Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Plaid has become the leading financial data aggregation company in the United States. Plaid is planning to leverage its connections to build a bank-linked payments network that would compete with Visa. Plaid’s money movement platform would allow consumers to pay merchants directly from their bank accounts using bank credentials rather than a debit card. Plaid’s established connections and technology uniquely positions it to enter the payments market and disrupt Visa’s monopoly"

Fascinating. I think the line that DOJ is drawing is tenuous. It is not like removing Plaid from the marketplace would remove dangers to Visa's debit card monopoly. Wouldn't a Google/Apple/FB/Amazon be more of a platform threat. Google/Paypal already do this when you can directly pay from bank account to merchant. How does this help?



It is quite a fascinating scenario.

Apple and Google wallet are integrated into the credit card processing infrastructure. So they don't compete with Visa, their payments still go over Visa's rails.

Plaid's killer feature has always been their private access to APIs that the banks won't give to anyone else. It's essentially like they're using modern web APIs while everyone else is using snail mail (i.e. ACH, bank transfers that settle in batches once per day). I'm not exactly sure how they struck those deals and why there is no reasonable, open integration path or payments protocols between banks in the US like there is in every other developed country. Is it just that the banks like making their $15 per wire transfer? It feels like there's got to be more to it but I'm not sure.

But regardless, where we've ended up is the banks have fought so well to keep everybody out of their collective walled garden, but somehow Plaid has snuck in under the radar and has become so large and entrenched that they are themselves being called the monopolist, rather than the banks that own and control the system but of which there are multiple. I don't know enough about the details of Plaid's business though to weigh in on whether there's any truth to these claims.


I was under the impression that they didn’t have access to any APIs but that they simply took your credentials and scraped the bank webpage.


I was under the impression it was a little of both, depending on the bank.


They do some of both.

When I link a Capital One account, I get an OAuth-style flow and the ability to select which accounts I share directly on the C1 website. The sites I use this on show up as "Linked Apps" in my security settings in C1.

Others use the credentials-based flow.


CapitalOne has (not even just for banking standards) an amazing developer platform. https://developer.capitalone.com


CapOne’s API snd docs, technical customer support and their easy to use VCC generation has kept me with them long after I had expected. Other than Amex they’re probably the only big “bank” I’d recommend (and Fidelity for checking).


Where they aren’t using APIs and instead the scrapers, does that mean they have your banking login credentials? Be curious to hear how they get around MFA.


My experience using plaid with Schwab, on which I have MFA, is that you need to add an MFA code to your password when connecting the two. It works for some duration (a few days?) and then loses sync and you have to re-enter the password+MFA combo.


Do you literally concatenate the two? I've been wondering how to get plaid to work with my accounts that have MFA.


Nah, Plaid's UI handles it natively. If it's required, Plaid will prompt you during the connection process with the same steps and any questions you'd encounter doing it directly on Schwab's website - "do you want a text or call" and then "enter the code" steps.


Yes, they also can monitor and scan your financial transactions. Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their financial information for convenience.


So what? Convenience is nice. And I'm willing to pay for convenience when the other options are far less convenient.


> Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their <VERB> information for <THING>


When i used Mint at first, they'd just ask you to go to the page with the caphcha or whatever and go through it when you'd update your accounts with the auth scraper method. This was like maybe a decade ago? You could do a similar thing with mfa in realtime.


they do for CIBC. it's a problem when you change your password and they keep trying to login with your old credentials - your account gets locked.


So why not force the opening of the walled garden in law then? The EU has PSD2 now which forces all banks to have open APIs. We have multiple Plaid-like competitors providing the platform on top of those APIs. But it wouldn't have happened without regulation.

Generally innovating through regulation is bad and I don't support it. But I think the aversion to it in the US is what creates these monopolies in the first place and in this specific use case, I think it's a faster way to solve the problem.

This is an example of what becomes possible (no card details and low fees):

https://techcrunch.com/2019/01/29/truelayers-payments-api-le...


yep I think this is exactly what is needed


>Plaid's killer feature has always been their private access to APIs that the banks won't give to anyone else.

These private apis will soon no longer be private due to Open Banking/PSD2 (europe) regulations. Plaid's biggest competitive advantage was removing the complexity of various data formats and APIs of banks. This variance will soon be gone in the coming years.


