Is it safe to connect your bank to a budgeting app?

Connecting your bank to a budgeting app is safe when three things are true: you sign in inside a connection service's window rather than typing your password into the app, the app receives read-only data through that service, and the app cannot move money. Established apps meet all three through a connection service such as Plaid. The risk that remains sits in the app's own account security and in your habits, and both are in your control.

What actually happens when you connect

The connection is a handshake between your bank and a connection service, with the app on the receiving end.

1. You choose your bank in the app.
2. A window from the connection service opens. Depending on the bank, it either sends you to the bank's own sign-in page, which hands you back once you have signed in, or shows the service's own sign-in form for that bank.
3. You pick which accounts to share.
4. Your bank gives the connection service permission to read those accounts, and the service passes balances and transactions to the app on a schedule, typically once a day.

The app never sees your bank password and never stores it. What it holds is permission to read, which your bank can revoke and which the app can drop when you disconnect. The two sign-in routes differ in one way: when the bank hosts the sign-in, the connection service never sees your password either, and when the service shows its own form, the service receives your credentials to establish and keep the connection, under its own security program, while the app still never does. Services like Plaid connect to over 12,000 banks, credit cards, and brokerages this way.

Read-only means read-only

Data flows in one direction. The app can see balances and transactions. It cannot start a transfer, pay a bill, or change your bank login. An app that also offers payments uses a different permission for that, which a budgeting app with read-only access doesn't have.

The consequence is that a breach of the app could expose your financial data, which is worth taking seriously, but could not move your money. Choosing an app that holds no bank credentials keeps the worst case bounded.

What to check before you connect

• Which connection service it uses. A named service such as Plaid means the app itself never handles your credentials. Whether the sign-in happens on your bank's own page or on the service's form is up to the bank, and the bank's own page is the stronger of the two.
• That access is read-only. The app's security page should say so plainly.
• Whether it sells personal information. The privacy policy answers this. An app you pay for has less reason to.
• How you sign in to the app. No password to phish, or a strong one plus a second factor, matters more than most people expect, because the app account is the real target.
• What happens when you leave. You should be able to disconnect every bank and have your account and data deleted.

The risks that remain, and what to do about them

Your app account is the way in. If someone can reset your app login through your email, they can see your financial picture. Secure the email account with a second factor, and prefer apps that sign you in with an emailed link or a trusted identity provider rather than a password you might reuse.

Phishing works on any login. Enter bank credentials only on your bank's own site or inside the connection service's window that the app opened. Never through a link in an email or a text.

Share only what you need. When the connection window lists your accounts, pick the ones the app should see. A business account or a child's savings account can stay out.

Connections expire on purpose. Banks end app connections after a password change, after two-factor authentication is turned on, or simply on a schedule. A connection that needs reconnecting is routine housekeeping, not a sign of a breach.

Common mistakes

• Typing bank credentials anywhere but your bank's own page or the connection window the app opened. A link in an email or a text, or a form inside the app itself, is the wrong place.
• Reusing the bank password for the app. If the app uses a password at all, it should be a different one.
• Treating "connected" as "can transact." Read-only access can't move money, and the app's security page should confirm that.
• Ignoring an expired connection for months, then wondering why the numbers are stale. Reconnect when the app asks.

Common questions

Can the app see my bank password? No. You sign in inside the connection service's window, on the bank's own page or on the service's form, and the app receives permission to read your accounts, never the credentials you typed. That is the whole reason the connection service sits in the middle. When the bank hosts the sign-in, the service doesn't see your password either.

Can it move my money? Not with read-only access. Budgeting apps read balances and transactions; they don't hold the permission to initiate transfers or payments.

Why do transactions take a day or two to appear, or show as pending? A new purchase starts as pending at your bank and typically takes one to three business days to post. Some banks share pending transactions with apps right away, and others report a transaction only once it posts. Either way, the delay is bank-side timing, not lost data.

Why did my connection break? Banks end connections after a password change, after two-factor authentication is turned on, or on a security schedule of their own. Reconnecting takes a minute and resumes syncing on the same accounts.

How do I disconnect? Remove the connection in the app, which drops its permission to read. Many banks also list connected apps in their own settings, where you can revoke access from the bank's side as well.

How Zypper handles this

Zypper connects through Plaid. You sign in inside the Plaid window, on your bank's own page when your bank offers it, and your bank credentials are never seen or stored by Zypper. Zypper receives read-only financial data and cannot move money. Connected accounts sync automatically every day, and you can refresh a connection at any time. There is no Zypper password to phish: you sign in with an emailed link or with Google. Zypper doesn't sell your personal information, your card number is held by a dedicated payment processor rather than on Zypper's servers, each household member has their own private login, and you can have your account and data deleted by contacting support. When a bank expires a connection, Zypper emails you and reconnecting takes a few clicks. See Connecting your bank accounts and Privacy and security at Zypper, or get started with Zypper.