How I Stopped Handing My Bank Password to Every App That Asked

Every bank I have ever used has told me, in bold letters and in text alerts, to never share my password with anyone. Occasionally, that exact rule gets tested by a phone call from someone who claims to be my bank, asking me to “verify” my password so they can definitely not steal it.

Then I go to link two of my own accounts together in some perfectly legitimate budgeting or net-worth app, and a little popup window shows up asking for the name of my bank, my username, and my password.

Same information. Opposite instruction. Nobody else in the room seems bothered by this except me.

I tried to make peace with it once, because I wanted to try out a money-tracking service that promised to show my whole financial life in one dashboard. I typed in the credentials. It worked, briefly, in the way a new gadget works great for exactly long enough that you tell your friends about it. Then, a month or two later, the connection quietly died. When I went to reconnect it, the app asked me for the two-factor code my bank had just texted me—the exact thing my bank tells me, in the same bold letters, never to hand to anyone. I hesitated, then typed it in anyway. The connection came back to life for another month or two, then died the same way again. That second time, I decided it wasn’t worth doing twice. The whole experiment cost me more setup time than it ever gave back in insight.

That popup, in case you’ve never looked closely at it, is very often powered by a company called Plaid. Plaid isn’t your bank, isn’t the app you’re using, and isn’t a company most people ever chose to do business with directly. It’s the plumbing in between. Depending on your bank, you may be handing your actual password to that plumbing.

Plaid works two different ways, and which one you get depends entirely on your bank, not on you.

For most large banks in 2026—Chase, Bank of America, Wells Fargo, Capital One, and most other major institutions—Plaid uses OAuth. In plain terms: the popup redirects you to your bank’s own real login page, you log in there exactly like you always do, and your bank hands back a token instead of your password. Plaid never sees your credentials at all in this flow.

For a lot of smaller banks, regional banks, and credit unions, OAuth isn’t available yet, so the connection falls back to a credential-based flow—meaning you type your real username and password into a screen that isn’t your bank’s website. Plaid says that password is encrypted in transit and isn’t stored after the connection is established. That may well be true. It’s also a claim you’re taking on faith from a company you never signed up with, about the one piece of information every security team on Earth tells you to protect like a house key.

Worth sitting with for a second: “encrypted” and “gone” are different claims. A normal website login uses one-way hashing—it checks your password without ever needing to see it again, even internally. A service built to periodically reconnect to your bank on your behalf needs something else: encryption it can reverse, which means someone, somewhere, holds the key to read it back. That’s not an accusation of bad faith—it’s just how the plumbing has to work if the connection is going to survive longer than one session. It does mean the password sitting in that pipeline is only as safe as whoever holds that key, whether the risk is a rogue employee or a breach nobody saw coming.

The practical lesson: before you panic, glance at which bank you’re connecting. If it’s a major one, you were probably redirected to its actual site the whole time and just didn’t notice. If it’s a smaller credit union, you may genuinely have just typed your password into a third party’s form.

“What if Plaid gets hacked?” Good question, slightly wrong verb

Plaid hasn’t reported a headline-grabbing breach of the sort where a hacker walks off with a database of passwords. What did happen, and what’s worth knowing, is a 2022 class-action settlement: Plaid agreed to pay $58 million over allegations that it collected consumers’ banking login credentials and later processed and sold the resulting transaction data to third parties without adequate notice or consent. The settlement covered an estimated 98 million people and required Plaid to change its disclosure practices and build a portal where users can see and manage every app connected to their accounts through Plaid.

That’s not a hack. It’s arguably a more mundane problem: a company quietly doing more with your financial data than most people realized they’d agreed to. For a “never share this with anyone” piece of information, that’s a fair thing to stay a little paranoid about.

The useful part of that story is that the portal still exists. Log in at Plaid’s consumer site (my.plaid.com) and you can see every app that has ever connected to your accounts through Plaid, and cut any of them off. If you’ve ever linked an account to a budgeting app you stopped using two years ago, it is very likely still sitting there with a connection it no longer needs.

Here’s the trick that’s saved me from handing out a password more times than I can count. When that linking popup appears, look for a small, easy-to-miss option—often phrased something like “enter your account and routing number manually,” “link with account numbers,” or “connect manually”—usually tucked below the main search box or bank list, sometimes only after you back out of the credential screen.

