Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It is quite a fascinating scenario.

Apple and Google wallet are integrated into the credit card processing infrastructure. So they don't compete with Visa, their payments still go over Visa's rails.

Plaid's killer feature has always been their private access to APIs that the banks won't give to anyone else. It's essentially like they're using modern web APIs while everyone else is using snail mail (i.e. ACH, bank transfers that settle in batches once per day). I'm not exactly sure how they struck those deals and why there is no reasonable, open integration path or payments protocols between banks in the US like there is in every other developed country. Is it just that the banks like making their $15 per wire transfer? It feels like there's got to be more to it but I'm not sure.

But regardless, where we've ended up is the banks have fought so well to keep everybody out of their collective walled garden, but somehow Plaid has snuck in under the radar and has become so large and entrenched that they are themselves being called the monopolist, rather than the banks that own and control the system but of which there are multiple. I don't know enough about the details of Plaid's business though to weigh in on whether there's any truth to these claims.



I was under the impression that they didn’t have access to any APIs but that they simply took your credentials and scraped the bank webpage.


I was under the impression it was a little of both, depending on the bank.


They do some of both.

When I link a Capital One account, I get an OAuth-style flow and the ability to select which accounts I share directly on the C1 website. The sites I use this on show up as "Linked Apps" in my security settings in C1.

Others use the credentials-based flow.


CapitalOne has (not even just for banking standards) an amazing developer platform. https://developer.capitalone.com


CapOne’s API snd docs, technical customer support and their easy to use VCC generation has kept me with them long after I had expected. Other than Amex they’re probably the only big “bank” I’d recommend (and Fidelity for checking).


Where they aren’t using APIs and instead the scrapers, does that mean they have your banking login credentials? Be curious to hear how they get around MFA.


My experience using plaid with Schwab, on which I have MFA, is that you need to add an MFA code to your password when connecting the two. It works for some duration (a few days?) and then loses sync and you have to re-enter the password+MFA combo.


Do you literally concatenate the two? I've been wondering how to get plaid to work with my accounts that have MFA.


Nah, Plaid's UI handles it natively. If it's required, Plaid will prompt you during the connection process with the same steps and any questions you'd encounter doing it directly on Schwab's website - "do you want a text or call" and then "enter the code" steps.


Yes, they also can monitor and scan your financial transactions. Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their financial information for convenience.


So what? Convenience is nice. And I'm willing to pay for convenience when the other options are far less convenient.


> Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their <VERB> information for <THING>


When i used Mint at first, they'd just ask you to go to the page with the caphcha or whatever and go through it when you'd update your accounts with the auth scraper method. This was like maybe a decade ago? You could do a similar thing with mfa in realtime.


they do for CIBC. it's a problem when you change your password and they keep trying to login with your old credentials - your account gets locked.


So why not force the opening of the walled garden in law then? The EU has PSD2 now which forces all banks to have open APIs. We have multiple Plaid-like competitors providing the platform on top of those APIs. But it wouldn't have happened without regulation.

Generally innovating through regulation is bad and I don't support it. But I think the aversion to it in the US is what creates these monopolies in the first place and in this specific use case, I think it's a faster way to solve the problem.

This is an example of what becomes possible (no card details and low fees):

https://techcrunch.com/2019/01/29/truelayers-payments-api-le...


yep I think this is exactly what is needed


>Plaid's killer feature has always been their private access to APIs that the banks won't give to anyone else.

These private apis will soon no longer be private due to Open Banking/PSD2 (europe) regulations. Plaid's biggest competitive advantage was removing the complexity of various data formats and APIs of banks. This variance will soon be gone in the coming years.


Paypal has my banking details and can use those or credit/debit card to complete my payments. They always prefer to use bank because of no fees with cc/debit as backup. Google could do the same. ACH is really creaky and old.

We need something like UPI (india) or Wechat (china) in the US. Zelle is a poor substitute.


Paypal is basically acting as a short-term lender in this case, which comes with all its own risks and costs. Sure Google could do the same but it's not worth it to them to get into this mess.

Paypal uses ACH under the hood (it's one of only two options, the other being wire transfers which are expensive and often even need to have humans in the loop). So they guarantee the payment to the seller, and then as the buyer your bank account gets charged up to a day later when the ACH batch processing goes through. If you don't have enough money in your bank when that happens, it gets rejected and Paypal takes on that loss unless they can recover it from you via collections system.

To limit their risk, Paypal even uses Plaid in some cases to check your bank account balance before deciding whether to allow your payment to go through! But even that isn't a guarantee, because you could always have made multiple ACH payments that day of which some might go through and some could fail due to lack of funds. It's like trying to prevent a race condition in a multithreaded program by just checking the value again closer to where the race occurs, it might make the issue happen a little bit less often but to actually solve the problem you need certain atomic primitives which the US bank transfer system completely lacks.


> Paypal has my banking details and can use those or credit/debit card to complete my payments. They always prefer to use bank because of no fees with cc/debit as backup. Google could do the same. ACH is really creaky and old.

> We need something like UPI (india) or Wechat (china) in the US. Zelle is a poor substitute.

Why is zelle a poor substitute? I can pay people via phone number.


Zelle still uses ACH under the covers.


Zelle is real-time, while ACH is not.


Zelle is owned by a private company, owned by the US' largest banks [1]. The US Federal Reserve is working on a replacement [2] (FedNow) that presumably will have less power to keep banking entities (small banks, community banks) in the US with less pull off the network (with pricing or other mechanisms).

From the perspective that instant payments should be an inexpensive, accessible utility for the benefit of all citizens, the Fed's FedNow efforts are preferable to Zelle or legacy ACH services.

[1] https://en.wikipedia.org/wiki/Zelle_(payment_service)

[2] https://corpgov.law.harvard.edu/2020/08/31/fednow-the-federa...


I understand how Zelle pull off real-time for intrabank. For interbank, they are either covering it or have they built a payment service under the covers?


The final real reconciliation for Zelle is done over ACH.


Technically, Plaid doesn't have access in a sanctioned way. You pretty much guaranteed violate any electronic banking ToS by sharing credentials with a third party.


Only if Plaid weren't a company that has contracts in place with every single bank they offer to access their services without being sued (despite the fact that the antique tech stacks these banks have don't allow Plaid to use oauth in most cases).




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: