Credit Cards asking for Banking Login Info

[NeverMarryAStripper 21870]

Twice recently when adding a bank account to my credit cards for payment purposes it has asked for my banking login information.  The first time it happened I was sure that I fucked up somehow and ended up on some phishing site so I backed out and just said fuck it.  The second time I verified that I was at the correct site and managed to cancel out to where I could just enter the bank routing and account numbers.  When did this become a thing and who in their right mind would enter that information on a web site?

[TornACL 7698]

Is your card a Citi card? I hate their fucking website with the fire of a thousand suns. 

Half the time, the piece of shit website is down for maintenance, the mobile app is completely useless, and as you mentioned, if you want to pay your bill online you have to share your login info.

I am about to cancel that card simply because of the interface of their website. If other cards are starting to do the same, I'm gonna have to start writing sternly worded letters. 

[NeverMarryAStripper 21870]

Citi was the second one.  I eventually managed to do it with just the routing and account numbers.  The first was a prepaid card that I use when sites that I may not entirely trust make me provide a valid credit card.  There's no way I'm entering my banking log in information on any web site.

Edited December 29, 2020 by NeverMarryAStripper

[Nice Guy Eddie 13507]

Are you talking about a connecting financial institutions together with Plaid? They’re owned by Visa so it’s legit and not some scam. 

[Wally Fairway 5539]

Oh, I'll go on a rant 

Why is it okay to just where enter in routing and account #s and the bank allows a site to transfer funds from my account? I'll answer, because we are lazy and dumb; don't get me wrong , I do it because I just described myself.

Banks should have some sort of verification requirement or approval that you set up to allow those transfers. But t would cost time and money to write and maintain that system. And customers would have to take time to use it properly. All I needed is your account number (because bank routing numbers are searchable) and I can transfer money from your account, maybe not much, maybe a lot or a lot to me. 

There is no good reason the isn't 2-step verification or pre-authorization, other than it would take time and effort to maintain. I really can't believe that system hasn't been hacked. But until that happens we'll think the system is safe.

[SimonBolivar 10957]

2 hours ago, Wally Fairway said:

Oh, I'll go on a rant 

Why is it okay to just where enter in routing and account #s and the bank allows a site to transfer funds from my account? I'll answer, because we are lazy and dumb; don't get me wrong , I do it because I just described myself.

Banks should have some sort of verification requirement or approval that you set up to allow those transfers. But t would cost time and money to write and maintain that system. And customers would have to take time to use it properly. All I needed is your account number (because bank routing numbers are searchable) and I can transfer money from your account, maybe not much, maybe a lot or a lot to me. 

There is no good reason the isn't 2-step verification or pre-authorization, other than it would take time and effort to maintain. I really can't believe that system hasn't been hacked. But until that happens we'll think the system is safe.

Yep, there are no real stops in place to prevent large ACH withdrawals from accounts that have the correct account number and routing number in most systems. If the account owner isn't paying attention then you can take everything at once or slowly break them down. We've seen people that have had thousands taken over years and they never noticed until it was too late to dispute them (varies by FI but we do 45 days). It's crazy to me that there are so many people who don't really check their accounts.

Edited December 29, 2020 by SimonBolivar

[TKthunder2 4985]

It’s all about data, they want your bank login so they can scrape all your activities and cross sell you on their ‘better’ products and accounts.  They also can sell your data.

My bank, credit union, credit card, 401k, and stock portfolio all keep asking to be my main hub for my financial tracking and reporting for a reason.

[Francisco 2.0 32386]

6 hours ago, TornACL said:

Is your card a Citi card? I hate their fucking website with the fire of a thousand suns. 

Half the time, the piece of shit website is down for maintenance, the mobile app is completely useless, and as you mentioned, if you want to pay your bill online you have to share your login info.

I am about to cancel that card simply because of the interface of their website. If other cards are starting to do the same, I'm gonna have to start writing sternly worded letters. 

Unrelated, but Citi closed my credit card because it had not been used in 3 years.  Mostly a meh from me, since I have others to use, credit score over 800, etc.  But this has never happened to me before; is this commonplace?

[Ignatius 4017]

Yeah fuck giving them your login...and second the hate of Citi’s site. I’ve been doing the miles/points churn and burn for years and only pick up a Citi card under extreme circumstances because of their shitastic site....

[Ignatius 4017]

2 minutes ago, Francisco 2.0 said:

Unrelated, but Citi closed my credit card because it had not been used in 3 years.  Mostly a meh from me, since I have others to use, credit score over 800, etc.  But this has never happened to me before; is this commonplace?

Some banks do it more than others. Barclays does it pretty consistently after 2 years, certain Chase cards will too. I have BofA cards I haven’t used in over a decade that they keep open...

[CooterBrown 18002]

Oh, I'll go on a rant 
Why is it okay to just where enter in routing and account #s and the bank allows a site to transfer funds from my account? I'll answer, because we are lazy and dumb; don't get me wrong , I do it because I just described myself.
Banks should have some sort of verification requirement or approval that you set up to allow those transfers. But t would cost time and money to write and maintain that system. And customers would have to take time to use it properly. All I needed is your account number (because bank routing numbers are searchable) and I can transfer money from your account, maybe not much, maybe a lot or a lot to me. 
There is no good reason the isn't 2-step verification or pre-authorization, other than it would take time and effort to maintain. I really can't believe that system hasn't been hacked. But until that happens we'll think the system is safe.

I’ve always wondered how secure this is since if you can provide a valid account number and the published routing number, you can move money anywhere.

I don’t know if they still do it, but for many years, RBFCU handed out account numbers in numerical order. If you were account #10000, you were the 10,000th customer. As a result, it’s really easy to provide a potentially valid account number.

