Open Bank is a money transfer service, not a bank itself, and safety depends on how you use it
Open Bank (also called Open) is a fintech platform that moves money between accounts and lets you pay bills or send transfers. It is not a bank—it does not hold your deposits or issue debit cards. Instead, it connects to your existing bank account through your login credentials or through bank-authorized connections, then initiates transfers on your behalf. Whether it is safe depends on three things: whether the company protects your data, whether your actual bank account is secure, and whether you understand what you are authorizing.
The company uses encryption to protect information in transit and stores credentials in encrypted vaults. However, giving any third-party service access to your bank login is riskier than using your bank's own app, because you are trusting two companies instead of one. If Open is compromised, someone could potentially access your account. If your bank account password is weak, Open's security does not matter. And if you authorize a transfer you did not intend, Open will not reverse it—your bank will, but only if you dispute it quickly.
Key Takeaways
- Open Bank is a third-party service that moves money from your account; it does not hold your money or act as your bank.
- The service encrypts your data, but you are trusting a second company with access to your account, which carries more risk than using your bank's own app.
- Your bank account password and two-factor authentication are more important to your safety than Open's security features.
- If you authorize a transfer by mistake or see unauthorized activity, contact your bank immediately—Open cannot reverse transfers, only your bank can.
- Open is not FDIC-insured because it does not hold deposits; only the money in your actual bank account is protected by FDIC insurance.
How Open accesses your account and what that means for security
Open connects to your bank account in one of two ways. The older method is direct login: you give Open your bank username and password, and the service stores them encrypted. The newer method is OAuth or bank-authorized connection: you log into your bank's website or app through Open, your bank confirms the connection, and Open receives a token instead of your password. OAuth is safer because your bank never shares your password with Open, and you can revoke the connection anytime in your bank's settings.
If Open uses direct login, your password is encrypted at rest and in transit, but it is still stored on Open's servers. If those servers are breached, attackers could decrypt it. If Open uses OAuth, your password never leaves your bank, so a breach at Open cannot expose it. Ask Open which method they use before you connect, or check your bank's app to see if Open appears as an authorized third-party service—if it does, you are using OAuth.
Either way, Open can only do what your bank allows. If your bank account is set to block third-party transfers, Open will not work. If your bank requires two-factor authentication for transfers, Open will prompt you for it. Your bank's security rules apply to Open's transfers just as they apply to transfers you make yourself.
What happens if someone uses Open to transfer your money without permission
If you see a transfer from Open that you did not authorize, contact your bank immediately—do not contact Open first. Your bank is responsible for protecting your account against unauthorized transfers. Under the Electronic Funds Transfer Act, your bank must investigate and usually must refund you within 10 business days if the transfer was truly unauthorized.
The key word is unauthorized. If you gave someone your Open login, or if you authorized a transfer but later regretted it, that is not unauthorized—it is a transfer you approved. Your bank will not reverse it. If you authorized Open to make a recurring payment and forgot about it, that is also not unauthorized. You have to cancel the recurring payment through Open or your bank's settings.
If your bank account password was compromised and someone logged into Open with it, that is unauthorized, and your bank will investigate. If someone phished you into authorizing a transfer through Open by pretending to be Open or your bank, that is also unauthorized. Report it to your bank and to the Federal Trade Commission at reportfraud.ftc.gov.
FDIC insurance does not cover Open, but it covers your bank account
Open does not hold your money, so it is not FDIC-insured. The Federal Deposit Insurance Corporation insures deposits held by banks, not by fintech services. However, the money in your actual bank account—the account Open connects to—is FDIC-insured up to $250,000 per account type per bank. When Open transfers money out of your account, it is moving FDIC-insured funds, but once the money leaves your bank, FDIC insurance does not follow it.
If Open goes out of business, your money is not trapped there because Open does not hold it. The money stays in your bank account. If Open's servers are seized or deleted, your bank account is unaffected. The only risk is if Open is hacked and attackers drain your bank account through Open—but that is a risk to your bank account, not to Open's solvency.
Steps to reduce risk when using Open
Use a strong, unique password for your bank account—at least 16 characters, with uppercase, lowercase, numbers, and symbols. Do not reuse this password anywhere else. If Open is breached and your password is exposed, attackers will try it on other sites. A unique password means they cannot use it to access your email, social media, or other accounts.
