How does a bank connection provider like Plaid work?
When a budgeting app asks to connect your bank, it usually hands you off to a provider. Plaid is one of the most common in the US. The provider sits between the app and your bank and does the connecting, so the app never has to.
The modern version of this is OAuth. In Plaid's own documentation, OAuth lets you grant access "without sharing their credentials directly with the third party," and during the flow "end users temporarily leave Link to authenticate" on the bank's own site or app (Plaid OAuth guide). You sign in where you always sign in. The budgeting app is not in the room.
When you finish, the bank tells the provider you said yes. The app gets a token, a long random string that stands in for your permission, not your password. The app's server exchanges a short-lived public token for an access token and uses that to pull balances and transactions going forward.
What can a connected app see and what can it do?
A data connection is read-only. The app can read what you let it read, typically account balances and transaction history. It cannot log in as you, move money, or change anything at the bank through that connection.
You also control the scope. Plaid lets you "select which accounts you want to connect with a given app," and apps list the data types they request, such as transactions or account and routing numbers (Plaid safety page). If a budgeting app wants routing numbers and you only want spending charts, that is worth a pause.
What the app does with the data after it arrives is a separate question. That is governed by the app's privacy policy, not by the provider.
What is the difference between OAuth and screen scraping?
Screen scraping is the old way. You type your bank username and password into the app or provider, and it logs in as you to copy your data. It works, but now a third party holds your actual credentials.
Regulators have been pushing the industry off it. The Consumer Financial Protection Bureau's personal financial data rights rule, finalized October 22, 2024, called screen scraping "a still common but risky practice" and aimed to move data sharing toward methods where you never hand over your password (CFPB, 2024). Whatever happens to that rule politically, the direction is set: OAuth is the standard, scraping is the fallback.
The practical tell: if you land on your bank's real website or app to sign in, that is OAuth. If you type your bank password into a screen that belongs to the budgeting app or a provider, that is scraping. Many banks support OAuth now, and some still do not, so the login step is where you find out.
What should you check before you connect?
Five things, in order:
- Is there a named provider? If the app does not say who handles the connection, assume the app is storing your credentials itself.
- Do you sign in on your bank's page? Look for your bank's own domain or app during the login step. A convincing fake bank login screen is the main phishing risk here, so slow down at that moment.
- What data types does it request? Spending apps need transactions and balances. They rarely need account and routing numbers.
- What does the privacy policy say about sharing and selling? Plaid states it does not sell financial data to third parties for marketing or advertising (Plaid safety page). The app you are connecting needs to make an equally clear statement about its own practices.
- Can you export and delete? Both should be real features, not a support ticket.
Then turn on two-factor authentication for the app itself, and for the email address attached to it. If a breach happens, the thing most at risk is the app's own copy of your transaction history, and your app login is the door to it.
How do you revoke access if you change your mind?
You have three places to pull the plug, and you can use all of them.
At the provider. Plaid runs a portal at my.plaid.com where you can see every app connected through Plaid and "the types of data shared with each app," disconnect any of them, and delete data held in Plaid's systems (Plaid Portal help). The disconnect steps are: sign in, pick the app under Overview, scroll to Manage connections, choose Disconnect app, then pick the institution and confirm (Plaid disconnect guide).
At the bank. Banks that support OAuth usually have a page in online banking that lists connected apps, with a revoke button beside each one.
At the app. Delete the connection in settings, then request deletion of your account and data.
One important caveat from Plaid's own help page: disconnecting stops future sharing, but "the app may still keep data it has already collected." To get that deleted, you contact the app directly. The CFPB's 2024 rule took the same view, requiring that revocation be simple and that data deletion be the default when access ends (CFPB, 2024).
Where Enrich fits
Enrich connects to your bank through Plaid, so your bank sign-in happens with Plaid and your bank, and Enrich never sees or stores your bank username or password. Access is read-only, and you can disconnect at any time from the Plaid Portal, from your bank, or inside the app. Enrich is in iPhone beta and free during beta, with the waitlist at joinenrichapp.com. Read the privacy policy before you connect, the same way you would with any app.
Quick answers
Can a budgeting app move money out of my account?
Not through a read-only data connection. Bank sync through a provider like Plaid gives an app permission to read balances and transactions. Moving money requires a separate payment authorization that a budgeting app would have to ask for explicitly.
Does Plaid give the app my bank password?
No. With OAuth, you sign in on your bank's own site or app and the budgeting app receives a token that represents your permission, not your credentials. Plaid's documentation describes OAuth as access granted without sharing credentials with the third party.
How do I disconnect a budgeting app from my bank?
Sign in at my.plaid.com, choose the app, scroll to Manage connections and select Disconnect app. You can also revoke access in your bank's online banking and delete the connection in the app. Then ask the app to delete data it already holds.
Is it safer to type transactions in manually?
Manual entry avoids a data connection, but most people stop doing it within weeks, so the budget dies. A read-only OAuth connection through a named provider is a reasonable trade for most people, as long as the app is clear about data use and deletion.