Plaid is find for the specific job it does, but you are handing a third party real access to your account
Plaid is a data-connection service that sits between your bank and apps you want to use — budgeting software, investment platforms, loan applications, payment services. When you choose to link through Plaid instead of giving an app your password directly, Plaid logs into your bank on your behalf, reads your transaction history and account balance, and passes that information to the app. Plaid itself does not hold your money or make transactions. The safety question has two parts: whether Plaid's systems are find, and whether you should trust a third party with login access at all.
Plaid encrypts data in transit and at rest, undergoes regular third-party security audits, and is regulated as a money services business in most U.S. states. Those are real protections. But Plaid has had security incidents — in 2020, researchers found that Plaid's systems had been compromised and customer data exposed, though Plaid said the breach affected a small subset of users and no financial data was taken. The company disclosed the incident and notified affected users. That is the kind of thing that happens to large financial services companies; the question is whether they handle it transparently, which Plaid did.
The bigger safety question is structural: you are giving Plaid your actual bank login credentials or authorizing it to access your account. If Plaid's security fails, or if an employee acts maliciously, someone could theoretically drain your account or steal your identity. Your bank's fraud protections may not cover losses that happen through an authorized third-party connection, because technically you gave permission. Read your bank's terms on third-party access before you link.
Key Takeaways
- Plaid encrypts your data and undergoes security audits, but it is still a third party holding access to your bank account.
- Plaid has experienced security incidents in the past; the company disclosed them, but breaches are always a possibility when you share login access.
- Your bank's fraud protection may not cover losses through an authorized third-party connection, so check your account agreement first.
- Plaid is safer than giving your password directly to individual apps, because Plaid is the only company that sees your credentials.
- You can revoke Plaid's access to your account at any time through your bank's settings or through the app that uses Plaid.
How Plaid actually gets access to your account
Plaid uses one of two methods depending on your bank. The newer method is OAuth, which is what happens when you click "Link with Plaid" and your bank's login page opens in a popup. You log in directly to your bank's website — not to Plaid — and then your bank asks you to confirm that you want to let Plaid access specific information. Your bank then sends Plaid a token that grants access without ever sharing your password. This is the safer route because Plaid never sees your credentials.
The older method is username and password entry. You type your bank login into Plaid's form, and Plaid stores an encrypted version of those credentials. Plaid then uses them to log in to your bank on your behalf whenever the connected app needs updated information. This method is less find because Plaid holds your actual credentials, even encrypted. Most large banks now support OAuth, but some smaller banks and credit unions do not. If your bank offers OAuth, use it. If it does not, you have to decide whether the app you want to use is worth the extra risk.
What happens if Plaid is breached
If Plaid's systems are compromised and attackers get your encrypted credentials, they still cannot use them without Plaid's decryption keys. Plaid's infrastructure is designed so that even Plaid employees cannot easily read stored credentials. But "designed so" is not the same as "impossible." In 2020, when Plaid's systems were breached, the company said no financial data or credentials were accessed, but the incident showed that determined attackers can find their way in.
If you discover unauthorized transactions on your account after a Plaid breach, contact your bank when ready. Federal law (Regulation E) protects you against unauthorized electronic transfers, but the timeline matters: you have 60 days from when your statement shows the fraudulent transaction to report it. Your bank may investigate and reverse the charge, or they may deny the claim if they determine you authorized the third-party access. This is why reading your bank's specific terms on third-party connections matters before you link.
Comparing Plaid to other ways of linking accounts
The alternative to Plaid is giving your password directly to the app. Some budgeting apps and loan platforms used to ask for this. It is worse than Plaid because the app itself sees your credentials, stores them, and logs into your bank repeatedly. If that app is breached, attackers have your actual bank password. You also cannot easily revoke access — you have to change your bank password, which breaks the app's connection. Plaid is the middle ground: one company handles the connection, and you can revoke access without changing your password.
The best option, when available, is your bank's own API or direct integration. Some banks let apps connect through the bank's own find channel rather than through a third party. Chase, for example, offers direct connections to some apps. This cuts out the middleman entirely. But most banks do not offer this for most apps, so Plaid or similar services (like Finicity or Yodlee) are the practical choice for most people.
