38

Paypal has a new payment option called "Bank Account" which says:

Enter your online banking ID + password

Paypal: Enter your online banking ID + password

QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like Paypal), but does there actually exist any security mechanism/protocol that they could be using to make this operation safe?

Notes: Seen from Japan, on Firefox 32.0 Ubuntu 2014.04, URL starts with https://www.paypal.com/ Paypal: Enter your online banking ID + password
The warning symbol in the URL says "Connection Partially Encrypted".

Improve this question
9
  • 4
    remember, when you are in doubt with anything concerning your Bank Account security, like here, Always call your bank! escpecially if you see sites asking for your Bank details
    – Lighty
    Commented Sep 24, 2014 at 9:42
  • 53
    That's the most creative form of image censoring I've ever seen.
    – Polynomial
    Commented Sep 24, 2014 at 12:23
  • 19
    I really hope he's buying $120's worth of peppers.
    – TMH
    Commented Sep 24, 2014 at 13:24
  • 10
    Imagine if all government documents were redacted with bell peppers instead of black lines.
    – Keavon
    Commented Sep 25, 2014 at 0:55
  • 2
    Upvoted for the bell peppers.
    – Keavon
    Commented Sep 25, 2014 at 1:00

5 Answers 5

Reset to default
22

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account.

What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What PayPal does with your credentials after that is unknown. They might store it for future payments, or they discard it after the verification process.

In one line: Yes, your bank password goes to PayPal. Is it bad? Well, it depends on how much you trust PayPal.

By comparison, in Finland we have a completely different system with PayPal. When PayPal needs to verify the bank account or withdraw from the bank account, you get redirected directly to the bank's online banking page. You login there, and then you get redirected back to PayPal. They only get a verification token from the bank. The system is called TUPAS.

Improve this answer
14
  • 11
    "it depends on how much you trust PayPal" - I don't know what's typical in the US, but here in the UK my bank tells me not to give my online banking password to their own employees, never mind to an unrelated organization. As well as how much you trust PayPal, it also depends how much your bank trusts PayPal. If you trust them with your password, but your bank doesn't, and your bank finds out what you did (e.g. because they detect logins from PayPal's servers), then I imagine you're in their bad books ;-)
    – Steve Jessop
    Commented Sep 24, 2014 at 23:48
  • 1
    @SteveJessop here in the US it varies a lot. I bet there are some banks who offer the same advice, but many people probably ignore it - and those who don't are usually the ones who would never share a password anyway. But your other point about the bank finding out is a good one. In many cases it is written into the terms of service of a website (banking, or other) that you must never share your password with anyone.
    – David Z
    Commented Sep 25, 2014 at 4:02
  • 3
    By the way TUPAS sounds a lot like OAuth...
    – David Z
    Commented Sep 25, 2014 at 4:03
  • 1
    @Adnan Again: If the user asks "Is it generally safe to enter critical banking-login information on a page, if my browser displays a mixed content warning" - the answer is NO!!! Even if it is just an Image at the moment, this might change in the future and you will not recognize, if unsecure JS is loaded over HTTP, since you are ignoring your browser-warning! Mixed content is a possible security hazard and you should not ignore it!
    – Falco
    Commented Sep 25, 2014 at 13:32
  • 1
    @schnaader, that wouldn't be safe. In that case the hash itself would become the password. If you got your hands on the hash (whether through DB leaks or something else), you could send that through and it would be verified, no need to break the hash. This type of attack has been called pass-the-hash and famously affected Windows accounts.
    – Chris Murray
    Commented Sep 25, 2014 at 16:01
18

Is my password sent to Paypal?

Yep. Giving your password to PayPal may be a breach of your bank's Terms and Conditions and/or make you personally liable for any fraud that takes place through that system. Also PayPal can see the personal information and transaction history associated with that account. Hope you trust PayPal real good now!

Or is there a kind of protocol involving the bank's server, which makes this actually safe?

PayPal is most probably running automated screen-scraping scripts attempting to log in to the normal online banking site on your behalf and doing the transfer. This is obviously pretty fragile and risks breaking when banks update their web sites. It is likely that some banks may be co-operating with PayPal to reduce this risk.

