Do I have to give a lender my bank login?

Two very different things get called the same thing

The first is a normal part of underwriting at parts of this market. The second is not something you should do for anyone, ever, regardless of who is asking or how routine they say it is.

What a properly done connection looks like

• You are taken to your bank's own login page, or to an authentication window that clearly belongs to your bank
• Your bank's multi-factor authentication runs as usual
• Nobody at the funder ever sees or asks for your password
• You are told what will be read — which accounts, which date range — and for how long access lasts
• Access can be revoked from your bank's own settings or the connection's dashboard
• The data pulled is transaction and balance information, not payment authority

Reasons to stop the conversation

• You are asked to enter your banking password into a form or app the funder controls
• You are asked to email, text or read out credentials
• You are asked for a one-time passcode from your bank
• You are asked to install screen-sharing software so someone can log in for you
• You are asked to add someone as a user on your online banking, or to grant transfer rights
• You are told the request is standard and pressed to hurry

None of those are how a legitimate read-only connection works. Any of them, on their own, is a reason to end the call and verify who you are actually dealing with. If it has already happened, change the password and the security questions immediately, review recent activity, and tell your bank.

Practical protections if you do connect

• Connect only the business accounts the file needs, not personal ones
• If your bank supports separate users with view-only permissions, create one for the connection
• Ask whether access is a one-time pull or an ongoing feed, and for how long — some agreements permit re-pulling for the life of the deal, which is a different thing from a snapshot at underwriting
• Revoke the connection when the deal is done or declined
• Set a low-balance alert on the account regardless

Can you refuse?

Sometimes. Alternatives that are often accepted: complete PDF statements downloaded from your bank, a bank verification form or verification of deposit sent by the bank directly to the lender, or a direct feed your bank offers.

Some funders require the connection and will not proceed without it. That is their right, and your choice is to accept it or use a product that does not require it. What you should not do is split the difference by giving credentials to someone whose process cannot support a proper connection.

What an ongoing connection keeps seeing

A snapshot taken for underwriting and a live feed that runs for the life of the deal are different grants, and the paperwork often does not separate them clearly. With a live feed the funder sees your balance every morning, sees a new debit from another funder within days of it starting, and sees the deposit that lands when a competitor funds you.

That matters in three specific ways:

• Anti-stacking enforcement. A second position shows up as a debit pattern almost immediately rather than at the next statement cycle.
• Debit timing. Some servicing platforms time the pull against the observed balance. That is welcome when it avoids a return and less welcome when it clears an account you were holding for Friday.
• Renewal calls. A falling balance is a sales trigger as much as a risk trigger, and the call will arrive on the week you can least afford to say yes.

None of that is improper and none of it is usually explained. Ask two questions in writing: does access continue after funding, and can I revoke it during the agreement without that being a default? On some agreements maintaining the connection is a covenant, which makes tidying up your bank's app a breach.

If the credentials are already out

Assume they have been used until you can show otherwise.

1. Change the password and the security questions from a device you trust, and sign out of all other sessions.
2. Check the payee and wire template lists, not only the transaction history. Adding a payee now and using it in three weeks is the usual pattern.
3. Check whether any additional user, alert rule or external transfer link has been added.
4. Tell the bank in writing that the credentials were disclosed and ask what it recommends. New account numbers are inconvenient and are sometimes the right answer.
5. Turn on alerts for any new payee and for external transfers, at the lowest threshold the bank allows.

The statement route, done properly

If you would rather not connect anything, produce statements an underwriter can verify without help: the original PDFs downloaded from the bank, every page, consecutive months, unedited. Screenshots, spreadsheets and re-typed summaries get sent back. Edited statements end the application and usually the relationship — submitting altered bank statements to obtain financing is fraud, and this market shares information about it.

Before any of this

You do not need to authorise anything to find out who a funder is or what they lend on. Find Me Funders' own inquiry form asks for no bank credentials, no Social Security number and no documents. Bank access belongs at the underwriting stage, with a party you have identified, through a mechanism that protects you.