Choosing that option instead gets you:

A plain form asking for your bank’s routing number and your account number—the same numbers printed on a paper check, or visible in your bank’s own app under account details.
A short wait, typically a day or two, while the two accounts confirm they belong to the same person. Most services do this with two small “micro-deposits,” a few cents each, sent to your account.
A screen where you type in the exact amounts of those deposits to prove you can see the account, which finishes the link.

No password. No username. No third party sitting in the middle of your login. Just the numbers your bank already prints on a paper check, which were never treated as a secret in the first place.

The honest caveat: this option isn’t always offered. Companies that use Plaid can configure it to nudge you toward manual entry, allow it as a fallback, or block it outright for banks that support credential-based login—purely as a setting they chose, not a limitation of your bank or your account. If you don’t see a manual option, that’s a business decision someone made on the other end, not proof that one doesn’t exist elsewhere.

The other honest caveat: manual entry only sets up a pipe for moving money in and out via ACH transfer. It does not give the app a live view of your balance the way a full Plaid connection does. If what you actually want is a dashboard that shows your net worth across every account in real time, the manual route won’t get you there—more on that trade-off below.

Why companies keep shoving Plaid at you anyway

If the manual option exists, why do so many apps bury it, or skip mentioning it at all? Because Plaid is genuinely good for their business, whether or not it’s the best trade-off for you personally.

Speed. A Plaid connection confirms an account in seconds. Manual entry with micro-deposits takes a day or two. Every extra day between signup and “it works” is a chance for a new user to give up and never come back.
Coverage without the engineering bill. Instead of building and maintaining a direct connection to every bank and credit union in the country, a company integrates once with Plaid and gets access to thousands of institutions.
Conversion rates. Fewer steps between “download the app” and “see your money in the app” means more people actually finish setting up their account instead of abandoning it halfway through.
Richer data. A full Plaid connection can hand a budgeting or investing app months of transaction history, not just a routing number. For apps whose entire pitch is “see your spending in one place,” that data is the product.

None of that is sinister, exactly. It’s just optimized for the company’s signup funnel, not for your personal comfort with handing out a password. Those two goals happen to overlap less often than either side would like to admit.

When the full connection is actually worth it

I don’t think Plaid should die out of spite. There’s a real use case here: if you want an app that shows your entire net worth in one screen, pulling live balances from every account you own, that app genuinely needs the kind of ongoing access a manual routing-number link doesn’t provide. That’s a real product, and for some people, worth the trade.

I’ve personally decided it isn’t worth it for me. My accounts that matter for day-to-day decisions—my Wealthfront Cash Account and my SoFi checking—each take about four seconds to check with biometric login. Multiply that by however many times a week I actually care about a second balance, and it’s nowhere close to the setup and re-authentication tax of keeping a third-party connection alive, watching it quietly die every couple of months, and occasionally getting my password stuck in someone else’s system for reasons I can’t fully audit.

If you’re chasing a bigger number, the way I once left a house down payment sitting in the wrong account for months, the fix for that isn’t a prettier dashboard. It’s opening the apps you already have and actually looking.

Before you click “Continue”

Notice which bank you’re connecting. Large national bank: you were probably redirected to its real site, and Plaid likely never saw your password. Small bank or credit union: you may have just typed it into a third party’s form.
Look for a manual account-and-routing-number option before you accept the credential prompt. It won’t always be there, but it’s there more often than most apps want you to notice.
Ask yourself honestly whether you need a live balance feed or just the ability to move money between two accounts. Most people only need the second one.
If you do link through Plaid, go check my.plaid.com occasionally and disconnect anything you no longer use. Old, forgotten connections don’t help you; they just sit there as one more thing that could go wrong on someone else’s system.

Banks have spent years training everyone to treat a password like a house key. It’s fair to ask the same question of every company that hands you a form and asks for it anyway: do you actually need this, or would the routing number on the bottom of a check do just fine?

Sources and date checked

Checked July 18, 2026. Bank coverage, settlement status, and product flows can change—verify before relying on any of this.

This article describes my own experience and opinion. It is educational, not individualized security or financial advice, and is not sponsored by or affiliated with Plaid, any bank, or any app mentioned here.

What’s actually happening behind that popup

“What if Plaid gets hacked?” Good question, slightly wrong verb

The workaround: cancel the popup and type the numbers yourself

Why companies keep shoving Plaid at you anyway

When the full connection is actually worth it

Before you click “Continue”

Sources and date checked