This approach has been done a number of times before, eg by Germany's sofort.com. I am disappointed to see PayPal jump on this payment model too. Whilst the rest of the web is working on federated authentication/authorisation schemes that let you approve particular transactions without having to hand over the keys to the kingdom to other participants (OAuth, SAML etc), the financial world is once again plumping for convenience and legacy compatibility over security.

Improve this answer
4
  • What's with banks using simple password authentication though? In Sweden, all (afaik) banks use some kind of PIN-protected physical token (sometimes this token is your credit card chip) for authentication.
    – You
    Commented Sep 24, 2014 at 16:36
  • 2
    When Sofort did it for German banks that had TANs, they required you to enter a TAN separately to use in the login; I believe they also man-in-the-middle the CAP process (chip+PIN home signer thingy). I don't know if PayPal are doing the same or whether the supported US banks use similar 2FA methods. Encouraging users to type banking passwords and 2FA tokens into a third party site (encouraging phishing) seems super-irresponsible to me.
    – bobince
    Commented Sep 24, 2014 at 18:20
  • 3
    Excuse me but your answer is just pure speculation!! "..running screen-scraping scripts.." "..pretty fragile.. risks breaking.." What?? Yes, it may be implemented this way, it probably isn't (considering how big PayPal is) but the fact is that you don't know and I don't know. So please don't just start making up things
    – Andreas Bonini
    Commented Sep 24, 2014 at 19:36
  • Yes, until we have an actual PayPal developer here to definitely describe how it works, all any of us can do is speculate. I speculate that it works similarly to the existing services that provide the same user experience.
    – bobince
    Commented Sep 24, 2014 at 20:44
9

Your information does go to PayPal, who will likely use it to login to your bank account. That way they can verify your information is valid.

However - technically - they can also see other information. Anything you see after logging in (your account balance, the various deposits / withdrawals) is visible to them, and they may or may not store that. Technically they are also able to invoke any other function you don't need another form of authentication for.

So, risk is one matter. The other matter is if your bank actually allows you to do that. A lot of banks will require that you keep your access information confidential. By using this function you will violate that agreement, by giving your access information to a third party.

Improve this answer
5
  • 3
    +1 for "banks will require that you keep your access information confidential". Ask your bank if this is allowed! Probably it is as it looks like they only support a small number of large banks, so they have probably got an agreement with them. But I still wouldn't go near it.
    – Ben
    Commented Sep 25, 2014 at 10:12
  • So sad we live in a world where a business that makes money off your money, still gets to at the end of the day tell you what you are and aren't allowed to do with that money you've so kindly let them 'hold onto'.
    – Mike
    Commented Sep 25, 2014 at 14:25
  • True, but to a point you have to understand them - you are essentially giving them the keys to your bank account. I have an account at a pretty big bank in Central US, and someone could literally empty it with the correct username and password. Even if you trust PayPal, services like these make users more prone to letting their guard down, and thinking that it's okay to give away their passwords. It's a bad habit to start.
    – Aaa
    Commented Sep 25, 2014 at 14:34
  • @Mike, the bank isn't dictating what you do with your money, where did you get that idea from? All the bank is saying is, "If you give your access to another, we are no longer responsible for protection of your funds". Which makes perfect sense, how can the bank protect your money if you give access to anyone and everyone?
    – Chris Murray
    Commented Sep 25, 2014 at 16:06
  • @ChrisMurray I must have misunderstood his meaning by saying that 'violate that agreement'. I suppose this means they'll take no responsibility for anything negative happening, which makes sense but I wouldn't worry about it in the case of a reputable company like Paypal.
    – Mike
    Commented Sep 25, 2014 at 16:09
0

I have a login and password that is read-only access. That is the login I use when sites such as paypal asks for it. I also use the read only account for my quicken software. If you are curious what paypal does with the login data, read the user agreement or contact support for more details.

Improve this answer
0

I think other answers explain well risks of giving your password to PayPal. I think the bigger issue here is that users are taught in this way that they can sometimes provide password to somebody. This is IMO extremely bad and stupid and I'm highly disappointed by PayPal for doing so.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .