- Without knowing it, when you use popular apps
like Venmo, Betterment, YNAB, Acorns, Wise,
or even crypto apps like Coinbase, BlockFi, crypto.com.
You've trusted both your financial data
and your personal information
to a company called played Plaid.
Plaid, Plaid whatever.
In early 2022, it was announced
that a $58 million settlement had been reached
in a class action lawsuit against Plaid,
alleging that the company
had gathered more info about you
than they actually needed,
and misled consumers on their sign-in form.
I'm not here to discuss the settlement, honestly.
I wanna ask and hopefully answer,
three very important questions.
First, who is Plaid anyway?
Is it safe to give them our data?
And finally, what other options do we have?
(dramatic percussion)
Welcome to "All Things Secured," my name's Josh.
And today we're taking a closer look at the infrastructure
that supports a lot of the FinTech or financial technology,
it has become such an integrated part of our lives.
And before you think to yourself,
"He's not talking about me, I don't use Plaid."
Yes, I am talking about you.
And more than likely you have used Plaid
at least once over the last decade.
But even if you've somehow managed
to keep your financial data away from their servers,
there will come a time when you will be asked
by a service you use to connect your bank via Plaid.
But before we get into whether or not this is safe,
and what options you have, if any, to protect yourself.
Let me explain why a company like Plaid even exists.
(dramatic music)
So let's say you're being fiscally responsible,
and you wanna use a budgeting app
like mint.com or YNAB.
Now ,this can all be done offline, requiring you
to manually input every financial transaction you make.
Or you can make things a lot more convenient
by connecting your budgeting app directly to your bank.
When you do this,
they can automatically pull new banking
and credit card transactions
for you to review, categorize, and clear.
Now, they can't actually make payments on your behalf,
but they do have the ability
to view what is happening in your bank.
Now, the problem for companies like Mint and YNAB
was that connecting directly to your bank was a hassle.
I mean, there are tons of different banks
and every bank had its own connection rules or API,
which made it almost impossible
to provide connections to every bank their customers used,
not to mention the legal liability for collecting
and storing your customer's banking data,
which was probably a headache.
So what Plaid does is work like a middleman
between your bank and any other app
that wants to see your banking data.
When you're using that budgeting app,
instead of giving them your bank login
and all of your financial data,
you're giving it to Plaid instead.
They securely store your logging information
and only give the budgeting app
the data that they really need,
or at least what they're requesting.
So in theory, this sounds really good.
I mean, as opposed to handing out your bank login info
to every app that asks for it,
and the risks associated with doing that,
and them storing that data.
You're providing it to one company
whose sole job is protect your information
by only giving out what is absolutely necessary.
Of course, giving one company
that much power over your data is a risk in itself,
so that begs the question.
(upbeat music)
I wish I could answer this question
with a very easy, yes it is.
or no, absolutely not.
But as with all things in life,
the answer is just a little more nuanced.
You see, at least at the time
that I'm standing here recording this,
Plaid hasn't been hacked, data hasn't been leaked.
And even if it had been,
banks have security measures in place to stop a thief
from using any stolen logins
they might somehow obtain.
So strictly speaking, yes,
Plaid is safe to use and convenient.
I mean, goodness, that's what makes this service
so popular is just how convenient it is.
But this recently settled lawsuit
highlights some of the biggest problems.
Let me show you what I mean.
Let's say that I want to connect my bank
to a funding source for privacy.com,
which is the company I use
to create disposable virtual credit cards.
As I go through the connection process,
you'll see exactly what kind of data is being requested.
They will need my account number and names,
which is understandable.
And they even need to know my account balance
to make sure that I have enough money in my account
for any transactions I'm trying to complete.
In this case, it kind of makes sense
because privacy.com is making payments on my behalf,
and they wanna make sure
that I have enough money in my account,
but honestly that's between me and my bank.
That's what overdraft is for, you know what I mean?
But here's where it gets tricky.
They also want my bank
to give them personally identifiable information,
including my full name, my physical address,
email address, and even my phone number, why?
