Don't Share Your Password: The Risky World of Screen Scraping vs Open Banking
Think sharing your online banking login with a budgeting app is harmless? Think again. Doing so could void your bank's fraud protection and leave you fully liable.
A while ago, I opened a new share trading account and went to make my first deposit. The broker's onboarding system asked me to enter my online banking username and password to log in and verify my bank account instantly. It seemed quick, but when I contacted my bank's security team, they immediately flagged it as a suspected scam.
While the third-party system itself was legitimate, the method was highly flawed. Shortly after, I received a warning letter from my bank stating that they would not be responsible for any money stolen from my accounts. Why? Because I had voluntarily given my password to a third party.
This is what is known in the industry as "screen scraping," and it's a practice used by many popular budgeting apps, money trackers, and even mortgage lenders trying to verify your income and expenses. While it's incredibly convenient, it carries a massive hidden trap: screen scraping risks.
The ePayments Code Trap: Why Your Bank Won't Help You
In Australia, your protection against unauthorized transactions is governed by the ASIC-administered ePayments Code liability rules. Under the code, if you voluntarily disclose your password or passcode to anyone—including a screen scraping service—you are breaching the code's security guidelines.
If a hacker uses that screen-scraped connection or your account gets compromised, your bank can legally deny your claim to get your money back. By handing over your keys, you have voided your fraud protection and left yourself financially exposed.
Enter Open Banking Australia
Fortunately, there is a much safer alternative. Australia is rolling out Open Banking Australia (as part of the Consumer Data Right or CDR). Under Open Banking, you never share your actual password. Instead, you are securely redirected to your bank's portal, where you log in and give consent to share specific data using safe APIs (Application Programming Interfaces).
If a budgeting app or lender does not support Open Banking and insists on you entering your raw login details, think twice. And if you have no choice but to use a screen-scraping service (like when applying for a home loan), make sure you change your online banking password immediately after the transaction is complete.
