Screen scraping is a technique that collects data from websites or apps by mimicking user behavior. It is a rudimentary technology used in place of more secure data transfer methods, such as application programming interfaces (APIs).
E-commerce companies like travel comparison sites often rely on screen scraping to compare prices for airlines and hotels. Academic research has also historically relied on these methods to obtain data for analysis. In financial services, screen scraping has also been used by third parties, such as fintechs, to obtain data from consumer bank accounts to power those fintechs’ products and services, such as apps for budgeting, investing or tax preparation and other use cases. While most screen scraping targets public websites, almost all cases of screen scraping in financial services require bank customers to share their usernames and passwords with a fintech (or a data aggregator acting on behalf of a fintech) to obtain access to data.
Screen scraping puts consumers’ sensitive financial information at risk, increasing the likelihood of fraud and scams, and allows fintechs to harvest consumer data without safeguards.
The Basics
A screen scraper is a program built to scan a website, identify patterns and save important information for later use. In its most basic form, the practice follows a pattern:
- Step #1: Impersonate the Consumer. Users share credentials (e.g., username and password) for a specific website or app. The screen-scraping tool saves this information and uses the credentials to access the account by mimicking the consumer.
- Step #2: Find the Data. The screen scraper navigates the application’s user interface (i.e., a website or mobile app) to identify account numbers, balances, transaction details, contact information and other types of sensitive information, replicating clicks and keystrokes to avoid detection as a scraper.
- Step #3: Save the Data to a Database. Once that information is found, the program processes the data into a uniform format (for example, formatting account balances with two decimal points) and stores the information in a database.
- Step #4: Share the Data. Data obtained through screen scraping is then shared with a consumer’s preferred financial app. Depending on the third-party fintech or aggregator accessing the data, the data may be sold to, or shared with, other third parties.
- Step #5: Repeat. Using pre-saved login credentials, screen scrapers will repeatedly access a consumer’s bank accounts, sometimes without a consumer’s knowledge, to obtain new and up-to-date data. Screen scrapers can also collect far more information than is needed to provide the product or service the consumer desires without the consumer’s knowledge in many cases.
What’s the Problem?
A 2020 Department of Justice study revealed that a single data aggregator had access to sensitive information from over 200 million individual bank accounts. Storing millions of login credentials in one place and allowing fintechs to access any data they want, whenever they want, without restrictions isn’t just a risk to individual consumers, it also poses a risk to the broader financial sector. At a time when fraud is at an all-time high, these practices could lead to the misappropriation of those credentials that can then be sold or used by bad actors to drain consumers’ accounts.
Screen scraping is outdated, insecure and has no place in financial services. The CFPB should require the transition away from screen scraping and toward more secure forms of sharing, such as APIs. Unfortunately, the CFPB failed to address the unsafe practice of screen scraping in its final Section 1033 rule.
To learn more, visit KeepBankingSafe.com.
