Open banking is generally safer than the password-sharing setup it replaced, because the app you connect to never sees your bank login. How safe it actually is for you depends on three things: the security of every company that touches your data, how quickly you catch and report any unauthorized activity, and a federal rulebook that is still being rewritten. The short answer is that the technology removes the worst risk of the old model, but the consumer protections around it are a mix of firm rules, pending rules, and gaps you should know about before you connect an account.
Why API Connections Are Safer Than Password Sharing
Before open banking, budgeting and finance apps typically used screen scraping. You handed over your bank username and password, and the app logged in as you to pull account data. That gave the third party the same access you have, which meant any breach at the app, or any careless handling of your credentials, could expose your entire account.
Open banking replaces that with an Application Programming Interface. The API is a structured connection between your bank and the app. Your login credentials stay with the bank. The bank verifies your identity directly, then sends only the specific data the app asked for — transaction history, balances, whatever you authorized — through the API. If the app is later breached, attackers get the data that was shared with it. They don’t get the keys to your account, and they can’t initiate transfers using stolen credentials.
The connection itself is encrypted in transit using Transport Layer Security, the same protocol behind any “https” website, and data is typically encrypted again while stored on the provider’s servers. Before data starts flowing, most banks also require a second factor to verify it’s really you: a code to your phone, a biometric check, or a push notification through the bank’s app. That makes it hard for someone to connect your account to a new service even if they already have your banking password.
The Consumer Financial Protection Bureau’s finalized Personal Financial Data Rights rule explicitly says data providers can’t satisfy their obligations by allowing third parties to screen-scrape consumer accounts; the rule was designed to push the market toward API-based access.1Federal Register. Required Rulemaking on Personal Financial Data Rights Enforcement of that rule is currently on hold, so some companies may still use credential-based access where API connections aren’t available yet.
Who Actually Holds Your Data
In most cases, the app you use doesn’t connect to your bank directly. A data aggregator sits in between. Companies like Plaid and Finicity maintain API connections with thousands of banks and credit unions, pulling your data from the bank and reformatting it for whichever app asked for it.2Federal Reserve Bank of Kansas City. Data Aggregators: The Connective Tissue for Open Banking That means your financial data usually passes through at least one additional company before reaching the service you signed up for.
Under the CFPB’s Section 1033 framework, the aggregator must certify to you that it will follow the same data-use restrictions as the app, and its name has to appear in the authorization disclosure you see before sharing data, along with a description of its role.3Consumer Financial Protection Bureau. Regulation 1033.431 – Use of Data Aggregator If the app brings an aggregator in after you’ve already authorized the connection, the aggregator has to send you its certification separately. Responsibility for complying with the authorization rules sits with the app, not the aggregator.
What Apps Can and Can’t Do With Your Data
The CFPB rule puts a hard limit on secondary uses. A third party must restrict its collection, use, and retention of your data to what is reasonably necessary to provide the product or service you asked for. Three things are explicitly outside that standard and can’t be bundled into the same authorization:
- Targeted advertising aimed at influencing your purchasing behavior
- Cross-selling the app’s other products or services to you
- Selling, renting, or otherwise sharing your data with others for money
None of those count as “reasonably necessary” for any product or service.1Federal Register. Required Rulemaking on Personal Financial Data Rights Enforcement of these limits, though, is tied to a compliance timeline that is currently stayed.
Your consent also has a time limit built into the rule: an authorization lasts no more than one year. After that, the third party has to ask again, and if you don’t reauthorize, it must stop using and retaining your data unless keeping it is still reasonably necessary for a service you’re actively using. By comparison, the reauthorization window in the United Kingdom and European Union is 90 days.
You can revoke consent at any time, without waiting for the authorization to expire. Most banks now have a section inside the mobile app or website where you can see every active third-party connection and disconnect any of them. Once you revoke access, the third party has to stop collecting new data, and under the CFPB rule it also has to stop retaining what it already has unless continued retention is reasonably necessary for a service you’re still using.
