# Instant Bank Verification- How does that work? **URL:** \ **Category:** Factual Questions\ **Created:** [October 13, 2011, 9:56pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579 "2011-10-13T21:56:47Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [October 13, 2011, 9:56pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/1 "2011-10-13T21:56:47Z")
Sometimes when signing up with a company they allow you to input your online bank login/password, and then they instantly verify that this is your account/you have funds. How does that work? ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [October 13, 2011, 10:03pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/2 "2011-10-13T22:03:54Z")
First, a criminal uses some false pretense to trick you into giving them your online banking credentials. Then they claim to have “verified” your account, when in fact what they have really done (or intend to do) is to use your credentials to transfer money out of your account and into theirs or that of a confederate. ---
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [October 13, 2011, 10:10pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/3 "2011-10-13T22:10:16Z")
No, these are reputable companies like PayPal or Charles Schwab. ---
**Author:** ![FatBaldGuy](https://avatars.discourse-cdn.com/v4/letter/f/ecd19e/32.png) [@FatBaldGuy](https://boards.straightdope.com/u/FatBaldGuy)\ **Post date:** [October 13, 2011, 10:15pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/4 "2011-10-13T22:15:01Z")
No, they are **pretending** to be legitimate companies like PayPal or Charles Schwab. No reputable company is going to ask for your login/password for your bank account. If you have given out this info, change your password immediately. ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [October 13, 2011, 10:33pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/5 "2011-10-13T22:33:11Z")
> [@FatBaldGuy](#): > > If you have given out this info, change your password immediately. Not only that; you should very carefully examine your transaction records for any unauthorized activity, and possibly also contact your bank personally to check if there are any pending transactions which don’t appear in your online statement yet. If there is any unusual activity you should report what happened to the bank immediately. You may not get your money back, since it was almost certainly against your account terms and conditions to disclose your credentials to a third party, but at least they may be able to trace the thieves. ---
**Author:** ![lazybratsche](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lazybratsche](https://boards.straightdope.com/u/lazybratsche)\ **Post date:** [October 13, 2011, 10:43pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/6 "2011-10-13T22:43:42Z")
No, this is a for-real-totally-legit feature offered by some banks. My bank offers such a service, and I’ve used it to monitor accounts I have with other institutions. In practice the bank is probably acting as man-in-the-middle-that-happens-to-be-friendly, and perhaps that’s not the best security practice and perhaps you also violate the external-account TOS by providing your info to a third party. (And yes, everyone should be very careful as similar looking things are also common attacks). ---
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [October 13, 2011, 10:46pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/7 "2011-10-13T22:46:59Z")
Listen, I’m not a moron. Scottrade does this, and it can access my bank account balance through their site. You don’t know what you’re talking about. Fuck off. ---
**Author:** ![groman](https://avatars.discourse-cdn.com/v4/letter/g/73ab20/32.png) [@groman](https://boards.straightdope.com/u/groman)\ **Post date:** [October 13, 2011, 11:11pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/8 "2011-10-13T23:11:45Z")
> [@treis](#): > > Listen, I’m not a moron. Scottrade does this, and it can access my bank account balance through their site. You don’t know what you’re talking about. Fuck off. Legitimate or not, the way it works is the same for everybody. You give somebody your login credentials to the bank, and the computer on the other end logins to the bank on your behalf using your credentials. Which part of how this works is not clear to you in the first place? ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [October 13, 2011, 11:27pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/9 "2011-10-13T23:27:26Z")
> [@treis](#): > > Listen, I’m not a moron. Scottrade does this, and it can access my bank account balance through their site. You don’t know what you’re talking about. Fuck off. **Moderator Note** **treis**. Not a warning, just a note that you’re in General Questions and telling someone to fuck off isn’t done. Go and sin no more. **samclem** Moderator ---
**Author:** ![Gary\_Robson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gary_robson/32/3448_2.png) [@Gary\_Robson](https://boards.straightdope.com/u/Gary_Robson)\ **Post date:** [October 13, 2011, 11:27pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/10 "2011-10-13T23:27:39Z")
> [@treis](#): > > Listen, I’m not a moron. Scottrade does this, and it can access my bank account balance through their site. You don’t know what you’re talking about. Fuck off. [moderator warning] After ten years on the SDMB, you should realize that telling someone to “fuck off” is out of line for the General Questions forum. Do not do this again. [/moderator warning] ---
**Author:** ![chrisk](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chrisk](https://boards.straightdope.com/u/chrisk)\ **Post date:** [October 13, 2011, 11:32pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/11 "2011-10-13T23:32:48Z")
Simul-moderation! 😉 ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [October 13, 2011, 11:42pm UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/12 "2011-10-13T23:42:01Z")
Pay no attention to the man behind the curtain. I was never here. ---
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [October 14, 2011, 12:47am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/13 "2011-10-14T00:47:25Z")
