8

Maybe I'm being overly sensitive as an IT professional who has a security mindset, but I am doing a mortgage refinance right now. My lender, who is legitimate (I used them a few years ago for the original purchase of my home), is asking me to help them verify my bank account balances via a service called accountchek.com (not to be confused with accountcheck.com).

Apparently the way this service works is that you go to the site, put in your e-mail address, the last 4 digits of your SSN, and some code that your lender pre-configured for you. Once you do that, it asks you for the username and passwords of all of your bank accounts so it can verify your balances. I called my lender and asked incredulously if they seriously expect me to do this. Yes, yes, they do.

Is it just me, or does this go against everything we've ever been taught about giving out passwords to third parties? I guess this is sort of a meta, philosophical question rather than one that has to do with technology, but since technology is in the mix here, I thought I'd request some feedback.

  • 5
    I'd be looking for a new lender. Or if you must comply, immediately change all your passwords after the service has run its checks. – iainpb Jul 10 '17 at 16:02
  • Changing passwords immediately afterwards is an excellent idea... if I do go through with it. – theglossy1 Jul 10 '17 at 16:08
  • 5
    Follow-up... my lender (who I know and is a nice guy) said that he understands my concerns and they will just do it the old-fashioned way for me. Good deal. – theglossy1 Jul 10 '17 at 16:16
  • 2
    Ask your bank what they think about this, chances are they can just send the info without the access. What could their plan be for two factor authentication? – user123931 Jul 10 '17 at 16:17
  • Just ran into it, and found out what their solution to 2fa and security questions is: accountchek just asks for those as well. – trutheality Mar 21 at 20:28
7

This is a very bad idea, but yes, various aggregators do exactly this. One of the few upsides of the new Open Banking and PSD2 regulations will mean aggregators are no longer going to need this sort of nonsense, as banks will provide APIs to share data.

It does present a huge challenge around understanding where data loss may have occurred after an incident, but for the customer there is a massive increase in security in not putting all these username and password combinations in aggregators database.

1

We are in Apr 2018 right now and I just went through this same nonsense with my lender. When I saw the requirement for my login credentials to be put in, that drew a red flag. I called one of my banks, SFCU, and they kept me on hold while they checked and double checked about 'Accountchek.' They came back and said three important things: 1. I will be doing it at my own risk as they have never heard of such a requirement 2. I will be compromising my login credentials by allowing a 3rd party to access it 3. If I have to do it, they are strongly advising me to go back and change the passwords after I have completed the check

Bottom line, I refused to do it which did not make my lender happy, but he said to use their document center for a secure upload!

I cannot believe that there are actually institutions, which expect clients to do this!!!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.