The Current Status of Federal Rules
Section 1033 of the Dodd-Frank Act tells the CFPB to require financial institutions to make your account data available to you and to third parties you authorize.4Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights The CFPB finalized its detailed rule in November 2024, covering security standards, consent procedures, and the data-use restrictions above.
That rule isn’t currently in effect. A federal court in the Eastern District of Kentucky stayed the compliance deadlines after the CFPB announced it would reconsider the rule, and the agency is working on a new proposal that will extend the compliance dates.5Federal Register. Personal Financial Data Rights Reconsideration So the authorization disclosures, aggregator certifications, one-year window, and secondary-use limits described above describe the rule on paper, not an actively enforced baseline today.
Other federal law still applies. The Gramm-Leach-Bliley Act requires every financial institution to maintain administrative, technical, and physical safeguards to protect customer records, guard against anticipated threats, and prevent unauthorized access that could cause substantial harm.6SEC. Gramm-Leach-Bliley Act Third parties that handle your financial data through open banking channels are generally required to maintain information security programs meeting those standards. And the Electronic Fund Transfer Act, through Regulation E, gives you specific liability protections when unauthorized transactions happen.
Your Liability If Something Goes Wrong
For personal accounts, Regulation E caps what you can be forced to pay when an unauthorized electronic transfer occurs. The cap depends on how fast you report it:
- Report within two business days of learning about the problem, and your liability is limited to $50 or the total unauthorized transfers before you notified the bank, whichever is less.
- Report after two business days but within 60 days of your statement date, and your liability can rise to as much as $500, based on transfers that happened after the two-day window but before you reported.
- Report more than 60 days after your statement date, and you can be liable for the full amount of unauthorized transfers that occurred after the 60-day window, with no cap.
Those windows run from when the bank sends your periodic statement showing the unauthorized transfer, not from the date of the transfer itself.7eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Speed is the single biggest factor in how much of a loss falls on you.
Business Accounts Don’t Get These Caps
Regulation E applies only to accounts established primarily for personal, family, or household purposes, and it defines a “consumer” as a natural person. Business accounts are excluded.7eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers If you connect a business checking account to an open banking service and an unauthorized transfer happens, the $50 and $500 caps don’t help you.
Commercial electronic fund transfers are instead governed largely by Article 4A of the Uniform Commercial Code. Under that framework, if your bank followed commercially reasonable security procedures and accepted a payment order in good faith, the loss from an unauthorized transaction can fall on you as the business account holder even though you didn’t authorize the transfer. The exact allocation of risk depends on the security agreement with your bank, which is worth reading closely and, if appropriate, negotiating or supplementing with insurance.
Using Open Banking Safely
A few habits do most of the work in keeping an open banking connection safe:
- Read the authorization screen before you tap approve. It should name the third party, name any data aggregator involved, specify exactly what data will be accessed, state the purpose, and state how long access will last. You may be able to narrow what’s shared.
- Review your bank’s list of active connections every few months and disconnect anything you no longer use.
- Turn on transaction alerts so unauthorized activity shows up in minutes rather than at statement time. The Regulation E windows reward early reporting heavily.
- For business accounts, read the commercial account agreement before connecting anything, and understand how your bank allocates liability for unauthorized transfers.
If You Suspect a Problem
If you see unauthorized transactions or think your data has been exposed through an open banking connection, move quickly:
- Contact your bank first. The sooner you report, the lower your liability under Regulation E. Ask for written confirmation and note the date and time.
- Revoke the third-party connection through your bank’s app or website to stop any further data sharing.
- Check every account, not just the one tied to the open banking service, for additional unauthorized activity.
- If personal information was exposed, file an identity theft report at IdentityTheft.gov. The site generates a recovery plan and produces a formal FTC Identity Theft Report you can use to dispute fraudulent accounts and place alerts with creditors.8Federal Trade Commission. IdentityTheft.gov
- Keep records of every call, email, and filing. Documentation of prompt reporting is what protects your position if a reimbursement dispute arises.
A credit freeze at the major credit bureaus is a reasonable precaution after a breach, but it won’t stop an open banking connection; freezes restrict access to your credit report for lending decisions, not account-level data flowing through bank APIs. Revoking the connection is the step that actually shuts off the data flow.