Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is not about whether is secure, or not. That is beside the point. (Refer to this question on the subject of trusting and similar services.) Rather:

Are bank customers permitted, under whatever account agreement they typically sign, to provide their username & password or other account credentials to sites like

Would a banking customer be giving up some of the protection offered by their bank if they voluntarily disclosed sensitive account details to a third party service?

Are many people using without understanding their responsibilities with respect to protecting their own account credentials? (Call me a skeptic :-)

share|improve this question
:O +1 I never thought of this. – Plynx Mar 2 '10 at 1:17
+1 good point. I would say no, never trust anyone with your password and username. It is like handing over your wallet to a stranger – gyurisc Mar 17 '10 at 6:32
up vote 13 down vote accepted

The My Money Blog did an article on this very topic a while ago.

I think if you look in the T&C for Mint, it says somewhere that you are giving a "limited" power of attorney to Mint that allows them to login to various websites on your behalf.

For purposes of this Agreement and solely to provide the Account Information to you as part of the Service, you grant Intuit a limited power of attorney, and appoint Intuit as your attorney-in-fact and agent, to access third party sites, retrieve and use your information with the full power and authority to do and perform each thing necessary in connection with such activities, as you could do in person.

share|improve this answer

Yes, the T&C for all banks I have accounts with say you must never tell anyone (or any software etc) your password and user name.

Therefore if you make use of, I would expect the bank to have a "get out of jail card" if any money every went missing from your account for any reason.

share|improve this answer
+1, though you have some typos in your answer, I assume you mean "get out of jail card" if any money ever went... – Rich Seller Feb 21 '10 at 14:37
Sounds like "any software" would apply to Quicken and other similar services too. – fennec Feb 25 '10 at 19:48 relies on its users to break rules to use their service. Regardless of bank policies, in the end you are trusting a third party to login to your account on your behalf, where it will have full control of your account.

For at least some of the banks it links to, it is not using a well documented open standard, like say OFX. It needs to crawl the web site and impersonate you. This means entering your name, password, passmark, security questions, etc. You're giving them all the keys. This also means if the bank changes its layout or functionality, Mint will have trouble updating and you might not know.

Lastly, if you hardwire Mint to your bank accounts and begin relying on it, you will find it difficult to later change banking passwords because it becomes even more of a hassle.

share|improve this answer
If only banks could use modern tools like OAuth (not necessarily exactly that but in the same direction) and support standard ways of exporting data... Unfortunately, most of them are barely 20th century, let alone 21st. – StasM Dec 5 '10 at 23:51
It'd be awesome if they were like facebook or sites that use OAuth so that you have to be logged in to your bank, then give permission to the application, and also that the would be a detailed list of what the third party needs to access. And furthermore it'd be awesome that this wouldn't break your security agreement with your bank unless you grant thirdparties access to withdraw funds on your behalf (which I imagine would be easier just using a debit card). – trusktr Mar 20 '11 at 3:27
As a matter of fact, any movement of funds would never be allowed by any third parties. They should only be able to read information. Movement of cash would require a debit card to be completely safe. – trusktr Mar 20 '11 at 3:29

Okay, I know I'm reviving an old question here, and it is probably a lost cause. But ...

How is this any different than telling my wife my username/password and both of us using the same login? Am I to assume that this is also against the T&C? Actually, I don't want to assume and just tell you what I think would be allowed/disallowed. So let's use an actual terms of use statement:

The only two clauses that deal with passwords are as follows:

Unauthorized use of JPMorgan Chase's Websites and systems, including but not limited to unauthorized entry into JPMorgan Chase's systems, misuse of passwords, or misuse of any information posted to a site, is strictly prohibited.


You agree that (i) you will not engage in any activities related to the Website that are contrary to applicable law, regulation or the terms of any agreements you may have with JPMorgan Chase, and (ii) in circumstances where locations of the Website require identification for process, you will establish commercially reasonable security procedures and controls to limit access to your password or other identifying information to authorized individuals.

The unauthorized use clause seems to be simply stating the obvious: that it is prohibited to access someone's account without authorization. (i.e. Don't steal someone's password and use it and don't hack into their servers.) That wouldn't apply here since the / quickenonline user authorizes the company.

The second clause does seem to address this situation. As I read it, it basically just says to use sound security practices. I would say that means if you do your research and you trust to protect your password then you are free to choose to authorize them to log in on your behalf.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.