I am from the UK but I'm living in Poland. I have two British bank accounts and a Polish account. The two British accounts are linked to a PayPal account registered from the UK and the Polish one is linked to an account made in Poland. Today I could not add instant funds to my Polish PayPal without using a third party (Trustly) who requested my internet banking credentials in order to verify my transaction. I have not been asked this with my British accounts. There is no information on PayPal (English or Polish) nor from my banks about this procedure being added. I was definitely on Paypal.pl and not a phishing site.
This got me wondering a few things:
Why does the PayPal process suddenly require my bank credentials and why have their customers not been informed of this change? To reiterate, nowhere on Paypal's English or Polish language site does it mention this change, nor does anyone from my bank know about it. They encouraged me to sever all ties with PayPal over this, as technically a financial organisation requesting your bank details is illegal under a certain EU law. Couldn't find that online, though, so take that with a pinch of salt.
Is such a system secure? Everything we learn about internet security and indeed everything I've learned in life is to trust as little people as possible. I went with the bank I'm using in Poland because they offer a higher level of verification for internet banking than the others.
As a developer myself, I'm guessing they'll scrape the online bank site to verify the credentials I provided are correct as a sort of verification system. The thing is, PayPal did this in the form of a small deposit that we enter the amount for. Why is the third party asking for a more trusting approach than PayPal themselves? Doesn't this seem odd? PayPal are essentially asking us to trust a third party more than themselves, which makes me quite uncomfortable.
What are your thoughts on this? Is it secret? Is it safe? Why have PayPal been quiet about it? Why not Britain as well? I wouldn't trust PayPal with my bank details, so why would I trust a third party I've never heard of before? There is so much about this that seems very suspicious to me. I was quite convinced I'd found my way onto a phishing site because it was hard to believe they wanted my credentials.
-- Edit with additional information:
The certificate on Paypal.com is indeed PayPals, verified by Symantec, etc. The website PayPal directs to when trying to add Instant Funds is Paypal-Doladowania.pl. In Polish, Doladowania means "Adding Funds" in this context. The HTTPS certificate is registered Paypal PTE Ltd, verified by DigiCert, registered in Singapore. No EV on either sites.
Here's a picture of the Trustly page asking for my credentials. In English it says "Please enter the identification credentials for your online banking."
If I enter some numbers (I just mashed the keys) they then ask me to do this:
Which is the partial password system this particular bank is using. So login to your bank account through a third party... I don't think so.