Yes, loan companies do ask for bank login information, and in most cases it’s a normal part of the application rather than a scam. The catch is how they ask. A legitimate lender never has you type your bank username and password into its own website or hand them to a loan officer over the phone. Instead, you’re routed through a third-party financial data aggregator such as Plaid, Finicity, or MX, which creates an encrypted connection between your bank and the lender. The lender sees a snapshot of your account data; it never sees your password.
How the Login Request Is Supposed to Work
When you reach the income or asset verification step of an online loan application, a pop-up or redirect appears asking you to choose your bank. That window belongs to the aggregator, not the lender. You log in on a screen branded by the aggregator or by your bank itself, and the aggregator pulls a structured copy of your financial data for the lender’s underwriting system to read.
Two different technologies sit behind that screen. Older connections use screen scraping: the aggregator stores your username and password and logs into your bank repeatedly on your behalf. The Consumer Financial Protection Bureau has called this approach “risky” because it “typically involves consumers providing their account passwords to third parties who use them to access data indiscriminately through online banking portals.”1Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule The newer approach uses an API protocol called OAuth, where your bank issues a digital token to the aggregator and your password never leaves the bank’s servers.
You can usually tell which one you’re using. If the connection screen redirects you to your bank’s own familiar login page, that’s token-based access. If it asks you to type your bank credentials into a third-party window, the aggregator is likely still using screen scraping. Neither is automatically a scam, but token-based connections are meaningfully more secure.
What a Lender Actually Sees
Linking your account gives the lender read-only access to recent financial activity. Most pull about two months of transaction history, though mortgage lenders and underwriters reviewing self-employed borrowers may look back six months or even two years. What they can see:
- Current and available balances, to confirm cash reserves.
- Individual deposits and withdrawals, to identify spending patterns.
- Recurring deposits like paychecks or benefits, to verify stable income.
- Account ownership details confirming the account is yours.
They also look for overdrafts and non-sufficient-funds incidents, which get treated as negative risk factors. The access is strictly read-only. No lender or aggregator can move money, change account settings, or initiate transfers through this connection. Encryption during transmission uses AES-256, the standard adopted by federal agencies for sensitive data.2National Institute of Standards and Technology (NIST). FIPS PUB 197, Advanced Encryption Standard (AES)
How to Tell a Scam From a Legitimate Request
The fact that real lenders ask for bank access is exactly what scammers exploit. They build fake verification screens that mimic the real thing. A few concrete differences separate them.
A legitimate request sits inside an application you started. It appears as an aggregator widget with recognizable branding (Plaid, Finicity, or MX) and takes you to your bank’s actual login page or to the aggregator’s branded screen. You arrived there by typing the lender’s URL yourself or by clicking through from a comparison site you chose.
A scam almost always starts differently. The Federal Trade Commission warns that legitimate companies do not email or text you a link to update your payment or login information.3Consumer Advice (FTC). How To Recognize and Avoid Phishing Scams Specific warning signs:
- A loan officer asks for your bank password by phone, email, or text. No legitimate lender does this.
- Unsolicited contact about a loan “application” you never submitted, with a request to verify your bank details.
- Generic greetings like “Dear Customer” instead of your name.
- Pressure to link your account within hours or lose approval.
- A login screen that shows no recognizable aggregator or bank branding.
If something feels off, close the window. Open a new browser tab and type the lender’s URL yourself rather than clicking a link in an email. The FTC takes enforcement action against deceptive data collection under Section 5 of the FTC Act.4Federal Trade Commission. Privacy and Security Enforcement
Your Legal Protections
Several layers of federal law apply when you share bank credentials with a lender. The Gramm-Leach-Bliley Act requires any company offering financial products to safeguard sensitive customer data, and the FTC’s Safeguards Rule obligates covered companies to maintain an information security program with administrative, technical, and physical protections.5Federal Trade Commission. Gramm-Leach-Bliley Act You should receive a privacy notice explaining how the lender will use your information.
If an unauthorized transfer later hits your account, the Electronic Fund Transfer Act caps your liability based on how quickly you report. Notify your bank within two business days of learning about the problem and your liability is capped at $50. Report after two business days but within 60 days of the statement being sent and the cap rises to $500. Wait longer than 60 days and you could be liable for the full amount.6Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer liability
One wrinkle: there is genuine disagreement over whether EFTA protections fully apply when you voluntarily shared credentials with an aggregator. Industry groups have argued that doing so might weaken an unauthorized-transfer claim; consumer advocates say the rights survive regardless. The CFPB has acknowledged the ambiguity without resolving it. The practical response is to watch your statements closely after linking an account and report anything suspicious within two business days, which gives you the strongest position no matter how the question is eventually settled.
There is also a CFPB Personal Financial Data Rights rule, finalized under Section 1033 of the Dodd-Frank Act, that would restrict aggregators and third parties to collecting only data reasonably necessary to deliver the requested product, prohibit using your data for targeted advertising or resale, and expire authorization after one year unless you renew it.1Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule As of early 2025, a federal court in Kentucky enjoined the CFPB from enforcing the rule while the agency reconsiders portions of it, so timing on when protections take effect is uncertain. Many large aggregators have already adopted its core principles voluntarily.
Turn Off Access Once the Loan Closes
Most borrowers forget this step. The aggregator connection to your bank account typically stays active after your loan funds unless you manually disconnect it. The lender rarely needs ongoing access, but the link persists until you cut it.
For Plaid connections, log into the Plaid Portal, select the app you want to disconnect, and follow the prompts to remove the connection. Plaid notes that disconnecting “may not remove data you’ve already shared with the app and that the app has already stored in their systems.”7Consumer Help Center. How do I disconnect my financial accounts from an app To get already-shared data deleted, contact the lender directly and ask them to purge it.
You can also delete your account data from Plaid itself through the Accounts section of the Plaid Portal by selecting your financial institution and choosing “Delete from Plaid.” That removes it from Plaid but does not pull it back from any app that already received it.8Consumer Help Center. How do I delete financial accounts from the Plaid Portal For Finicity, MX, or other aggregators, check with the aggregator or your bank for the equivalent disconnect option.
If You’d Rather Not Link Your Account
You can almost always opt out. Most lenders accept paper documentation instead: typically two to six months of bank statements plus pay stubs or W-2s to verify income. Self-employed borrowers should expect to submit more, potentially two years of statements and a profit-and-loss statement.
The tradeoff is time and sometimes money. Digital verification completes in seconds; manual review requires a human underwriter and adds days or weeks, especially if the lender comes back for additional documents. Some borrowers also report slightly less favorable terms with manual underwriting, including higher rates or additional origination fees, because manually underwritten loans cost more to process. Quoted rate differences can run from half a percentage point to nearly a full point.
If the convenience is worth the exposure, link the account, then disconnect as soon as the loan funds. If not, ask the lender upfront for the complete list of documents they’ll need so you don’t end up in multiple rounds of requests that stretch the timeline further.