Screen Scraping

Screen scraping, in banking, is a technique by which a third party obtains a customer's account information by signing in to the bank's website or mobile service as if it were the customer. The customer gives their login details to the third party, whose software enters them, moves through the pages and copies out balances, transactions and account numbers. The bank's systems see what looks like a normal customer session.

The method was the original basis of account aggregation, personal finance apps and bank-linked payment services, long before banks offered any official way to share data. It is a specific use of data scraping. Regulators and banks have worked for years to replace it with open banking interfaces, but it remains in use where those interfaces are missing or incomplete.

A consumer who wants to connect a bank account to an app selects their bank from a list and types their online banking username and password into a form presented by the app or by a data aggregator working behind it. The aggregator stores the credentials and uses automated software to log in. The software has been written to understand the layout of that particular bank's pages. It locates the relevant fields, extracts the data and converts it into a standard format for the app.

The process may be repeated daily to refresh the data, which is why credentials are kept. If the bank asks for an additional code, the software either passes the challenge back to the customer or fails. Some aggregators do not read the visible website and instead imitate the bank's mobile app, calling the private interfaces that the app uses.

• Credential sharing. Customers hand over login details that give full access to their accounts, a habit banks otherwise warn against, and the aggregator's store of credentials is an attractive target for attackers.
• No limit on scope. The third party can see everything the customer can see, including accounts and products that have nothing to do with the service, and in principle could initiate transactions.
• Unclear liability. Bank terms often prohibit sharing credentials, so a customer who suffers a loss may find that responsibility between bank, aggregator and customer is disputed.
• Fragility. A redesign of the bank's pages can break the connection without notice, and data may be read incorrectly.
• Security controls. Automated logins are hard to tell apart from attacks such as credential stuffing, and they place load on bank systems. They also conflict with multi-factor authentication.
• No easy revocation. The customer can end access only by changing their password.

The replacement is a dedicated interface provided by the bank. Under an open banking API, the customer is redirected to their bank, authenticates there and approves a specific request. The bank then issues the third party an access token, typically using OAuth, that is limited to named accounts, data types and a period of time. The third party never sees the password, the bank knows which firm is connecting, and the customer can withdraw permission through consent management tools.

Aggregators generally prefer these connections where they work well, since they are more reliable. Screen scraping persists as a fallback for small institutions without an interface, for data that the official interface does not cover, such as savings, loans or investments, and where the interface is slow or often unavailable.

The second Payment Services Directive brought account information and payment initiation services into regulation and gave licensed providers a legal right of access to payment accounts. Its technical standards, which applied from September 2019, require banks to offer either a dedicated interface or to let third parties use the customer interface while identifying themselves with a certificate. Access through the customer's credentials with no identification, the traditional form of screen scraping, is no longer permitted for payment accounts. Strong customer authentication rules reinforced this.

An account information service provider must therefore be authorized or registered. The rules cover payment accounts only, so scraping of other products falls outside them, which is one argument for wider open finance legislation.

The United States had no equivalent mandate for many years, and data sharing developed through screen scraping and then through bilateral agreements between large banks and aggregators, together with industry technical standards. The Consumer Financial Protection Bureau finalized a personal financial data rights rule under section 1033 of the Dodd-Frank Act in October 2024, intended to require data providers to offer developer interfaces and to move the market away from credential-based access. The rule was challenged in court and the Bureau reopened it for reconsideration in 2025, so its requirements and timetable remained uncertain at the time of writing.

Australia's Consumer Data Right created accredited data sharing by interface, and its government has consulted on restricting screen scraping.

Screen scraping has been used for more than reading data. Some early online bank payment methods in Europe logged in with the shopper's credentials and submitted a credit transfer on their behalf, the forerunner of regulated payment initiation. In the United States, instant account verification for ACH payments relied heavily on credential-based access to confirm account ownership and balances before a debit, and has been moving to token-based connections.