And it's not even like I have an option
to choose which data I give them,
which if either Plaid or privacy.com are watching this,
that would be my biggest request.
I want you to differentiate between which data
is absolutely necessary for you to have,
and that which is optional,
and then give me a choice
for which optional data I provide.
Anyway, do you see the issues here?
Within the settlement of the lawsuit,
Plaid admitted no wrongdoing,
but they did agree to delete some of the data
they already collected on you
to minimize what they collect in the future,
and to give us more control going forward.
Now, part of this control, at least from what they say,
comes from creating an account directly with Plaid.
So now they're a B2B company
that's trying to give me as the end user,
the option to create my own account.
It just doesn't really make sense, but that's what I did.
I went ahead and did it.
It took me about 10 minutes to get it all set up.
And before you go and run and do the same,
let me just tell you now
it doesn't give me any extra control.
Sure, I can look in and see what data's being shared
with an app like Coinbase, for example,
but I can't actually control anything.
The only control I have is to simply disconnect my app,
thereby severing the connection
between Coinbase and my bank,
which I could have done directly within Coinbase, anyway.
In other words, when you're dealing with Plaid,
it's an all or nothing game.
You either give them all your data,
and allow them to hand over as much information
as the app you wanna connect requests,
or you don't use Plaid at all.
You don't really get to choose.
So hopefully at this point, you're thinking to yourself,
"I'm not sure I'm willing to trust Plaid
"with all this data,
"especially since they seem to have admitted
"to collecting too much of it in the past.
"So what are my options?"
Well, I'm glad you asked.
(gentle music)
Let's continue with Coinbase as an example here.
Let's say that I'm logged into my Coinbase account,
and I'm trying to connect a funding source to the app
so that I can add money and invest in crypto.
As you can see here, it tells me that
of the various options available,
connecting my bank account directly is the fastest.
And it honestly is the cheapest option.
You'll notice that the first thing that opens up
is a Plaid connection request.
What I've found is that in most cases,
when you exit out of this request,
you'll be offered the option
to manually link your bank account.
In this case, you give them
only your routing account number, and name,
which is much less information
than what Plaid retrieves and provides them.
It's basically the same as
if I'd given them a voided check.
You know what a check is, right?
It's that paper thing you used to sign, nevermind.
Going back to privacy.com.
The process is very similar,
instead of using the Plaid service,
which is what would happen if I click that button here.
I have the option to connect my debit card instead.
Now, obviously this carries its own risks,
but at least I'm able to control my data more.
Here's the reality, Plaid equals convenience.
No Plaid equals inconvenience.
It's as simple as that.
Some apps such as the budgeting apps
won't automatically pull your transactions
unless you're using Plaid.
Other investing apps, I've noticed,
won't allow for instant funding unless I use Plaid.
Otherwise I'm forced to wait for a couple of days
for my money to appear in the account.
As with pretty much anything related to privacy,
it comes down to a decision that you need to make
between privacy and convenience,
and that delicate balance between the two.
I can't make that decision for you.
And I won't judge you if you decide
that you wanna keep using Plaid.
In the end for a company like Plaid
that is valued at an estimated $13 billion,
as of their latest round of funding in 2021,
this $58 million settlement is laughable.
They get off the hook for any legal liability,
and we, as consumers might get a few dollars
if you wanna make a claim on the settlement.
I'll put a link in the below,
but it literally might only be a few dollars.
The only other people who gain here are the lawyers
who have billed hundreds of thousands of dollars
in legal fees during this whole lawsuit.
Meanwhile we, the consumers, are still left wondering
how we're supposed to protect our data
while still using all of these great finance apps?
There is no easy solution, as I've explained here.
But it all starts with you being aware of how,
and with whom you're sharing your data.
That more than anything,
is what I hope you've learned from me today.
Hey, if you've enjoyed this explanation,
please consider subscribing to "All Things Secured,"
and then make sure you watch
the latest online in security privacy video right here.
Go ahead and click right now.