My fiancé wants to transfer a substantial amount from his Norwegian bank account to my U.S. bank account in a different and unaffiliated bank. He says he does not want to wire transfer the money. Instead, he says he has to link the two accounts and needs my security info to do that. The Norwegian account is in Euros and my account is in dollars.
There is no banking process in the world which requires you to share your "security info" (passwords, PINs, TANs, mother's maiden name or other authentication factors) with a third party.
No bank anywhere in the world will tell you that there is any situation whatsoever where you are supposed to give those secrets to anyone but them.
No bank anywhere in the world will ever tell you that they need you to obtain that secret information from someone else.
Whenever anyone who didn't prove to you that they are your bank claims they need your banking login for any purpose whatsoever, they either misunderstood something or are lying. Every legitimate banking process, domestic or international, can be done without this.
Assuming that the other party is indeed just misinformed and not acting in bad faith, call your bank and ask them the following questions:
- Do they offer an account linking service with banks in other countries? (I would be surprised if they do, but maybe there are actually banks which offer this)
- Do they offer an account linking service between accounts denominated in different currencies? (Also unlikely. How would they handle conversion fees? But again, I can't prove a negative.)
- If they do, what information does the other bank need about your account? (And here I am pretty certain: They will tell you to fill out forms and sign documents and write letters and maybe show up in person, but they will not tell you to give anyone your "security info")
This answer isn't going to tell you how to determine if this is a scam, and is assuming that your bank and the other bank can do this across borders and with different currencies.
In general one bank will need the routing number of the bank and the account number that is being linked. They then send one or more micro transactions to verify that the numbers are correct. Then the user who supposedly has access to both accounts verifies the sizes of the micro transactions. This step proves that the person has access to both accounts.
The fact that they need to verify the amount of the micro transactions is where a scammer will request the login info. They need to see the transactions. Of course these transactions aren't done instantly so there is no need to be logged into both accounts at the same time. My credit union in their description of the process explains that it can take 5 days. Which means that somebody has to check periodically. This makes the request to have the login info seem legitimate.
Once these accounts are linked money can move either direction. But generally with these links it can only be to the checking account or to a savings account. The login info means that any other accounts besides the checking or savings account are vulnerable. Their funds can be moved into the linked account, just before the funds are transferred out of your bank.
Your bank doesn't need your password. They don't know your password. They store a salted and encrypted version of your password. If a trusted employee, like a loan officer, needs to see your account balances their password protected account gives them the power. If a trusted employee, like a teller, needs to move money into or out of your account their password protected account gives them the power. they need to user their login to make sure the system is logging their activities.