5

To add money into my PayPal wallet I have to use Trustly. Trustly connects to my bank account and draws the funds from there.

In order to connect to my bank account I need to provide them with MY BANK USERNAME AND PASSWORD.

I can see my bank balance, I receive a one time token SMS from my bank to agree with the transfer... the integration between Trustly and my bank is legit.

However...

The thing that bothers me is that I need to add my bank username and password on the Trustly site. Most of the merchant integrations of these type I have seen usually involve a redirect to my bank site where I insert my username and password, I authorize what needs to be authorized, etc, then get redirected back to where I came from. So basically, nobody but my bank deals with my credentials. Not so with Trustly, where I give them my bank username and password. They say they don't store any credentials, and I still need a one time token that my bank provides, but still... can they be trusted with my bank credentials?

If they do store them and someone gets access to them, I am still exposed to social engineering attacks where someone might try to convince me to give them the one time password.

Improve this question
8
  • 3
    Why do you you "have to use Trustly"? What's wrong with moving funds using the Paypal site?
    – Ben Voigt
    Apr 8, 2019 at 3:56
  • 2
    @Pips Probably Ben is confused about the same thing as I am: shouldn't PayPal be able to do the withdrawal on its own?
    – glglgl
    Apr 8, 2019 at 10:51
  • 1
    @Pips: Must work differently in different countries, or perhaps depending on the bank.
    – Ben Voigt
    Apr 8, 2019 at 13:21
  • 1
    Giving your login credentials to a third party is probably a violation of your bank's terms of service. Nobody needs your credentials to initiate a transfer to your account.
    – chepner
    Apr 8, 2019 at 18:59
  • 2
    @chepner: A number of these designed-to-be-convenient-with-no-forethought-given-to-security services want you to think you are "logging into your bank" but the actual credential prompt is on the middleware site. If OP says the middleware is prompting for his credentials instead of letting the bank site handle the credentials, I'm inclined to believe him. See also github.com/plaid/link/issues/68 for analysis of a similar service
    – Ben Voigt
    Apr 8, 2019 at 22:47

3 Answers 3

Reset to default
2

"Can be trusted" isn't really a binary question, it's a balance of risk and benefit. I have to place a lot more trust in my bank than Paypal, since my bank is ultimately the holder of my money. However in this case, as you have pointed out, Trustly would effectively have full access to your bank account if they desired. Assuming they are a company that you can verify PayPal is actually partnering with, you can be pretty sure that they won't outright steal your money. However, they could covertly use the opportunity to automatically scrape your account information, transaction histories, and any other information on the account that could be sold to data agencies. The other problem is that your bank likely specifies in their TOS that sharing your banking login information violates it, which could introduce you to other problems if Trustly does misuse your account information and you ask your bank for help. None of this considers what happens if Trustly has nothing but the purest intentions, but does not properly scrub your account information and it is stolen from them.

Ultimately I cannot tell you how important tying your Paypal account directly to your bank is to you. However, providing your bank login credentials to a third party is extremely inadvisable in almost any situation.

Improve this answer
1
  • 2
    Providing your bank login credentials to a third party is not just inadvisable, but almost certainly a violation of your terms of service with your bank.
    – chepner
    Apr 8, 2019 at 18:58
1

I never use Trustly because of the way the integration is implemented. There are ways to allow payments without having to give total control to the payment provider, so it sounds to me that they are most likely not having only the most pure intentions. Oh and I don't care what they officially try to parrot.

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Mar 13 at 8:44
1

Nobody but you can be trusted with your bank login credentials. Sharing them is probably a violation of the terms of your bank's online access.

Which is part of why I refuse to use web-based financial management tools except those built into the banks themselves. I'm willing to give a password to Quicken to be recorded on my own machine (or store it on my non-networked password manager, also only on my own machine) but that's my limit, and I'd much rather folks moved to the newer protocol which assigns a separate credential for that purpose.

Whatever Trustly is, the mere fact that they are making the request would send me screaming in the other direction.

Especially since PayPal should be able to credit and debit your account with nothing more than the routing number and account number, the same way other direct deposits and direct payments do. (Even with that more protected access, I've seriously considered setting up a separate account to isolate it from the rest of my funds.)

This really sounds much more like scam than anything else. It might be honest, but I see no reason to assume so... and even granting the assumption, not knowing how they store and protect the credentials would make me extremely uncomfortable. And I see absolutely no need for it, at least in the banking systems I am familiar with.

I would assume scam, or if not scam then incompetent and untrustworthy, untill proven otherwise. And even with proof, I wouldn't trust it.

Improve this answer
1
  • The ICANN lookup says that trustly.com is indeed owned by Trustly Group AB in Stockholm, and has been since 2006. So this may be legit, just very, very badly designed. I still wouldn't touch it.
    – keshlam
    Mar 13 at 23:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .