers. Thier sole purpose is to invade millions of people's financial privacy.

To avoid them is easy- always opt for using bank account and routing numbers to accept payments online.

4
cointasticalOP•

To clarify, I was the invoice/payments service/platform I use does the payments processing. Plaid only comes into the scene when I am asked to "verify my bank account" by providing to Plaid my bank login and password.

And boy, I was wrong letting myself get suckered into agreeing to that!

always opt for using bank account and routing numbers to accept payments online.

That's not easy. I'm not touching anything to do with my client's bank account number or bank anything. They can send me a check, or pay with a credit / debit card. (or Bitcoin, like I first asked :-) ).

Unfortunately, the best service for that seems to be one this online invoicing service, which comes with the unfortunate side-effect of using this Plaid "verification" (bank transaction history sucking service).

1
ibbcbb•

doesn’t anyone find the name funny? i.e. you’ve been plaid

9
cointasticalOP•

Yup, they played me, and good!

3
dvsrydin•

Well count yourself lucky they didn't take any funds

5
cryptodime•

I get it seems super fishy, but are you sure you typed in the auth into their site?

Usually, with things like this, (I don't know plaid but looking at the demo on the webpage, it looks pretty similar to Zelle), you're not actually giving them your auth but logging into a page of your actual bank that then allows them to access your account. That part is still sketchy. But I doubt anything your bank actually works/partners with would allow their customers to type in their auth for their bank into a 3rd party site.

3
cointasticalOP•

you're not actually giving them your auth but logging into a page of your actual bank that then allows them to access your account

The frame for the HTML form is served by plaid.com, and they are indeed asking for my username and password. It appears they have API access to 3,800 (of the ~11,500+) banks in the U.S., and need only my username and password:

2
Zinnia_Hani•

Thats why GDPR exists in the EU

3
cointasticalOP•

I clicked the button after it clearly showed "we will import your transactions", instructing them to proceed. I don't know that GDPR would have stopped that from occurring.

2
nyaaaa•

for any purpose permitted under applicable law.

Would certainly lessen thos.

And kinda not allow it at all because if they de-identify, it is still your data so they need it to be identifiable to be able to delete it if you request it?

But its a US company operating in the US, so since you got no laws, you are fucked.

3
Zinnia_Hani•

They would also remove your data if you ask them to.

1
Timstertimster•

You have zero ability to audit their compliance for such requests. It’s like google claiming to delete your photos. They don’t. They just tag them as hidden. But their ML still has access and uses them for as long as it makes sense to their ML efforts.

1
cooriahredditor for 3 months•

I do freelance work also with my own LLC. After asking many clients about remitting my invoices with bitcoin instead of dollars, I finally found a corporate recruiter that agreed to. And it's awesome. So much more privacy, speed, and security. I recommended everyone keep asking people to do the same for them.

3
Bitcoin_Inquisitorredditor for 3 months•

For a freelancer I would recommend using Bitwage.com
You can invoice in fiat your clients, they send you in their fiat currency and you can receive directly to your BTC wallet all the amount or split it into % of fiat and BTC if you like.

Bitwage is the best way for freelancers that work with clients abroad.
Also there are many sites for freelancers that pays directly in BTC.

2
cointasticalOP•

For repeat clients, I could see doing that. For the one and done clients, ... they aren't going to go through the hassle of signing up to BitWage, and all that, just for me and my one invoice.

I do see now that BitWage will create a bank account number for me that I can use for Direct Deposit, which would allow me to convert my revenues from UpWork, for example, into Bitcoin:

2
Bitcoin_Inquisitorredditor for 3 months•

In Bitwage you create your account, they assign you a bank number account in the currency you want and you just hand that bank details to whatever employer/client you have. Each payment request have a reference identified to your Bitwage account.

I used Bitwage many times with many clients/employers and worked as it is designed to work.

2
cointasticalOP•

they assign you a bank number account

Ya, I think that is new. They used to require the employer / vendor to have an account with BitWage, if I remember correctly?

Each payment request have a reference

In the U.S., ACH / Direct Deposit payments don't support any additional information beyond bank routing number and account number. Or at least, my employer wouldn't mess with additional reference numbers or anything like that. Are you using this outside the U.S. perhaps, where a reference identifier with the payment is something normally used?

1
Bitcoin_Inquisitorredditor for 3 months•

You can create as many as you want employers "profiles". There is no restriction for that.

my employer wouldn't mess with additional reference numbers

Is time for you to choose wisely your employers... they have the duty to respect your payment instructions.

1
HTechs•

You got plaaaaaaa-id

2
localether•

That’s dickered.

2
FantasticEchidna4•

that sucks. I used to make the same mistakes and now I force myself each time I input data into a website to think what data that action can give them about my life and if that should be that way.

2
oafsalot•

You think your transaction data is YOUR data. That data is used world wide by banks everywhere. It's already out there.

1
cointasticalOP•

Well, yes, I know that VISA and Mastercard know all about my Taco Bell habits, and which airlines I use to fly.

And yes, I know that my gym knows my bank routing and account number, and probably shares that with whomever.

But really, I kind of believe that the names of my clients who paid me with direct deposit, for instance, was not being shared, prior to this, with every Tom, Dick & Harry that pays to get at that bit of data. Or the days and times where I happen to make larger sized deposits with the teller. Fortunately, I don't think the data shared shows whether those were cash deposits versus check, but the pattern of multiple, larger sized ATM withdrawals one day followed some time later by similarly-sized deposits might show my usage of cash for conducting business -- something again, maybe I don't care to see shared with the world.

1
dragonstorm27•

I would have created a new bank account for that.

1
cointasticalOP•

Hindsight is 20/20!

1
technifocal•

Your bank doesn't support OAUTH with permission sets? Wow, that's so like, 2018.

^(I kid, but in the EU we have OpenBanking which does exactly this)

1
whoami-now•

You're worried about Plaid downloading your entire transaction history, but Bitcoin's ledger is public.

0
cointasticalOP•

Apples to oranges.

1