Is Plaid Safe? Security, Privacy, and Your Bank Account

A request to log in to your bank can feel uncomfortable, especially when a company you have never heard of appears between you and an app you already use. You are right to stop and look at the details.

This guide explains what Plaid’s security measures do, where privacy concerns remain, and how to control an existing connection. For the bank-linking screens and individual products, see our Plaid review and step-by-step guide.

Is Plaid safe to use with your bank account?

Plaid has documented safeguards for handling financial information. Its security overview describes encryption and monitoring, and its compliance documentation lists independent assessments. Those are useful reasons to take the company seriously. They are not a promise that a connection can never be misused.

The practical question is whether you trust the particular service requesting access. A budgeting app that you chose, a funding provider you are already working with, and an unsolicited message asking you to reconnect your bank deserve different levels of scrutiny.

Consider a simple example. You open your budgeting app and choose to add a checking account. A request to share transaction history fits that purpose. If an unexpected text asks you to connect that same account to an unfamiliar company, stop and verify the request through a contact method you already trust.

Is Plaid secure? How it protects your information

It helps to know what the security terms mean. Encryption protects information from being read without the right keys. Testing and audits examine controls. Neither tells you whether an app needs the data it is requesting.

Sources: Plaid’s data security overview and audit and certification information.

These safeguards apply to Plaid’s systems and assessed controls. They do not automatically certify every app that uses Plaid. Your bank, the connected app, your email account, and your device also matter. Use a unique bank password and the additional sign-in protections your bank offers.

Is it safe to give Plaid your bank login?

First, check where you are entering it. With a bank-hosted connection called OAuth, you sign in through your bank’s website or app. Plaid says it does not receive or store your bank login credentials through that connection method. You then authorize access and return to the service. See Plaid’s OAuth guide.

Other connections work differently. Plaid’s consumer help center says that when you provide credentials directly to Plaid, it stores them so it can retrieve financial information. It also says your login credentials are not shared with the connected app. That distinction is why a blanket claim that “Plaid never stores passwords” would be misleading. Read Plaid’s explanation of credential access.

If you are uncomfortable with the method offered, ask the company whether it supports another way to verify the account. Do not send your bank password to a representative by email, chat, or text to get around a connection problem.

What information can Plaid access, and what does the app receive?

There is no single data package shared by every Plaid connection. Products serve different purposes. For example, an app may need account details to set up a bank payment, while a budgeting tool needs transactions to categorize spending.

Can the app see all of my bank accounts?

Plaid’s current Account Select documentation says the app’s API access is limited to selected accounts. The flow can allow one account, several accounts, or require all accounts; selection may happen at the bank during OAuth. Review the actual selection before continuing. Plaid also documents exceptions for some older connections created before March 2023. Source: Account Select documentation.

What the app receives is not the whole privacy question. Plaid’s own collection can be broader depending on the product and connection, including information associated with a bank login. Check both the consent screen and Plaid’s End User Privacy Policy.

Does connecting my bank let Plaid take money out?

Sharing financial data is not, by itself, a blanket payment authorization. However, Plaid also offers payment products, and an app can use linked account details as part of a payment service. Read any debit, recurring-payment, or transfer agreement separately. Plaid’s Transfer documentation requires businesses to obtain and retain the appropriate authorization for debits. Do not assume that every Plaid-powered experience only reads data.

Does Plaid sell your data? What about other privacy concerns?

Plaid Portal states that Plaid does not sell or rent your financial information to outside companies. That is different from saying your information is never used or shared.

Its End User Privacy Policy describes uses beyond delivering a single connection, including fraud prevention, improving services, developing insights, and developing new products, including AI systems. It also describes sharing with connected app developers, service providers, and other recipients in specified circumstances. The app’s own data practices are governed by its separate policy. Read the current policy.

Before agreeing, ask yourself whether the data request fits the service. A spending app may need an ongoing transaction feed. A one-time verification request deserves a clear explanation of whether access continues afterward. Also look for how the company handles deletion requests and how to reach a person if the connection is wrong.

What happened with the Plaid privacy lawsuit?