Paypal has my banking details and can use those or credit/debit card to complete my payments. They always prefer to use bank because of no fees with cc/debit as backup. Google could do the same. ACH is really creaky and old.

We need something like UPI (india) or Wechat (china) in the US. Zelle is a poor substitute.


Paypal is basically acting as a short-term lender in this case, which comes with all its own risks and costs. Sure Google could do the same but it's not worth it to them to get into this mess.

Paypal uses ACH under the hood (it's one of only two options, the other being wire transfers which are expensive and often even need to have humans in the loop). So they guarantee the payment to the seller, and then as the buyer your bank account gets charged up to a day later when the ACH batch processing goes through. If you don't have enough money in your bank when that happens, it gets rejected and Paypal takes on that loss unless they can recover it from you via collections system.

To limit their risk, Paypal even uses Plaid in some cases to check your bank account balance before deciding whether to allow your payment to go through! But even that isn't a guarantee, because you could always have made multiple ACH payments that day of which some might go through and some could fail due to lack of funds. It's like trying to prevent a race condition in a multithreaded program by just checking the value again closer to where the race occurs, it might make the issue happen a little bit less often but to actually solve the problem you need certain atomic primitives which the US bank transfer system completely lacks.


> Paypal has my banking details and can use those or credit/debit card to complete my payments. They always prefer to use bank because of no fees with cc/debit as backup. Google could do the same. ACH is really creaky and old.

> We need something like UPI (india) or Wechat (china) in the US. Zelle is a poor substitute.

Why is zelle a poor substitute? I can pay people via phone number.


Zelle still uses ACH under the covers.


Zelle is real-time, while ACH is not.


Zelle is owned by a private company, owned by the US' largest banks [1]. The US Federal Reserve is working on a replacement [2] (FedNow) that presumably will have less power to keep banking entities (small banks, community banks) in the US with less pull off the network (with pricing or other mechanisms).

From the perspective that instant payments should be an inexpensive, accessible utility for the benefit of all citizens, the Fed's FedNow efforts are preferable to Zelle or legacy ACH services.

[1] https://en.wikipedia.org/wiki/Zelle_(payment_service)

[2] https://corpgov.law.harvard.edu/2020/08/31/fednow-the-federa...


I understand how Zelle pull off real-time for intrabank. For interbank, they are either covering it or have they built a payment service under the covers?


The final real reconciliation for Zelle is done over ACH.


Technically, Plaid doesn't have access in a sanctioned way. You pretty much guaranteed violate any electronic banking ToS by sharing credentials with a third party.


Only if Plaid weren't a company that has contracts in place with every single bank they offer to access their services without being sued (despite the fact that the antique tech stacks these banks have don't allow Plaid to use oauth in most cases).


> The complaint alleges that Visa’s CEO viewed the acquisition as an “insurance policy” to protect against a “threat to our important US debit business.”

This quote makes it sound like Visa is acting monopolistic, which is the behavior they don't want to see.

Rest of the paragraph

> This acquisition is the second-largest in Visa’s history, with an extraordinary price tag of $5.3 billion. Visa’s CEO justified the deal to Visa’s Board of Directors as a “strategic, not financial” move, and noted that in part because “our US debit business i[s] critical and we must always do what it takes to protect this business.” Unless acquired, Visa feared that Plaid “on their own or owned by a competitor [was] going to create some threat” with a “potential downside risk of $300-500M in our US debit business” by 2024. If Plaid remained free to develop its competing payment platform, then “Visa may be forced to accept lower margins or not have a competitive offering.”


Yeah, the Justice Department may not have scrutinized this acquisition all that much, but this guy said the quiet part out loud.


It's unclear where these statements come from, but I find it hard to imagine they were meant to be public, the CEO would know better. Most likely they were internal conversations that got leaked or conversations that got logged which were part of some sort of warrant/information request.

Or you're right and CEOs of huge multi-international companies are a lot more stupid than we previously thought.


I mean, even if he said it internally, that's a dumb thing to say.


The underlying argument is that they would probably just do it again with another competitor down the line, I believe. At its heart is anti-competitive behavior.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: