That’s unusual, but not unheard of. Some online merchants will allow you to make payments via ACH transfers. Can be useful for things like international purchases or if you don’t have a normal credit/debit card to use. Sometimes smaller merchants will prefer this, if they don’t have an existing business partnership with a payment processor already.
Usually these will go through a third-party system that tokenizes your login with your bank. This way the merchant can only access your routing/account numbers to do the transfer. As for why you’d need to provide your bank login instead of the routing/account numbers directly, it’s usually just a form of fraud prevention, as the login verifies that you’re actually the account owner and not trying to pay with a checkbook you found on the street.
It’s similar to Plaid, which is a near-identical service that some merchants in the US use. From what I can tell, Ozow appears to be legitimate, so realistically it’s probably safe to enter your login details as long as you’re not getting any certificate errors on the page.
E: Not sure why this is downvoted. I’m not saying it’s a good system, just saying that it’s not inherently a scam.
We have a variation of this system here (India)
During checkout you can select netbanking as payment method. It asks you to select your bank and after you select it and click next/pay, it redirects you that bank’s login. You login, provide OTP, and it redirects back to the website you were shopping at, usually to orders page.
Sounds like a good opportunity to redirect to a fake version of the bank’s website.
Honestly I think the best solution is a revokable token from your bank that you can give to a merchant. One token per merchant, make it easy to revoke as the user sees fit. If you see a charge on the token from one merchant by someone else it’s immediately obvious that token and possibly that merchant was compromised
As far as I know, fake version of bank’s website will not work because the redirection happens from payment gateway with hardcoded linking to bank websites.
You shouldn’t trust Plaid either.
Especially if all they’re doing is looking for the routing and account number. Because that’s just as easy to give.
It’s also risky to give. Banks will generally approve all transactions between two accounts if one of them is a business account, because the assumption is that those are business transactions and are legitimate 99.99% of the time, so there’s very little scrutiny involved for those transfers. Giving the merchant your routing/account number gives them access to make withdraws from your account at will and at any time and can’t be revoked, and giving that access to somebody you may not fully trust the reputation of is a dangerous move.
A trusted financial institution as a middleman can be useful for those situations, because they’ll tokenize your details to expose as little as possible to the merchant, directly. These services are typically insured, so even if something did happen to your account, you’re more likely to get your money back than if you gave a merchant direct ACH access to your bank account. It’s basically a modernized version of Western Union.
You do realize that if the bank authorizes a transfer, that you did not… it’s wire fraud and they’re obligated to refund that cash, regardless if they recoup the cash or not.
Their fuck up, their loss.
On the other hand, if you give your credentials to a 3rd party, that’s against the ToS none of us actually read, and if something happens to your account; they’re going to deem it as your fuck up.
As for whatever technobabble Plaid wants to use, even if they’re insured… you’re not, unless you can prove in court that they were the source of the breach. Their lawyers are probably better than yours.
Plaid effectively admitted to stealing your transaction history and selling it to the highest bidder in the past. There was a settlement and they agreed to not to that in the future
Just don’t ever share your password, and certainly not your banking password, and definitely not with Plaid.
I know someone who works in software security at Plaid. I can’t give too many details because there’s only like 20 of them - but no, you REALLY should not trust Plaid. (Allegedly) phones intercepting 2FA in their server rooms, (allegedly) bank connection issues that have led to people getting access to the wrong accounts, (allegedly) using browser bots to handle login on the backend for banks without API access, (allegedly) customer info leaks that weren’t reported… Now that I think if it, I should tell my friend about the whistleblower programs
I don’t know how it works in the US but under European law if he knows about these things and isn’t reporting them he’s liable if and when it all comes to light.
If you know that the company you work for is committing crimes, and you do not report it, you are as liable as the company.
The crazy part that the bank uses username+password method for authentication.
Well, it is a payment processor that uses bank accounts. So, that makes sense.
That’s what wire transfers are for.
There should be no need for you to give them your credentials. Also, be aware that if you do give a third party credentials, and you get hacked, your banks going to blame you for being stupid.
Because it is stupid.
How stupid is it? Not even the bank support staff will ask for your credentials.
I just noticed it was login details… my brain was thinking account and routing.
Still, I say: You (importer) tell me the amount to pay – then I authorize payment to you.
They’ve been doing essentially the same thing for years. Here’s the site from 2 years ago. Not to say that this is definitely safe, but scam sites usually don’t last this long
https://web.archive.org/web/20220114215955/https://ozow.com/
Step 3: Log in and select your account to pay from. Don’t worry, we have security covered. 🤣
Yeah, scam or not, this method of getting your account and routing information is not at all secure. I’m actually more surprised that the banks allow another site to initiate the login with a plaintext password. This defies all decent security practices.
Seen the same thing with other third party payment systems in south africa. Run away my dude.
This kind of stuff got legalised in Germany: Banks said that e.g. Sofortüberweisung was instigating their customers to break their TOS and should be shut down, anti-trust then said “nuh-uh you can’t just shut down legitimate business” (Sofort is indeed legitimate) and instead put third-party systems under banking regulations, and required ordinary banks to have APIs allowing third parties do do sensible things.
…which theoretically could mean that you’re sent to your actual bank to authorise and thus getting rid of the normalising phishing problem, dunno, haven’t checked I’m boycotting them out of principle for going down that route in the first place. Don’t serve any purpose now that we have real-time transfers, anyway.
