I was wondering how feasible it would be to use it as a basis for a service to facilitate e-commerce. It would require the user to give me, a 3rd party, their credentials which isn't something I'd recommend someone to do. But then again, Mint has done well for themselves doing just that so perhaps my opinion on the matter isn't entirely relevant.
PayPal, BrainTree, Stripe, etc. are not available in my corner of the world and I feel that's too bad cause a good payments solution could be a big deal to businesses and consumers alike if available. I'd be happy if the bank shuts down my service as long as they (or someone else) provide an alternative.
Have you provided your bank credentials to Mint or another similar 3rd party service? If so why? Did you ever stop to think if it was a bad idea? Do you think most people do?
[0] https://github.com/xtrumanx/zapi
That said, I still have a hard time convincing others of using the service due to security concerns. I also personally wouldn't really trust a startup/smaller company with my data either since they don't have as much on the line as a larger established company does.
A core issue is the need for a next-level financial data aggregator, somebody to pull together one's info across multiple banks, cards, investments, etc. Much as Bank X wants to provide all those services to me, and much as I may even want them to, other companies get involved and there's a need for a one-screen view of all of it, preferably updated near-live, and working on whatever interface/device I choose to use (notebook, phone, tablet; app, web browser).
Trust is the main thing. I was mad at myself for signing up for Mint (in a fit of frustration attempting to solve some problem) when it was new & independent; I'm still irritated but less so now that Intuit is taking responsibility.
I turned it off and deleted my data because the bank or brokerage would change something and break the automatic downloads and things would get out of date.
I believe banks and brokerages should have two levels of access: one where you can move money and one where you can look but not touch. I'd be much happier using the second type of password with Mint, with the bank's own apps, etc. I'm not thrilled at all about the idea of losing my phone and having someone get "write" access to my bank account.
I didn't think it was a bad idea, because it is clearly explained that Mint can't make changes to your accounts. It is only used for query. I am under the impression that the banks only allow Mint query capabilities. They've lately released a new service called "Mint Bills"-- which does make changes but that is separate from their main "Mint" service.
I've recommended Mint to friends and those who've tried it like it.
Things are changing lately, however. Banks are providing more and more "Mint-like" analytic services for their customers. These days, if you have your stuff at one bank there's little need for something like Mint.
I think there will always be room for a service that can work with multiple financial services/banks/accounts at the same time and with a uniform interface. Unfortunately, this is an exceedingly hard business for start-ups to crack (my opinion). To do it right (without asking users to literally surrender control of their accounts), services like Mint need to negotiate with multiple financial institutions-- not fun at all, just to get to the starting-point where one can compete with Mint.
Mint can do anything that you could do with the same credentials. Unless you have read-only credentials, they can technically make changes using your details.
Fast-forward a few months later and I’m using them again. Whatever concerns I had about data security did not outweigh having immediate information to all my accounts and reports that would take me too long to generate myself. I don’t worry so much about Mint abusing my data as someone hacking their services. I wouldn’t have the same trust level with a startup or smaller company though.
That's why people do it, and there's clearly an opportunity for a better experience...
But... I have personal checking and savings accounts at the local credit union, personal checking and savings accounts at one of the large, major banks, business checking and savings accounts at the (same previously mentioned) credit union, as well as several store and major credit cards issued by various financial institutions. (I tracked my vehicle loan within Mint as well, until I decided to just go ahead and pay it off.)
The convenience of being able to see all of them, quickly, within the same "single pane of glass" apparently outweighs the fears that I have or I wouldn't use it. An attacker acquiring the credentials for most of those accounts wouldn't be too much of an issue, honestly. The one account I would worry about would be my (primary) personal checking account but, luckily, the credit union's web site/software is pretty limited with regard to what kind of transactions could be performed... and, now that I think about it, I'm not sure I can initiate any transactions via their web site. The one thing I know I can do is the "online bill pay" but I would have to physically go into one of their branches to sign up for that before it was even available.
The solution is well-liked by merchants. Banks generally don't like it (for obvious security/privacy reasons), but are cautious in actually preventing it. SOFORT actually used to be the only payment method to buy german train tickets online without a surcharge. In a recent ruling, a court deemed this to be an inacceptable intrusion to privacy, forcing the train operator to offer another free means of payment.
