Online payment integration requires handling my bank credentials. Why?

Question

When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website?

The context of my question can be found on the Personal Finance & Money where I asked something different but regarding the same payment solution, i.e. Trustly.

With this payment solution you need to add your bank credentials on someone else's site (not your bank's). I was reluctant to do so, researched the site, asked that question as reassurance, even changed my home banking password afterwards. So my question is not about trust here (I kind of figured out they can be trusted although I still have a trust issue with it), it is about reasons why one might chose to do an integration like this.

Are there any benefits (technological, user experience, business reasons, others?) to do an online payment integration by asking users to login to their bank account inside your application?

Answer 1

Basically there must be technical reasons or business reasons Trustly doesn't support the pass-through transaction approval you're accustomed to. Instead of asking their users to take action and passing them onto their bank to do so, Trustly prefers to automate this process and needs your credentials to act on behalf of you. I won't say this isn't unusual, but it certainly isn't limited to Trustly. Other financial organizations like Mint and Honeydue have used a similar model of requiring their customers' credentials for years.

There are technical alternatives that wouldn't require you to provide your credentials to Trustly, but like I said, there may be reasons they've chosen or been forced not to use them. There's not a universal standard in banking for authorizing one party to act on your behalf with regards to querying account details or making transactions. In fact, the EU has introduced a new standard (PSD2) to try to fix this compatibility issue and do away with the 'screen scraping' approach likely used by Trustly and others as a workaround. If you want to read in greater detail about this change then you can start with this article: https://openbankinghub.com/screen-scraping-101-who-what-where-when-f83c7bd96712

Maybe the other organizations you've dealt with have been able to set up specific gateways for sharing data or transactions with partners, which is why they could redirect you instead of prompting you for your credentials.

Hopefully the USA or other countries still lagging behind will follow the example and push for standardization so trusting your credentials to third-parties is no longer needed.