MSE News: New HSBC app will show ALL your accounts - even if they're with its rivals

colsten

zerog wrote: »

I have 13 current accounts and 8 credit cards and I haven't seen the need to use an "app".

I have a few more than you, and I couldn't possibly manage them all without an aggregator. I must have used one for about 10 years now, with no major problems at all. The biggest 'upset' was probably when Egg Money Manager got withdrawn a few years ago. Ewise has filled that space very nicely though, and I hope it will stay available without having to go through an intermediary such as a bank.

Doc_N

colsten wrote: »

I have a few more than you, and I couldn't possibly manage them all without an aggregator. I must have used one for about 10 years now, with no major problems at all. The biggest 'upset' was probably when Egg Money Manager got withdrawn a few years ago. Ewise has filled that space very nicely though, and I hope it will stay available without having to go through an intermediary such as a bank.

I'm with you on this - aggregation is hugely useful. First Direct Internet Banking Plus works (and stores no passwords, logins etc outside your own PC) but it's extremely clunky, requires Internet Explorer, and three incorrect logins will mean a huge amount of work redoing all the information - a real heartsink moment if it happens.

Ewise? Tell me more. In fact I'd be interested to hear of any alternatives to the First Direct option.

colsten

Doc_N wrote: »

Ewise? Tell me more. In fact I'd be interested to hear of any alternatives to the First Direct option.

ewise is the underlying technology for the FD aggregator. It's the same clunky IE interface but it does offer you to save/backup your login details on an external device, which I find hugely helpful. They also offer more organisations than FD did when I last looked at FD. Unfortunately, you can't import your FD details, so you'd have to start again from scratch.

Support for ewise is very responsive - I mucked up my login once and they'd reset things for me within a day (I didn't have to re-enter all my data). They are also relatively quick with fixes if you report a problem to them.

https://www.ewise.com.au/accunity/aa/home.asp

jogu

This phrase in the article is very misleading:

"It's worth noting that until Open Banking comes into effect, some banks <..> say that you're liable for fraud on your account if you've shared your login details with anybody, including apps"

This conflates two separate things. Even after OpenBanking comes into effect, you will still be liable for fraud if you've shared your login details with a third party or app.

The key benefit of OpenBanking is that you can use apps like this WITHOUT giving away your login details. The signup process will involve a secure way for the account holder to allow the app access to the account transactions, which will be confirmed by the account holder using their login details to login to the account provider only. The app will also only be able to do what you have granted it permission to do - so in the case of this HSBC app, it will only have permission to read your transactions, and will not be able to send payments from your bank account. If you instead give away your login details, HSBC technically has the ability to make payments.

(It's interesting that it looks like this new app will give me significantly better access to transactions in my HSBC accounts that the current HSBC app gives me!)

jogu

colsten wrote: »

The important bit there is "as long as you do not give your security details to the service provider". A proper aggregation service will not give your security details to the provider but keep it instead in an encrypted file on your device. Nobody in their right mind would be using any service that actually passes the security details to the provider.

That's not really the important part. There's no real semantic different in the two scenarios you outline. You are trusting the aggregation service's word that the account details are encrypted and that they never send them to their service, and that they've sufficiently protected everything involved to stop any hackers accessing your security details - there's quite a few attack vectors.

The important change with OpenBanking is that you no longer have to give your security details to anyone other than your bank. There is a new security process that allows you to securely authorise your bank to allow the third party to see your list of transactions (there will also be permissions you can grant so third party apps can initiate payments). Any access is clearly logged as to who it was made by, and within your internet banking portal you will be able to revoke any access you have granted to third parties.

If anyone is interested in the technical details, the process is based on OAuth2, partially on OpenIDConnect, and partially on the OpenIDFoundation Financial API security standard. (Source: I'm a member of the working group for the latter and also working on a project for the OpenBanking Implementation Entity.)

poppy10_2

Still no sign of this from HSBC.
We've got used to them being far behind the curve technologically

jogu

poppy10 wrote: »

Still no sign of this from HSBC.
We've got used to them being far behind the curve technologically

None of the other people developing apps/services around OpenBanking have released them yet either, HSBC is hardly alone in this!

The OpenBanking APIs are currently in a 'managed rollout' phase; it's likely we'll start to see services that use the APIs becoming available around the start of March.


(I should probably correct one of my posts further up too - if you share your banking password with an FCA registered/authorised company, and possibly some unregistered firms but it's not clear, then from 13th January the bank should cover you for any fraud.)

gt94sss2

poppy10 wrote: »

Still no sign of this from HSBC.
We've got used to them being far behind the curve technologically

Its in beta... and as far as I can tell so are virtually all other apps such as Tandem which will offer similar functionality.