Pending EU legislation (PSD II) will force banks to offer some sort of limited API access that'll allow users to sensibly share access with services like Mint or SOFORT.
I find it really hard to believe that SOFORT does this without support or even consent of the banks. Scraping bank websites seems like something that could get you ruined or even jailed (I don't know, for dealing with bank customer's data in an improper way or something - at least I'd assume the banks could sue you for violation of their TOS). I only started using Sofortüberweisung at all when some trustworthy looking sites adopted it, and when it appeared to me as if it was a joint venture between SOFORT and the banks.
I guess if you want to build a successful business today, you can't ask nicely and wait for permission to do things (see also Uber et al).
Personally, I avoid that service but it has the blessing of government agencies from operating that way.
Some banks (e.g. DKB) now started to cooperate with Sofort instead and the German banks will start a similar service themselves this year.
I have tried one or two services similar to mint in an effort to get more control on budgeting. The typical bank provided online banking interface is like something from 10-15 years years ago with a painful interface and no real facilities to either analyse your income/spending on the site or to easily export data.
The promise of these other services is to scrape at your data, gather it into an easily viewable/filterable format and allow you to group it semantically (i.e. this payment every month is for rent, food, socializing) The idea being that it can automatically analyze the accounts give you more control over your budget.
My experience was that for personal accounts the analysis was no better than I was doing myself and they cannot account correctly for cash withdrawls which kind of defeats the purpose of the exercise. Finally, my bank recently updated their online banking site so that it's just as good as that offered by these external services.
However, as others have stated, they view the convenience gained to be worthwhile enough to sacrifice the security of their accounts. Plus, I'm sure they asses the probability of Mint (and their employees, contractors, etc) using this information in any way other than "read-only" (at least intentionally) to be very close to zero.
http://money.stackexchange.com/questions/15392/are-there-any...
Unfortunately, banks are technically backward and don't realise they're dumb vaults yet, much in the same way phone carriers are dumb pipes.
I use Mint though and I find it really helpful for monitoring my finances.
I also get an incredibly powerful mobile app, free checking, and ATM fee reimbursement.
The interesting part is that I was able to hook up those external bank accounts without providing username and passwords to USAA.
Note, their banking services are available to anybody, even non-military.
Really, I would think that this data would in some sense be the holy grail for targeted marketing, short of the databases that Amazon has on its customers.
That being said I use them too...
Also, post some info about your experience writing other secure apps. Social proof is about all we have to go on here, so play it up.
Where I'm from the banks run on ancient software (we're talking COBOL in most cases) and when an ATM breaks, you see it briefly boot through Windows 98.
Web scrapers could be feasible for an e-commerce service (that's mostly what Yodlee is, the service that powers Mint) the hard part is the regulatory issues surrounding banking web scrapers. It's a very very grey area.
In my opinion with this stuff, if there's demand, it's better to ask for forgiveness than permission and third party banking apps could/can provide endless functionality and insight.
This is also why I don't seriously use Evernote. Yeah I'd love to have all my documents and bills there, but at one point you have to stop and think about the implications of a private company (in fact 2, since they're probably using AWS) knowing everything about you.
I'm using "Cha-Ching 2 beta" which was abandoned some 6 years ago when Intuit bought out the company working on it but the beta still works (I owned a copy of Cha-Ching 1 from some software bundle I picked up). The downside is (1) manual entry of every transaction, and (2) no analytics at all. The plus side is I wrote my own scripts to extract data from its Sqlite database so I can do analytics in a spreadsheet.
I definitely don't trust any one company. I don't want my bank or my credit card company to have 100% of my financial data.
For customers to trust your company you will have to have a lot of financial backing and support of big names in the industry. And when Mint first launched people were a little less concerned about giving up data. Now a days people are much more aware of the implications so you would be fighting an uphill battle.
I could potentially trust Mint but anything smaller and not based in the US definitely not.
If we have to resort to scraping for banking data, I'd personally prefer to do the scraping by myself and for myself rather than trusting any third parties with my credentials.
Giving full access would be really crazy at least to me.
Good luck
https://mint.lc.intuit.com/questions/1057341-known-issue-cap...
And I did give them all of my passwords for everything.
