2

To add money into my PayPal wallet I have to use Trustly. Trustly connects to my bank account and draws the funds from there.

In order to connect to my bank account I need to provide them with MY BANK USERNAME AND PASSWORD.

I can see my bank balance, I receive a one time token SMS from my bank to agree with the transfer... the integration between Trustly and my bank is legit.

However...

The thing that bothers me is that I need to add my bank username and password on the Trustly site. Most of the merchant integrations of these type I have seen usually involve a redirect to my bank site where I insert my username and password, I authorize what needs to be authorized, etc, then get redirected back to where I came from. So basically, nobody but my bank deals with my credentials. Not so with Trustly, where I give them my bank username and password. They say they don't store any credentials, and I still need a one time token that my bank provides, but still... can they be trusted with my bank credentials?

If they do store them and someone gets access to them, I am still exposed to social engineering attacks where someone might try to convince me to give them the one time password.

  • 2
    Why do you you "have to use Trustly"? What's wrong with moving funds using the Paypal site? – Ben Voigt Apr 8 at 3:56
  • @BenVoigt: What do you mean? I added funds to my PayPal wallet from my bank account, and Trustly is the only option I had. – Pips Apr 8 at 9:01
  • 1
    @Pips Probably Ben is confused about the same thing as I am: shouldn't PayPal be able to do the withdrawal on its own? – glglgl Apr 8 at 10:51
  • @Pips: Must work differently in different countries, or perhaps depending on the bank. – Ben Voigt Apr 8 at 13:21
  • 1
    @chepner: A number of these designed-to-be-convenient-with-no-forethought-given-to-security services want you to think you are "logging into your bank" but the actual credential prompt is on the middleware site. If OP says the middleware is prompting for his credentials instead of letting the bank site handle the credentials, I'm inclined to believe him. See also github.com/plaid/link/issues/68 for analysis of a similar service – Ben Voigt Apr 8 at 22:47
1

"Can be trusted" isn't really a binary question, it's a balance of risk and benefit. I have to place a lot more trust in my bank than Paypal, since my bank is ultimately the holder of my money. However in this case, as you have pointed out, Trustly would effectively have full access to your bank account if they desired. Assuming they are a company that you can verify PayPal is actually partnering with, you can be pretty sure that they won't outright steal your money. However, they could covertly use the opportunity to automatically scrape your account information, transaction histories, and any other information on the account that could be sold to data agencies. The other problem is that your bank likely specifies in their TOS that sharing your banking login information violates it, which could introduce you to other problems if Trustly does misuse your account information and you ask your bank for help. None of this considers what happens if Trustly has nothing but the purest intentions, but does not properly scrub your account information and it is stolen from them.

Ultimately I cannot tell you how important tying your Paypal account directly to your bank is to you. However, providing your bank login credentials to a third party is extremely inadvisable in almost any situation.

  • Providing your bank login credentials to a third party is not just inadvisable, but almost certainly a violation of your terms of service with your bank. – chepner Apr 8 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.