Is It Safe to Give a Budgeting App Your Bank Login?

Short answer: it depends entirely on how the app connects. If you type your online banking username and password into an app — the practice called screen scraping — you may lose your bank's protection against unauthorized transactions. If it connects through a bank-authorised API, your password never changes hands. In Canada, the API route isn't broadly available yet, so the safest option today is to hand over a file, not a login.

This isn't a scare piece. It's what the Financial Consumer Agency of Canada (FCAC) says, in plainer language.

What screen scraping actually does

Screen scraping is the practice of giving a third-party app your bank username and password so it can log in as you. The app then reads your transactions by copying what appears on screen, and stores that data on its own servers.

FCAC is blunt about the mechanics: apps that use screen scraping "require you to provide your online banking username and password … to automatically log into your bank account as if they were you," and they "transfer your data to an external database." The line worth remembering is this one:

Once you share your username and password in this manner, you no longer have control over it.

That's not a vulnerability in any single app. It's the nature of the arrangement.

The part most people miss: your bank's guarantee

Most Canadian banks offer an online banking guarantee — protection against unauthorized transactions on your account. It usually comes with a condition: you kept your credentials private.

Share your password with a third-party app, and the bank may argue you didn't. FCAC says you "may lose the protection your bank offers against unauthorized transactions," and that you "may be responsible" for losses — potentially even when you didn't do anything wrong. The app holds your password; if it's breached, untangling who's accountable is hard.

Where Canada stands today

If you've heard "open banking is coming," you've heard right — but it isn't here.

FCAC states plainly that open banking, also called consumer-driven banking, "is not available in Canada yet." It's live in countries like the UK and Australia, not here. Until it arrives, there is "no secure system in Canada to safely share financial data from your bank account with fintechs."

That matters because the safe alternative people are waiting for — an encrypted API connection where you authorise specific data and never share your password — isn't yet an option for most people. In the meantime, screen scraping remains legal and widely used across Canadian budgeting, debt, and aggregator apps.

The law, in one paragraph

Canada's Consumer-Driven Banking Act (CDBA) was enacted as part of Bill C-76, the Budget Implementation Act, 2024, No. 2, and received Royal Assent in December 2024. Under the intended framework, liability after a breach would rest with the firm that controlled the data at the time — and FCAC would act as the regulator, with an accredited-entity registry you could check before sharing anything.

The catch is timing. The accreditation and technical standards are still being finalised, and the prohibition on screen scraping is not intended to take effect until the framework is operational. So for now, the rules you're protected by aren't the new ones.

What to do right now

You don't have to unplug everything. Do a pass:

1. List which apps hold your banking credentials. Any app that asked for your username and password is a screen-scraping connection.
2. Revoke what you don't use. Old apps with your password are pure downside.
3. Ask providers how they connect. "Do you use screen scraping or a bank API?" is a fair question, and the answers differ.
4. Read your bank's account agreement. Find out whether sharing credentials affects your guarantee.
5. Prefer file-based import. Download a QFX/OFX/CSV export yourself and import it. No credentials change hands, and you keep the file.

If something has already gone wrong, FCAC's advice is to contact your bank immediately and file a complaint with the FCAC.

Where Chord fits

Chord takes the file-based route by design. It never asks for a bank login, never holds your banking password, and imports the QFX file you downloaded yourself. That's a deliberate limit, not a missing feature — see how importing works.

The trade-off is manual: you download a statement each month. In exchange, there is no credential to leak and no screen-scraping connection to audit. That's the whole argument for local-first personal finance.

FAQ

Is Plaid safe? It depends on the connection. For years, aggregators like Plaid relied on screen scraping; many are moving to API-based access. The right question for any provider is whether your password is involved. FCAC's guidance is about the method, not one company.

Is screen scraping illegal in Canada? No. It's legal and widely used today. The CDBA's prohibition doesn't take effect until open banking is operational.

If I use a file import, can the app still see my bank? No. A QFX file is a download you made. It contains transactions and no credentials.

When will open banking launch in Canada? Uncertain. Budget 2025 updated the implementation plan; the accreditation and technical standards were still being finalised.

Sources

Accessed 2026-10-23.

• Financial Consumer Agency of Canada — Open banking
• Yahoo Finance Canada — Screen-scraping your bank account could void your fraud protection