0

I have just discovered that my local bank, Nordea, has decided to remove the only good thing about their entire operation: the so-called "simplified login" feature on their website, which allows (soon allowed) the customer to log in to a kind of very limited "read-only" mode which basically just allowed you to see your current balance, the last few transactions (limited descriptions) and see whether or not there are any new "customer support messages", but not read those messages, not make any kind of payments, edit accounts, etc.

Now, they will only allow "full" logins, which 100% prevents any kind of automation and requires you to sit with a hardware device and enter numbers into it and then into the webpage before it allows you to see as much as your account balance. Other than being very obnoxious for every customer, it also blocks me and other "advanced" users out from our custom-programmed bots which have always regularly logged in with that "simplified" login method just to regexp out the current balance/new messages and then notify us via whatever mechanism we use privately.

I have previously asked them if they have any kind of JSON/RSS API of any kind, but no. They don't even have as much as e-mail notifications! Nothing except their spyware "smartphone app" which I would never install, nor would I ever allow such a surveillance device to track me 24/7 in the first place. Only by being a registered corporation with special, way more costly account types do you get any kind of "API" access from them, even to do this most basic imaginable task.

Before you tell me to switch banks, the others are at least just as bad (even worse from what I can tell, and for a longer time), and the act of switching banks is practically impossible for me personally.

What I'm asking is if maybe somebody knows of some sort of "hidden standard" or something which all banks in the world support, but don't have documented, for people like me to automate basic things such as knowing my account balance. Needless to say, I have looked for this countless times on their website, asked them about it, and asked other people about it. Nobody seems to know anything, or, if they do, won't tell me.

I know that there are a bunch of "Nordea-supporting" PHP libraries and whatnot on Github, but they are all ancient and even if they were up to date, they were most likely using the same method as I have been using: automating the login process through their "simplified login" mechanism, which is "soon" to be gone. (Probably at new year; they didn't even mention any dates or time frames.)

And yes, I have a Bitcoin wallet and have that fully automated. The problem is that virtually nobody else in the world cares about my Bitcoin, so "switching to Bitcoin" remains a pipe dream which I would be ready to do, but the world clearly isn't.

Improve this question
2
  • Isn't this what you are looking for? developer.nordeaopenbanking.com
    – HTLee
    Dec 30, 2019 at 16:21
  • 2
    Without an answer, I would probably have VTC this question as little more than a rant. Given the very useful answer (at least to those with Nordea accounts), it is probably worth keeping. To that end, I have taken the liberty of editing the title to be more useful (IMHO). The body of the question might also be edited (it probably needs little more than "Is there a way of accessing Nordea account data now that they are removing / have removed "simplified login"?"), but I don't feel happy making such a drastic change unilaterally.
    – TripeHound
    Dec 31, 2019 at 8:28

1 Answer 1

Reset to default
4

Well, there is good news and better news. The good news is that Nordea Bank does have an API that can be leveraged to access the customer account data. The better news is that you don't have to sign up for any kind of limited-access developer program to publish code that uses their APIs.

The specific feature set you seem to be looking for (Personal Accounts data) is freely available and well documented at: https://developer.nordeaopenbanking.com/app/documentation?api=Accounts%20API

You will also need to get comfortable with the Access Authorization command set in order to provide for secured logins for your application. https://developer.nordeaopenbanking.com/app/documentation?api=Access%20Authorization%20API

But, all in all, Nordea actually offers one of the more programmer-power-user friendly services I've seen in the banking industry. Anyone can program against their APIs, and they are well documented and publically available. I'd call it a win from the programmer side. And I'd call it a win from the security side that they disabled the old "simple login" method (it wasn't very secure, and made their whole customer-facing platform substantially more vulnerable to attack). Welcome to the modern world of information security where you use OAuth tokens for the process instead of the user's password -- and where the token can be constrained to just the limited permissions required (read-only in your case).

Improve this answer
5
  • 2
    "use OAuth tokens for the process instead of the user's password -- and where the token can be constrained to just the limited permissions required (read-only in your case)" Oh I wish the rest of the banking world would get onboard with that yesterday. Then I might actually be able to have a Mint-like overview of accounts.
    – Ben Voigt
    Dec 30, 2019 at 22:27
  • 2
    @BenVoigt , most banks do have this, it is just hidden behind a private-only developer program. It's basically what Mint is doing with all their work; they (Intuit) has the weight to throw around to get access to all the banks' developer programs so they can OAuth enter your account. Its just that lots of the big banks don't want "just anybody" to be able to do the same thing (don't know why, part of the beauty of OAuth is the clear delineation of "them not us"). I wish that they'd all do like Nordea here and just make it publically accessible.
    – Ruscal
    Dec 31, 2019 at 1:32
  • 2
    +1 A really useful first answer to a question that I might otherwise have voted to close as little more than a rant against a bank imposing meaningful security.
    – TripeHound
    Dec 31, 2019 at 8:11
  • The previously suggested nordeaopenbanking.com thing doesn't work, because it turns out that they require you to have a registered company and with special permissions on top of that in order to actually use this API. As such, that answer is sadly useless (although very much appreciated that somebody tried to help -- they sure don't make it obvious at all that you need a company anywhere on their site). They told me this in a support reply.
    – Richard
    Dec 31, 2019 at 15:13
  • I'm sorry about that @Richard. I went as far down as I could (without having a banking account with them) and never got to the authorized-developers-only bit. That does stink. I really really wish places would stop doing that. As long as their APIs are good and their OAuth permission-grant pages are explicit, then they should welcome the "anyone can write against the API" crowd.
    – Ruscal
    Dec 31, 2019 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy