The short answer
Most people have granted financial access they have entirely forgotten about: a budgeting app tried for a fortnight in 2023, a card saved at a shop used once, a subscription that still holds a payment mandate. Almost none of it expires on its own.
The important structural fact is that deleting an app does not revoke its access. The grant lives on a server — at your bank, at your card network, at your app store — not on your phone. Removing the icon removes your ability to see what it is doing, and nothing else.
There are six places where access is recorded, they are held by different parties, and only checking all six gives you the picture.
The six registers
1. Your bank’s connected-apps list. Under Open Banking, an app reading your accounts holds a consent recorded at your bank. Most European banks expose this in the security or privacy section of online banking, often as “third-party access”, “connected services” or “data sharing”. This is the authoritative list for account access, and it is the one that is almost never checked.
Revoking here is decisive: it kills the token, regardless of what the app’s own interface says. Revoking inside the app asks the app to stop, which is a request rather than a control.
2. Standing direct debit mandates. A direct debit authorises a company to pull money from your account on a schedule it controls. Cancelling the service does not necessarily cancel the mandate. Your bank has the list; anything on it whose payee you cannot immediately identify is worth resolving.
3. Card-on-file and recurring card payments. Distinct from direct debits and held at a different layer. Many banking apps now show recurring card payments and subscriptions. Where the bank does not surface it, virtual card numbers issued per merchant are the structural fix — one merchant, one number, revocable individually.
4. App store subscriptions. Purchases made through Apple or Google billing do not appear as separate merchants at your bank and cannot be cancelled at the bank. iOS: Settings → your name → Subscriptions. Android: Play Store → Payments & subscriptions. This is where the forgotten ones usually hide.
5. PayPal and wallet billing agreements. PayPal maintains “automatic payments” — standing authorisations separate from any individual transaction. Settings → Payments → Automatic payments. These persist for years.
6. OAuth grants on your identity accounts. Anywhere you clicked “sign in with Google”, “sign in with Apple” or “sign in with Microsoft”. These are not financial by themselves, but the identity account is the recovery path to your financial accounts, which makes it part of the same blast radius. Check Google’s third-party access page, Apple’s “Sign in with Apple” list, and the equivalent in your Microsoft account.
Why revoking in the app is not enough
Three separate reasons, and each has bitten people.
The consent lives at the bank, not the app, so an app that has stopped working, been sold, or gone out of business may still hold a live token. The company’s disappearance does not revoke anything.
Data already collected is not deleted by revocation. Revoking stops future reads. What was already pulled — often years of transaction history — sits in the provider’s systems under whatever retention policy applies. Revocation and deletion are separate requests, and only the second requires them to erase it. Prompt logs and data subject access requests covers the mechanics of asking, which work the same way for transaction data.
And an acquired company’s grants transfer with the acquisition. The consent you gave a small independent app in 2023 may now be held by whoever bought them.
The thirty-minute routine
Work through the six registers in order and apply one rule: if you cannot say what it is for, remove it. Reinstating access takes ninety seconds. Wondering whether a forgotten grant is still reading your account costs you nothing but achieves nothing either.
For each item, record three things — the name, what it does, and when you last used it deliberately. The third question is the one that resolves most entries.
Where you cannot identify a payee, the transaction reference usually contains a merchant descriptor you can search. Where it still makes no sense, contact your bank rather than guessing; unidentifiable recurring payments are also what early card fraud looks like.
Do this quarterly. Calendar it, because the failure mode of this task is not difficulty, it is never happening. Align it with something you already do — the same day you check your credit report, or the start of each quarter.
Removing access without breaking things
Some caution is warranted in two places.
Direct debits for services you still use. Cancelling a mandate for an active utility or insurance policy creates a missed payment, and missed payments have consequences beyond the inconvenience. Cancel the service with the provider, then remove the mandate — in that order.
Identity-provider grants. Revoking “sign in with Google” for a service where that was your only login can lock you out entirely, particularly if you never set a password. Set an alternative sign-in method first, confirm it works, then revoke.
Bank connected-app consents carry neither risk. Revoke freely.
What good looks like on the other side
When you are evaluating a new app, the quality of its access model is visible before you commit.
An app that connects through a licensed Open Banking interface holds a scoped, expiring, individually revocable token, and never sees your banking password. An app that asks you to type your online banking credentials into its own screen is screen scraping, holds credentials that are not scoped and do not expire, and cannot be revoked at the bank because the bank cannot distinguish it from you. Screen scraping vs Open Banking API explains how to tell which one you are being offered, and how to check an app is a licensed AISP covers verifying the licence.
The distinction is the single most useful thing to check before granting access, because it determines whether this audit is even possible next time.