It is reasonable to ask about this before deciding whether to use Plaid. A federal court approved a $58 million class-action settlement on July 20, 2022. The case involved allegations about financial data collection, consent, and how the connection process was presented to users.

The settlement included changes involving data deletion, minimization, disclosures, and consumer controls. This was a privacy dispute; describing the settlement as proof that hackers stole money from linked bank accounts would misstate what it addressed. The court’s final approval order explains the allegations and settlement terms.

For a connection you are considering today, read the current permissions and policies. Older screenshots and forum discussions can raise useful questions, but they may describe a different login flow or an earlier version of the service.

How to disconnect Plaid and request deletion of your data

You can use Plaid Portal to review supported connections. Disconnecting an app stops future sharing through that connection. It does not automatically erase information the app already received. Treat stopping access and requesting deletion as separate tasks.

Disconnect an app in Plaid Portal

1. Open my.plaid.com and sign in.
2. In Overview, choose the app you want to manage.
3. Select Manage connections, then Disconnect app.
4. Review the message, choose the financial institution, and select Disconnect.

These are Plaid’s published Portal instructions. If you cannot find the connection or the needed control, use the help and privacy request options in Plaid’s deletion guide. Some newer experiences cannot be fully managed in Portal.

Do not rely on disconnection to cancel a payment, subscription, or financing agreement. Contact the provider to handle those arrangements. Removing the data connection and changing your obligations are separate actions.

Is Plaid bank verification safe before business funding?

A business funding provider may need to confirm account information or review the financial data requested in its process. Plaid can provide a way to share that information through a bank connection. The particular permissions depend on the provider’s setup, so ask which information it needs and why.

At Excel Capital, we use Plaid prior to funding, rather than at the start of the initial application. If you are working with us and receive a request, it should fit the stage of your funding process. When the timing or company name is unexpected, contact the representative you already know before connecting.

Completing a Plaid connection does not itself tell you that funding is approved or that you have accepted payment terms. Review the funding documents separately. Our guide to how Plaid works shows the bank-linking process and explains the different products you may encounter.

More questions about Plaid safety

Is Plaid legit and trustworthy?

Plaid is a legitimate company with publicly documented products and security controls. A message using its name can still be fraudulent. Start from the app or company website you intended to use, and verify an unexpected request independently. A familiar logo is not enough to establish who sent a link.

Why did I receive a Plaid verification code I did not request?

According to Plaid, an unexpected one-time code can result from someone mistyping a phone number or from an attempted connection you did not authorize. It does not, by itself, prove someone successfully accessed your bank account.

Do not share the code. Check your bank and the named app through their official websites or apps, review unfamiliar activity, and secure your accounts if you suspect an attempt. Plaid says its support team will not ask you to read an OTP over phone, text, or email. Its unexpected-code guide explains how to contact support.

Why would Plaid ask for my SSN, ID, or a selfie?

Plaid’s Identity Verification product can request identity details, an identification document, or a selfie depending on the checks a business enables. Those steps are different from simply sharing bank transaction data. Confirm the business requesting the check and read the notices for that specific flow. See Plaid’s Identity Verification documentation.

Is Plaid safe to link to Chase, Bank of America, or another bank?

Use the connection offered through the app you trust and inspect the actual sign-in destination. If it redirects to your bank, confirm that you are on the bank’s genuine website or app before entering credentials. The available connection method depends on the institution and integration; a bank’s presence in the selection screen does not endorse the requesting app. Our password explanation above covers the two main routes.

What if I am not comfortable connecting through Plaid?

Pause and ask the provider what alternatives it accepts. Explain whether your concern is entering credentials, sharing transaction history, or keeping an ongoing connection. Our guide to bank-verification alternatives explains the options. Availability varies, and the provider must confirm which method supplies the information it needs.

What should I do if I notice an unauthorized transaction?

Contact your bank promptly using the number on your card or its official app or website. Identify the transaction and follow the bank’s dispute and account-security instructions. Also contact the connected app when relevant. Disconnecting Plaid alone does not resolve a disputed debit. Plaid’s unauthorized-activity guidance directs people to the institution or service where the money is missing.