> [@groman](#): > > Legitimate or not, the way it works is the same for everybody. You give somebody your login credentials to the bank, and the computer on the other end logins to the bank on your behalf using your credentials. Which part of how this works is not clear to you in the first place? The part where this is how it works. Besides, you didn’t really explain the process. When I go to log in to my accounts I have to select the account type and click on some links from the homepage. So is there some program running on Bank A’s machine that knows how Bank B’s website works? Does Bank B have public APIs for this? > [@](#): > > [moderator warning] > After ten years on the SDMB, you should realize that telling someone to “fuck off” is out of line for the General Questions forum. Do not do this again. > [/moderator warning] Totally worth it. I’m tired of people who don’t know the answer to a GQ guessing some bullshit. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 14, 2011, 1:49am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/14 "2011-10-14T01:49:36Z")
Anyone who has your bank account number and password can access your bank account. Anyone who can access your bank account can see how much money is in it. What’s the mysterious part? ---
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [October 14, 2011, 2:07am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/15 "2011-10-14T02:07:06Z")
Technical question though: Most bank web sites only present your account information in human-readable form. Does Instant Verification (when non-fraudulent) interpret the HTML emitted by the banking website to find the account value number, or just know the layout for a bunch of banks, or is there a more structured access available? ---
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [October 14, 2011, 2:24am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/16 "2011-10-14T02:24:52Z")
> [@Chronos](#): > > Anyone who has your bank account number and password can access your bank account. Anyone who can access your bank account can see how much money is in it. What’s the mysterious part? How is the mysterious part. Obviously everyone can go through the website and access it that way. But that’s not typically how computers do things. The how is what I am wondering. Is there an API, a clearinghouse, or what? ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [October 14, 2011, 3:00am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/17 "2011-10-14T03:00:28Z")
> [@treis](#): > > How is the mysterious part. Obviously everyone can go through the website and access it that way. But that’s not typically how computers do things. The how is what I am wondering. Is there an API, a clearinghouse, or what? Some banks have an API, but mostly, yeah, you do actually have to screen scrape. Mint and Yodlee both have their own system to do this sort of thing. I believe that Yodlee is used as the backend of a number of services. Not sure if Mint contracts theirs out or not. Clearly the right thing to do for this sort of thing is for banks and other services to give out a “read only” login and password, or to use an authentication method that goes directly through them and hands out temporary credentials with limited access. But I guess we can hardly expect financial institutions to handle security as well as Twitter. ---
**Author:** ![LurkerInNJ](https://avatars.discourse-cdn.com/v4/letter/l/ed655f/32.png) [@LurkerInNJ](https://boards.straightdope.com/u/LurkerInNJ)\ **Post date:** [October 14, 2011, 3:44am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/18 "2011-10-14T03:44:23Z")
PayPal does this to verify your checking account. They send you two very small deposits from their account into your checking account using PayPal , and you have to go to your bank account and tell PayPal what they sent you. If it matches, you are verified. You don’t give PayPal your bank passwords or anything. ---
**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\ **Post date:** [October 14, 2011, 3:58am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/19 "2011-10-14T03:58:42Z")
> [@iamthewalrus\_3](#): > > Clearly the right thing to do for this sort of thing is for banks and other services to give out a “read only” login and password, or to use an authentication method that goes directly through them and hands out temporary credentials with limited access. But I guess we can hardly expect financial institutions to handle security as well as Twitter. Actually, ING Direct has done exactly this. They now allow you to set up what they call a “[Personal Finance Access Code](http://helpcenter.ingdirect.com/ingd/Topic.aspx?category=FINANCE1)” that is separate from your regular password specifically for use by the aggregation services. Unfortunately, I don’t know of any other bank that does this (which doesn’t prove that there isn’t one). ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [October 14, 2011, 5:53am UTC](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579/20 "2011-10-14T05:53:54Z")
> [@LurkerInNJ](#): > > PayPal does this to verify your checking account. > > They send you two very small deposits from their account into your checking account using PayPal , and you have to go to your bank account and tell PayPal what they \sent you. If it matches, you are verified. You don’t give PayPal your bank passwords or anything. A quick search didn’t turn up any mention of it on PayPal’s website, but according to [some third-party articles](http://blog.auctionbytes.com/cgi-bin/blog/blog.pl?/pl/2009/2/1235839118.html), apparently the OP is correct, and PayPal, probably the most-phished website in history, is (or was) actually doing this unbelievably stupid thing: > [@](#): > > Some eBay sellers on a discussion board were questioning why PayPal was asking them to reveal passwords to their bank accounts. It certainly seemed like a valid concern, so I asked PayPal spokesperson Michael Oldenburg for more information. > > Michael said PayPal does under some circumstances ask for that information if users want to instantly confirm their bank accounts. PayPal only asks that question - which is optional - when users are signed in to PayPal as a way to confirm a bank account instantly… > > Given that PayPal, like other financial services, is a target of phishers, I’m not convinced it’s a good idea to set a precedent for asking for someone’s bank account password. Wouldn’t it be better if the rule was, never give out your bank account password to anyone under any circumstances, no exceptions? [Next page](https://boards.straightdope.com/t/instant-bank-verification-how-does-that-work/599579.md?page=2)