[McCroskey 1504]

2 hours ago, Francisco 2.0 said:

Unrelated, but Citi closed my credit card because it had not been used in 3 years.  Mostly a meh from me, since I have others to use, credit score over 800, etc.  But this has never happened to me before; is this commonplace?

Very common for card issuers to close dormant accounts (usually at a minimum of 24-36 months of non-activity and assuming your credit is fine), but as stated the policies vary amongst card issuers.  BoA may let you stay dormant for 5+ years, while others like Amex or Barclays may close an account after only 24 months.

[McCroskey 1504]

9 hours ago, NeverMarryAStripper said:

Twice recently when adding a bank account to my credit cards for payment purposes it has asked for my banking login information.  The first time it happened I was sure that I fucked up somehow and ended up on some phishing site so I backed out and just said fuck it.  The second time I verified that I was at the correct site and managed to cancel out to where I could just enter the bank routing and account numbers.  When did this become a thing and who in their right mind would enter that information on a web site?

As said by others, it's a newer technology led by the industry leader Plaid...but certainly other companies like Yodlee (now Equifax) are getting involved and it's rapidly growing in popularity.  But like you, most people are still VERY skeptical of it which is completely understandable.

At this point, the use-cases are primarily for a faster and more secure manner of sending/receiving money between institutions or businesses compared to the older ACH technology (routing #s and account #s), as well as aiding lenders when it comes to the requirement to verify deposits/income in the process of a loan application...usually mortgages.

Credit card companies use the technology to make it easier for cardholders to connect bank accounts and make payments. 

Venmo or Paypal now use it to quickly link accounts for sending/receiving payments, as opposed to the old way of entering a checking account info...waiting on the two small deposits to occur, then verifying, etc...which could take days.

When getting a mortgage, lenders can use it to instantly verify recent deposits made to your account, which can speed up the loan approval and closing process (think Rocket Mortgage).

The list of benefits and uses goes on...

There's a lot more to this and I'm happy to answer questions.

 

 

[Francisco 2.0 32386]

23 minutes ago, McCroskey said:

Very common for card issuers to close dormant accounts (usually at a minimum of 24-36 months of non-activity and assuming your credit is fine), but as stated the policies vary amongst card issuers.  BoA may let you stay dormant for 5+ years, while others like Amex or Barclays may close an account after only 24 months.

 

Interestingly, I have an Amex Everyday card, which has never been used.  I've had it for 5 years or so.  Guess I need to use it for something.

My Amex Gold does get used, however.  

[McCroskey 1504]

20 minutes ago, Francisco 2.0 said:

 

Interestingly, I have an Amex Everyday card, which has never been used.  I've had it for 5 years or so.  Guess I need to use it for something.

My Amex Gold does get used, however.  

There's a lot that goes into the "decisions" to automatically close an account so it's very likely your personal account history with them and/or other card usage warrants the dormant Everyday account staying open.

Amex monitors cardholder behavior very closely, and they do a good job of targeting offers, incentives, credit line increases, etc...to encourage someone to use a card they may otherwise not be using.  Those getting cards closed in 24-36 months of non-usage are almost always due to increased risk, or fraud.

Edited December 30, 2020 by McCroskey

[52-80 19142]

17 hours ago, Wally Fairway said:

Oh, I'll go on a rant 

Why is it okay to just where enter in routing and account #s and the bank allows a site to transfer funds from my account? I'll answer, because we are lazy and dumb; don't get me wrong , I do it because I just described myself.

Banks should have some sort of verification requirement or approval that you set up to allow those transfers. But t would cost time and money to write and maintain that system. And customers would have to take time to use it properly. All I needed is your account number (because bank routing numbers are searchable) and I can transfer money from your account, maybe not much, maybe a lot or a lot to me. 

There is no good reason the isn't 2-step verification or pre-authorization, other than it would take time and effort to maintain. I really can't believe that system hasn't been hacked. But until that happens we'll think the system is safe.

Murrica.

EU created the SEPA system, where you can transmit money INTO an account freely.  There's no need to be secretive about account numbers (lol checks) as friends and strangers and businesses freely share theirs to receive cash from payer. 

The payee of course, to send money out, needs to confirm via 2FA.  Same for initiating a recurring payment or allowing a business to auto-pay bills.  There 2FA or a separate contract represents the agreement.

Some aspects of our financial system , like the sanctity of the SSN, is just inexplicable.

 

 

[Nice Guy Eddie 13507]

It’s a silly game that we are told to keep unused credit cards active as to not lower your credit score. Which ultimately the credit card issuers love because when someone finally has to reach for their unused card, there is a good chance the sweet monthly interest charges will soon flow.

as for the topic, I’m all for methods that make transfer faster. I recently wanted to transfer some funds between a checking and savings accounts that had never been connected before. I had to wait several business days for the small deposit test. And now I’m waiting 3-4 business days for the transfer. Frustrating because this is nothing more than a data transfer.  probably more annoying is that the money is shown as transferred from bank A but bank B shows nothing for a day or two. This should all take a very short time.

Edited December 30, 2020 by Nice Guy Eddie

[washparkhorn 9939]

Isn't this part of the Know Your Customer (KYC) mandates under the anti-money laundering (AML) provisions of the Patriot Act?

[wood 11225]

On 12/29/2020 at 9:41 PM, McCroskey said:

There's a lot more to this and I'm happy to answer questions.

How safe is it? How are they protecting the user's bank login data?

[Nice Guy Eddie 13507]

1 hour ago, wood said:

How safe is it? How are they protecting the user's bank login data?

I was under the under the impression that they don’t store your login data at all. You’re logging onto your own bank, which creates the connection. I could be wrong.