Keep your money safe from sneaky screen scraping

(NC) Have you ever signed up for an app that promised to simplify your finances, only to wonder why it needs your online banking password? If the request gave you an uneasy feeling, you may have had good reason to distrust it.

Some financial technology, or fintech, apps use a method called screen scraping to log into your bank account. The app asks you for your username and password. Then, it uses that access to pull financial data like balances, transactions and even investments so that the app can manage them in one place. It may sound convenient, but it’s a cybersecurity nightmare.

• Handing over your login information means giving up more than just your username and password:
• You're giving a third party access to all the sensitive information you usually guard safely.
• You risk losing your legal protection against unauthorised transactions.
• Your bank may not repay your losses if your data gets breached.

The access you give out matters

Some things, like government services, use banks as sign-in partners to access your account. This isn’t the same thing as screen scraping because you still sign in through the bank itself, and the bank provides confirmation for the secure login—your information stays secure.

With screen scraping, you’re giving a third-party app your banking login, letting it see and potentially make changes to your account. That includes personal information, transaction history, the products you use and more. And because it's logging in with information you gave, if something goes wrong it can be extremely difficult to prove you’re not at fault.

Even if the app markets itself as secure, giving a fintech company this kind of access to your account may go against your bank’s terms of use. 

That’s why experts, as well as the Government of Canada, advise against it.

How to protect yourself:

• Never share your banking credentials with an app, by text or email or over the phone.
• Avoid apps that ask for your bank password, no matter how helpful they claim to be.
• Use only secure, approved channels to access your financial data.

Fraud is evolving fast, and screen scraping is one of the sneakiest ways bad actors can get to your money. The best defence is always keeping your passwords to yourself.

Learn more at canada.ca/money.