Enable two-factor authentication on your bank account. Most banks offer SMS codes, authenticator apps, or security keys. An authenticator app or security key is more secure than SMS because it cannot be intercepted by SIM swapping or phishing. When you use Open, your bank will ask for your second factor, and attackers cannot bypass it without physical access to your phone or key.
Review your bank account activity weekly. Check for transfers you do not recognize, recurring payments you forgot about, or small test charges (which scammers sometimes use before draining an account). Most banks let you set up alerts for transfers over a certain amount—use this feature.
Revoke Open's access if you stop using it. Log into your bank's app or website, find the connected apps or authorized services section, and disconnect Open. This prevents Open from making transfers even if your password is compromised.
Do not give your bank password to anyone, including Open support staff. Open will never ask for your password. If someone claiming to be from Open asks for it, that is a scam.
What Open's terms of service say about liability
Open's terms typically say the company is not liable for unauthorized access to your account if you failed to protect your password or if you authorized a transfer. This is standard for fintech services and reflects the law: you are responsible for keeping your password secret and for reviewing your account activity. Open is liable if it was negligent—for example, if it stored passwords in plain text instead of encrypted, or if it ignored a known security vulnerability.
If Open is breached and your account is drained, you have two paths. First, dispute the unauthorized transfers with your bank under the Electronic Funds Transfer Act. Your bank will investigate and refund you if the transfers were truly unauthorized. Second, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB investigates complaints against fintech services and can order restitution.
Open is not a bank and is not regulated by the Office of the Comptroller of the Currency or the Federal Reserve. It is regulated by state money transmitter laws and by the CFPB. This means Open has fewer safety requirements than a bank, but it also means you have fewer protections if something goes wrong. Your bank is your primary protection.
Comparing Open to other ways to move money
Open is one option among several for transferring money. Your bank's own app or website is the safest option because you are not trusting a third party with access to your account. You log in directly to your bank, and your bank handles the transfer. There is no intermediary.
Peer-to-peer apps like Venmo, PayPal, or Cash App are also third-party services, but they work differently. You do not give them your bank password. Instead, you link your bank account once (usually through OAuth), and the app stores a token. You then use the app's interface to send money. This is safer than giving Open your password because the app does not need to log into your bank repeatedly.
Wire transfers through your bank are slower but safer for large amounts because they are irreversible and require your explicit authorization each time. ACH transfers through your bank are free and reversible within a few days if unauthorized.
Open is useful if you want to automate transfers or pay bills from a single interface, but it is not necessary. If you are uncomfortable giving any third party access to your bank account, use your bank's app instead.
Frequently Asked Questions
Can Open see my bank balance and transaction history?
Yes, Open can see your balance and recent transactions because it needs this information to initiate transfers. However, Open should only access what is necessary to move money. Check your bank's connected apps settings to see what permissions you granted. If Open has permission to see more than it needs, you can revoke access and reconnect with limited permissions if your bank allows it.
What if I forgot to cancel a recurring payment through Open?
Log into Open and cancel the recurring payment immediately. Then contact your bank and ask them to reverse the most recent unauthorized transfer if it has not cleared yet. If it has cleared, ask your bank to dispute it as unauthorized. You authorized the first payment, but if you did not authorize subsequent ones, your bank may reverse them depending on the circumstances.
Is Open safer than giving my bank password to a bill payment service?
Open is safer than most bill payment services because it uses encryption and OAuth when available. However, the safest option is to pay bills directly through your bank's bill pay feature, which does not require you to give your password to anyone. Your bank's bill pay is free and does not rely on a third party.
What should I do if Open is hacked?
Change your bank password immediately. Contact your bank and report any unauthorized transfers. File a dispute with your bank for each unauthorized transfer. Check your credit reports at annualcreditreport.com for signs of identity theft. File a complaint with the CFPB at consumerfinance.gov. Your bank is responsible for refunding unauthorized transfers under federal law.
Does Open report my transfers to the IRS or credit bureaus?
Open does not report transfers to the IRS or credit bureaus because it is not a lender or financial institution. Your bank may report large transfers (over $10,000) to the IRS as part of anti-money-laundering rules, but this is your bank's requirement, not Open's. Open does not affect your credit score.