Why don't bank verification services use OAuth

Question

I'm going off of this answer, but asking a new question since that's quite old.

It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username and password in order to verify account information quickly. This flies in the face of the age-old security advice: "No legitimate organization will ever ask for your password". The answer I linked above seemed to imply that this is an inevitable evolution of banking and that there's not much to be done about it.

But what I don't understand is this. This seems like the exact use case that OAuth was built for. The Wikipedia summary begins as follows.

OAuth (short for "Open Authorization"[1][2]) is an open standard for access delegation, commonly used as a way for internet users to grant websites or applications access to their information on other websites but without giving them the passwords.

The user story for these bank identity verification popups seems to be this: Service X wants to know that you are the owner of the bank account Y. They do this today by either (the old method) dropping two small (less than $1) transactions into your account and asking how much money they just deposited, or (the new method) asking for your password directly.

But if bank Y supports OAuth, couldn't service X just request delegated access to the account, in the same way that my Mozilla Thunderbird installation requests delegated access to my Google Calendar (crucially, at no point did I share my Google password with Thunderbird)? Why aren't they doing this? Is there some technical limitation I'm not seeing here?

Answer 1

Why aren't they doing this?

There needs to be a standard API for this which third party services could use. While OAuth2 and OpenID Connect could provide such API in general it needs to be configured for each bank separately by the service. Thus it is not as universal as a bank transaction is, which requires only the information where to send the money too.

With directly asking for the password this is different though. There is no bank-independent API for this, so this would need to be coded separately for each bank and is thus not universal.

But, banks are actually moving in the direction you envision. With the revised Payment Services Directive (PSD2) the EU regulates that banks must offer APIs for third parties and searching for psd2 oauth shows that banks are actually using OAuth for such access. See also here about Open Banking API.