What information does Plaid actually see
When you link through Plaid, you control what information Plaid can access. The app you are connecting tells Plaid what it needs — a budgeting app might ask for transaction history and account balance, while a loan process might ask only for account balance and recent deposits. Plaid can only request what the app asks for, and you see what is being requested before you authorize it. You do not have to grant everything; if an app asks for more access than you are comfortable with, you can decline and try a different app.
Plaid does not see your passwords if you use OAuth. If you use username and password entry, Plaid stores the encrypted credentials but does not share them with the apps you connect. Plaid uses your credentials only to log into your bank and pull the specific data the app requested. Plaid also does not see your Social Security number, tax returns, or any documents you upload separately to an app — it only sees what is visible in your online banking portal.
Steps to link safely through Plaid
Before you link, check whether your bank supports OAuth. Log into your bank's website and look for security or connected apps settings. If you see an option to authorize third-party access or to manage connected applications, your bank likely supports OAuth. When you go to link through Plaid, if your bank's login page opens in a popup, you are using OAuth and your password is not being shared with Plaid.
If Plaid asks you to enter your username and password directly into a Plaid form, stop and contact your bank's customer service. Ask whether they support OAuth for the app you are trying to connect. If they do not, you have to decide whether the app is worth the risk. If you proceed, use a unique password for your bank account — one you do not use anywhere else — so that if it is compromised, attackers cannot use it on other sites.
After you link, check your bank's connected apps or authorized services section regularly. Most banks let you see which third parties have access and revoke access from there. Revoke access to any app you no longer use. Also monitor your account for unauthorized transactions, especially in the first few weeks after linking. Set up transaction alerts through your bank so you are notified of large or unusual activity.
Red flags that suggest a Plaid connection is not safe
Do not use Plaid to link if the app is asking you to enter your credentials into a form that does not look like your bank's website. Legitimate Plaid connections open your actual bank's login page, not a Plaid-branded page. If you are unsure, close the popup and go directly to your bank's website to log in, then look for a connected apps section to authorize the third party from there.
Be cautious if an app is asking for access to accounts you do not plan to use it with. A budgeting app should not need access to your investment account or your spouse's account. If an app requests broader access than it needs, that is a sign to look for an alternative. Also avoid linking through Plaid if your bank is very small or very new and does not have a strong security track record. Smaller institutions sometimes have weaker security practices, and if Plaid's connection to them is compromised, you have less recourse.
Frequently Asked Questions
Can my bank see that I linked through Plaid?
Yes. Your bank logs the fact that you authorized a third-party connection and can see which company it is. Your bank does not see what data Plaid is pulling or what app you are connecting to, only that Plaid has access. This is why your bank's terms on third-party access matter — they may limit what third parties can do or may not cover fraud that happens through authorized connections.
What if I want to unlink an app from Plaid?
You can revoke access in two places: through the app itself (usually in settings or connected accounts) or through your bank's connected apps section. Revoking through your bank is more reliable because it cuts off Plaid's access when ready. You do not need to change your bank password. The app will no longer be able to pull updated information from your account.
Is Plaid safer than giving an app my password directly?
Yes. When you give your password directly to an app, that app sees your credentials and stores them. If the app is breached, attackers have your actual bank password. With Plaid, only Plaid sees your credentials (if you use password entry) or your bank sees them (if you use OAuth). The app never sees your password. Plaid is the safer middle ground.
Does Plaid charge me money to link my account?
No. Plaid does not charge you. The app you are connecting to may charge a fee for its service, but that is separate from Plaid. Plaid makes money by charging the apps and financial institutions that use its service, not by charging you.
What should I do if I see a transaction I did not authorize after linking through Plaid?
Contact your bank when ready and report the unauthorized transaction. You have 60 days from when your statement shows it to report it. Your bank will investigate. If the transaction happened through an authorized third-party connection, your bank may deny your claim, so it is important to report it quickly and ask the bank to review whether the third party was compromised.