Plaid is a legitimate financial data company, but connecting it to your bank account carries real tradeoffs you should understand before you decide.
Plaid is owned by Visa and operates in the United States, Europe, and Canada. It does not hold your money or make transactions on your behalf — it only reads and transmits data between your bank and the apps you use. Thousands of financial apps, budgeting tools, investment platforms, and loan services use Plaid to pull your account information without asking you to hand over your actual bank password.
That said, "legitimate" does not mean "risk-free." Plaid has faced lawsuits over how it handles data, and connecting any third party to your bank account means trusting that company's security practices and privacy policies. The decision to use Plaid depends on what you are trying to do, how much you trust the app requesting access, and whether the convenience is worth the exposure.
Key Takeaways
- Plaid is a real company owned by Visa that acts as a middleman between your bank and other apps, but it is not regulated as a bank and does not have the same legal protections.
- Plaid has faced multiple lawsuits and regulatory inquiries over data practices, including a $58 million settlement with the Consumer Financial Protection Bureau in 2022.
- When you connect Plaid, you are giving the app permission to see your transaction history and account balances, but Plaid itself cannot move money or change account settings.
- Many banks and financial apps now offer direct connections that bypass Plaid entirely, which may be safer if your bank supports them.
- You can revoke Plaid access at any time through your bank's settings or the app you connected it to, though you may lose features that depend on real-time account data.
What Plaid actually does and does not do
Plaid reads your account information — transactions, balances, account type — and sends that data to the app you are using. It does not store your actual bank password. Instead, you log into your bank through Plaid's interface, and Plaid receives a temporary token that lets it pull data without ever seeing your password.
Plaid cannot move money, change your password, set up transfers, or modify account settings. It is read-only. The app you connected to Plaid is the one that might ask permission to move money or make changes — that is a separate permission you grant to that app, not to Plaid itself.
That distinction matters. If a budgeting app like Mint uses Plaid to see your balances, Plaid is only showing the app what you already have. If the same app later asks permission to set up automatic transfers, that permission goes to the app, not to Plaid, and you can revoke it independently.
The security and privacy risks Plaid has faced
In 2022, Plaid settled with the Consumer Financial Protection Bureau for $58 million over claims that it misrepresented its data practices and failed to secure customer information properly. The CFPB found that Plaid collected more data than necessary and did not clearly tell users what it was doing with that data.
Plaid has also faced class-action lawsuits from users who argued the company was scraping bank data in ways that violated the Computer Fraud and Abuse Act and state laws. Some of these cases have settled; others are ongoing. The lawsuits do not prove Plaid broke the law, but they show that courts and regulators have taken the privacy concerns seriously enough to investigate.
In 2021, Plaid disclosed a data breach affecting a small number of users, though the company said no financial data was exposed. Plaid also faced criticism for selling anonymized financial data to third parties, a practice it has since restricted.
How to decide whether to use Plaid
Start by asking whether the app you want to use actually needs Plaid. Many banks and financial services now support direct connections that bypass Plaid entirely. If your bank is Chase, Bank of America, Wells Fargo, or another major institution, check whether the app you want to use can connect directly to your bank instead. Direct connections are often more secure because they use your bank's official API rather than a third-party intermediary.
If Plaid is your only option, consider what data the app needs and whether you trust that app with it. A budgeting tool that only reads your balances and transactions is lower-risk than a loan app that reads your full financial history to make lending decisions. The more sensitive the data, the more you should scrutinize both Plaid and the app requesting access.
You should also check the app's privacy policy separately from Plaid's. Even if Plaid handles your data securely, the app you connected to Plaid might sell or misuse that data. Plaid's security is only one part of the equation.
How to connect safely if you decide to use Plaid
When you connect through Plaid, you will see a login screen that looks like your bank's website. This is Plaid's interface, not your actual bank. Log in with your real bank credentials — Plaid will receive a token but will not store your password.
After login, Plaid will ask which accounts you want to share and what permissions you are granting. Be specific. If the app only needs to see checking account balances, do not give it access to your savings account or credit cards. The more accounts you connect, the more data you are exposing.
Review the permissions carefully. Some apps ask for read-only access (they can see your data but not move money). Others ask for write access (they can move money or make changes). Only grant write access if the app genuinely needs it to do what you want.
How to revoke Plaid access and what happens next
You can disconnect Plaid in two places. First, log into the app you connected to Plaid and look for account settings or connected accounts. Most apps have a button to disconnect or revoke access. Second, log into your bank's website and check the connected apps or third-party access section. Most banks let you see which apps have access and revoke them from your bank's side.
When you revoke access, Plaid stops pulling new data immediately. However, the app may still have the historical data it already downloaded — revoking access does not delete what Plaid already sent to the app. If you want the app to delete your data entirely, you will need to contact the app's support team and request data deletion.
Revoking Plaid access will break features that depend on real-time account data. A budgeting app will stop updating your balances. A loan app will not be able to verify your income or assets. If you disconnect and later want to reconnect, you will need to go through the login process again.
Alternatives to Plaid
The safest alternative is a direct bank connection. Major banks including Chase, Bank of America, Wells Fargo, Citi, and others now support direct API connections. If the app you want to use offers a direct connection option, choose it. Direct connections use your bank's official security standards and do not involve a third party.
Some apps let you upload bank statements or transaction exports manually instead of connecting live. This is slower and requires more work from you, but it avoids giving any app ongoing access to your account. If you only need to connect once or occasionally, manual upload may be worth the extra effort.
For loan applications, some lenders will accept tax returns, pay stubs, or bank statements as proof of income instead of asking for Plaid access. Ask the lender what documentation they accept before you connect anything.
Frequently Asked Questions
Can Plaid steal my money or make unauthorized transactions?
No. Plaid itself cannot move money or make transactions. It only reads data. However, the app you connected to Plaid might have permission to move money if you granted it write access. Always check what permissions you are giving before you connect, and only grant write access if you trust the app and it genuinely needs it.
Does Plaid sell my data to other companies?
Plaid has sold anonymized financial data in the past, though it restricted this practice after regulatory pressure. Plaid's current privacy policy says it does not sell personal data, but you should read the policy yourself. More importantly, check the app's privacy policy — the app you connected to Plaid might sell or share your data even if Plaid does not.
Is it safer to give my bank password directly to an app instead of using Plaid?
No. Never give your actual bank password to any app, including Plaid. Plaid exists partly to avoid this — you log into your bank through Plaid's interface, and Plaid gets a temporary token instead of your password. If an app asks for your password directly, that is a red flag.
What should I do if I see Plaid on my bank's connected apps list but I do not remember connecting it?
Check which app connected to Plaid by looking at the app's account settings or the bank's connected apps page — it should show which service requested access. If you do not recognize the app or did not authorize it, revoke access immediately. If you cannot figure out which app it is, contact your bank's support team for help.
Will my bank protect me if something goes wrong with Plaid?
Your bank's fraud protection covers unauthorized transactions, but it may not cover losses from a third-party app or Plaid itself. Read your bank's terms about third-party access and what they will and will not cover. This is another reason to be selective about which apps you connect and what permissions you grant.