My new landlord sent me to a payments portal for making lease payments. The $38 credit card fee was kind of steep, so I thought I'd set up an automatic ACH debit. This brought me to an account verification screen asking me to supply my bank account information and my online banking password. Yikes. I don't think so. I just hate screen scraping. How about you?

I own my sign-in credentials and I'm not giving them away that easily, convenient payment portal or no. That's one reason I am encouraged to see the Consumer Financial Protection Bureau's (CFPB) proposed rulemaking, "Personal Financial Data Rightsicon denoting link is offsite," issued in October. The proposal aims to move providers away from screen scraping, a 1990s technology that the CFPB calls a "risky data collection practice." It would require data providers to facilitate access via application programming interfaces (APIs), a practice with the potential to make screen scraping obsolete. Smaller banks would have until around 2029 to comply with the rule, so screen scraping could stick around for a while.

I've been writing a lot about standards recently, and this is another situation where the lack of an up-to-date, consistent standard for data exchange is inefficient and inconvenient not only for me with my fear of breaches but also for my bank and my property manager.

Instead of agreeing to the screen scrape at the property manager's website, I headed over to my online banking app and set up an auto bill pay. Here are the likely consequences of my choice:

  • The bank is going to be mailing a paper check to this small real-estate business. A banker recently told me that his bank had managed to get the share of consumer bill pay executed via paper check down to 20 percent. Especially for small businesses, the bills are paid with paper checks. The banker opined that share was not going to drop significantly anytime soon.
  • For the property manager, what could have been an automated process now will involve the receipt and recording of a paper check. Someone is going to have to match the check to the invoice and post it correctly to the accounting system.

So not great for consumers, not great for payees, not great for payments providers, not great for the payments ecosystem. According to the CFPB notice, "Screen scraping became a significant point of contention between third parties and data providers, in part due to its inherent risks, such as the proliferation of shared consumer credentials and overcollection of data."

Lots to think about in the 299-page proposed rule. Comments are due December 29, 2023. Make sure your voice is heard.

Photo of Claire Greene
By Claire Greene, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed