40

This question is not about whether Mint.com is secure, or not. That is beside the point. (Refer to this question on the subject of trusting Mint.com and similar services.) Rather:

Are bank customers permitted, under whatever account agreement they typically sign, to provide their username & password or other account credentials to sites like Mint.com?

Would a banking customer be giving up some of the protection offered by their bank if they voluntarily disclosed sensitive account details to a third party service?

Are many people using Mint.com without understanding their responsibilities with respect to protecting their own account credentials? (Call me a skeptic :-)

Improve this question
3
  • :O +1 I never thought of this.
    – Plynx
    Mar 2, 2010 at 1:17
  • +1 good point. I would say no, never trust anyone with your password and username. It is like handing over your wallet to a stranger
    – gyurisc
    Mar 17, 2010 at 6:32
  • Related: In the UK, recent developments are trying to put such "third party" apps on a proper footing, giving approved providers of Mint-like products an officially-sanctioned way of accessing your account: see Open Banking.
    – TripeHound
    Sep 28, 2018 at 8:12

4 Answers 4

Reset to default
15

The My Money Blog did an article on this very topic a while ago.

I think if you look in the T&C for Mint, it says somewhere that you are giving a "limited" power of attorney to Mint that allows them to login to various websites on your behalf.

For purposes of this Agreement and solely to provide the Account Information to you as part of the Service, you grant Intuit a limited power of attorney, and appoint Intuit as your attorney-in-fact and agent, to access third party sites, retrieve and use your information with the full power and authority to do and perform each thing necessary in connection with such activities, as you could do in person.

Improve this answer
1
  • Is the implication here that allowing an entity with power of attorney to access your bank information is not a violation of the bank TOS that otherwise forbids you from sharing your login info?
    – Tashus
    Oct 28, 2019 at 21:03
8

Yes, the T&C for all banks I have accounts with say you must never tell anyone (or any software etc.) your password and the username.

Therefore if you make use of Mint.com, I would expect the bank to have a "get out of jail free card" if any money ever went missing from your account for any reason.

Improve this answer
2
  • +1, though you have some typos in your answer, I assume you mean "get out of jail card" if any money ever went...
    – Rich Seller
    Feb 21, 2010 at 14:37
  • 2
    Sounds like "any software" would apply to Quicken and other similar services too.
    – user296
    Feb 25, 2010 at 19:48
6

Mint.com relies on its users to break rules to use their service. Regardless of bank policies, in the end you are trusting a third party to login to your account on your behalf, where it will have full control of your account.

For at least some of the banks it links to, it is not using a well documented open standard, like say OFX. It needs to crawl the web site and impersonate you. This means entering your name, password, passmark, security questions, etc. You're giving them all the keys. This also means if the bank changes its layout or functionality, Mint will have trouble updating and you might not know.

Lastly, if you hardwire Mint to your bank accounts and begin relying on it, you will find it difficult to later change banking passwords because it becomes even more of a hassle.

Improve this answer
3
  • 2
    If only banks could use modern tools like OAuth (not necessarily exactly that but in the same direction) and support standard ways of exporting data... Unfortunately, most of them are barely 20th century, let alone 21st.
    – StasM
    Dec 5, 2010 at 23:51
  • It'd be awesome if they were like facebook or sites that use OAuth so that you have to be logged in to your bank, then give permission to the application, and also that the would be a detailed list of what the third party needs to access. And furthermore it'd be awesome that this wouldn't break your security agreement with your bank unless you grant thirdparties access to withdraw funds on your behalf (which I imagine would be easier just using a debit card).
    – trusktr
    Mar 20, 2011 at 3:27
  • As a matter of fact, any movement of funds would never be allowed by any third parties. They should only be able to read information. Movement of cash would require a debit card to be completely safe.
    – trusktr
    Mar 20, 2011 at 3:29
3

This doesn't seem any different than telling my wife my username/password and both of us using the same login. Am I to assume that this is also against the T&C?

Actually, I don't want to assume and just tell you what I think would be allowed/disallowed. So let's use an actual terms of use statement: https://www.chase.com/ccp/index.jsp?pg_name=ccpmapp/shared/assets/page/terms

The only two clauses that deal with passwords are as follows:

Unauthorized use of JPMorgan Chase's Websites and systems, including but not limited to unauthorized entry into JPMorgan Chase's systems, misuse of passwords, or misuse of any information posted to a site, is strictly prohibited.

...

You agree that (i) you will not engage in any activities related to the Website that are contrary to applicable law, regulation or the terms of any agreements you may have with JPMorgan Chase, and (ii) in circumstances where locations of the Website require identification for process, you will establish commercially reasonable security procedures and controls to limit access to your password or other identifying information to authorized individuals.

The unauthorized use clause seems to be simply stating the obvious: that it is prohibited to access someone's account without authorization. (i.e. Don't steal someone's password and use it and don't hack into their servers.) That wouldn't apply here since the Mint.com / quickenonline user authorizes the company.

The second clause does seem to address this situation. As I read it, it basically just says to use sound security practices. I would say that means if you do your research and you trust Mint.com to protect your password then you are free to choose to authorize them to log in on your behalf.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .