What you actually agree to when an app connects to your bank

The short answer

When a budgeting app connects to your bank properly, it never sees your password. You are redirected to your own bank, you authenticate there, and the bank hands the app a token that permits a specific, limited set of reads for a limited time. The app holds a key to a narrow door, not your house.

That is the good version. The bad version still exists, and the difference is worth knowing before you connect anything.

Two ways an app can reach your account

Redirect-based consent (what you want)

Under PSD2 in the EU and UK, a licensed third party requests access through a dedicated interface your bank provides. The sequence:

1. You tap “connect bank” in the app.
2. The app sends you to your bank’s own domain.
3. You authenticate with your bank — password, app approval, whatever your bank uses.
4. Your bank shows you a consent screen listing what will be shared and for how long.
5. Your bank issues the app an access token. The app gets the token; it never gets your credentials.

This matters because the secret stays between you and your bank. If the app is breached, attackers get tokens — revocable, scoped, expiring — rather than credentials that unlock everything.

Credential sharing and screen-scraping (what you don’t)

The older approach: the app asks for your online banking username and password directly, stores them, and logs in as you on a schedule to read the screen.

Everything about this is worse. The app now holds a credential that grants whatever you can do, not what you agreed to share. Your bank cannot tell the app’s session from yours. Your bank’s terms may treat sharing credentials as a breach that shifts fraud liability onto you. And revoking access means changing your password, not flipping a switch.

In the EU this is largely displaced by PSD2. It has not disappeared — some apps still use it for institutions with no API coverage, and some non-EU apps use it by default.

What “read-only” does and doesn’t mean

Most consent you grant is an account information permission: balances, transaction history, account holder name, sometimes standing orders. That is read-only. An app with this permission cannot move money.

Moving money requires a separate payment initiation permission, granted per payment or as a defined mandate. If an app asks for payment initiation and only offers you budgeting features, that is a question worth asking out loud.

Read-only is not the same as harmless. Your transaction history is one of the most revealing datasets about you that exists — where you live, your health, who you pay, what you earn, whether you gamble, when you travel. The security question is answered by the token model. The privacy question is answered by the provider’s retention and sharing terms, which is a separate investigation.

Consent expires, and that is a feature

PSD2 consent has a maximum lifetime, after which you must reauthenticate. Apps find this annoying and so do users, which is why some prompt you to reconnect every few months.

Treat the prompt as a checkpoint rather than a nuisance. It is a scheduled opportunity to notice you are still sharing your entire financial history with an app you stopped using in March.

What revoking access actually removes

Two separate actions, and people routinely do only the first:

Revoke the connection. In the app, or better, in your bank’s own interface, where third-party access is usually listed under something like “connected apps.” Doing it at the bank is more reliable — it works even if the app is uncooperative or defunct.

Revoking stops future reads. It does not delete anything the app already collected.

Delete the data. A separate request to the provider. Under GDPR you can require erasure, and the provider has one month to respond. If you connected an app, decided against it, and only disconnected, your transaction history is still sitting in their database under whatever retention policy they publish.

Five things to check before connecting

1. Is the provider licensed? In the EU, look for an account information service provider (AISP) authorisation and check the regulator’s public register — not the company’s own claim on its website.
2. Does it redirect you to your bank? If it asks for your banking password inside the app, stop.
3. What permission is it requesting? Account information only, or payment initiation too?
4. What is the retention period? Look for a number. “As long as necessary” is not a number.
5. Who are the sub-processors? Analytics and infrastructure vendors that also touch the data. Good providers publish the list.

Where this goes wrong in practice

The failure I see most often is not a broken protocol. It is a user who connected six apps over three years, uses one, and has never looked at the connected-apps list in their bank.

Go and look at yours now. It takes two minutes, and it is the single highest-value security action available to most people reading this.