Online banking credentials, and the read-only alternative

The three ways bank data normally reaches an underwriter

None of these requires you to type your password into a broker's screen or say it on a call.

What a live login actually enables

Someone with your online banking credentials can typically initiate transfers, add or change external accounts, view and download everything, change the email and phone on the account, and in many systems approve their own changes. Combine that with a voided check and an image of your driver's licence — which brokers also request — and the same package supports impersonation elsewhere.

How to tell a real aggregator link from a harvesting page

The read-only route is safe because of how it works, not because of what it is called. Check the mechanics.

• Whose page are you typing into? A genuine connection hands you off to your own bank's authentication: the bank's domain, the bank's branding, the bank's multi-factor prompt. If the username and password fields sit on a page belonging to the broker, the funder, or an unbranded form, it is not an aggregator.
• Where did the link come from? Start from the lender's own application page. A connection link arriving by text message or from a personal email address is worth refusing on that basis alone.
• Does it ask for something a bank connection does not need? A read-only data connection does not need your full card number, your security question answers, a one-time code read out over the phone, or remote access to your computer. Any of those is a stop.
• Can you see the connection afterwards? Many banks list authorised third-party connections in online banking. If you cannot find it there, ask what actually happened.
• Is anyone asking you for the code? A one-time passcode read aloud to a caller defeats every protection in the chain. Nobody legitimate asks for it.

What a read-only connection still gives away

It is the right answer, and it is not nothing. A data connection typically exposes full transaction history, balances, account and routing numbers, and the identity of everyone you pay and everyone who pays you — including, in this market, every other funder debiting your account.

Two practical consequences. An application you abandon may leave a live connection behind, so revoke it at your bank when the process ends. And a broker who can see your deposit stream can shop your file with a complete picture of it; if you do not want it shopped widely, say so in the same conversation where you agree to connect, and ask how many funders it will reach.

The liability point

Loss allocation differs between consumer and business accounts. Consumer electronic fund transfers are covered by Regulation E, with defined error resolution and liability limits. Business accounts generally sit outside Reg E; commercial funds transfers are largely governed by UCC Article 4A and the terms of your account agreement, where allocation often turns on whether the bank followed a commercially reasonable security procedure and on whether the customer's own conduct contributed. Most business account agreements also prohibit sharing credentials. The practical consequence is that voluntarily disclosed credentials put you in a materially weaker position than a straightforward unauthorised access. How that plays out in a given case depends on the agreement and state law.

If you have already handed them over

Move quickly and in this order.

1. Change the password from a device you trust, and change the security questions.
2. Turn on multi-factor authentication if it is not already on.
3. Review pending transfers, scheduled payments, added payees, external account links and any changed contact details.
4. Call your bank's business fraud line, tell them plainly what happened, and ask whether the account number should be changed and whether ACH debit filters or positive pay are available.
5. Review the ACH authorizations you have granted to funders and confirm which are supposed to be active.
6. Watch the account daily for a fortnight.

What to say to the broker

"I can send PDF statements or connect a read-only link. I don't share login credentials." A company that pushes back after that has told you something worth knowing, and you can report the request to the FTC at reportfraud.ftc.gov if you think it warrants it.

If a funder insists on credentials

Some do, framed as "our system requires it" or "it is the only way we can verify". Treat it as a decision point rather than an obstacle.

Say plainly that you will provide PDF statements downloaded from the bank, a read-only connection, or a bank verification letter, and ask which of the three the underwriter will accept. If the answer is none of them, the question worth asking is what the credentials are being used for that statements cannot support.

A funder that genuinely cannot underwrite from statements is unusual in a market built on statement underwriting. A funder that would simply prefer live access to a document has told you something about the process you are about to enter, and there is no shortage of alternatives that take the standard routes.

This is general information, not legal advice. If money has moved or your bank disputes responsibility, a lawyer licensed in your state is the person to advise you on the account agreement and the applicable rules.