Ally Bank is closing my account due to suspicious activity related to my use of the YNAB app. They claim I've shared my password, likely because the multiple logins were flagged as unusual.

Did you link your account to YNAB several times, or just once when setting it up?

it kept on asking to reauthorize

Wowow Never even thought of something like this happening I had a different concern: https://frumfinance.slack.com/archives/C056LMV4SAD/p1699977482365369?thread_ts=1699977482.365369&cid=C056LMV4SAD

They do have an API but it is not public, that is what Intuit-related apps like Quicken use. Most banks have it but it is not advertised at all - its called OFX. Instead they do a direct agreement with Intuit. Unfortunately, that API is not available for other apps. And recently that API has been moving towards non-password use cases with OAuth (see here). [I used to work at a financial institution].

So having YNAB connected to my ally accounts via Plaid or MX is breaching their terms? something is not clear to me.

@gorgeous-computer-9973 based on my understanding, yes. You gave your password to a third party (e.g. Plaid). This is in contrast to logging in on the bank website and approving API access. Hard for non-techies to notice the difference, but you can generally tell by looking at the URL of the page that actually asks for your login info (e.g. .ally.com vs. .plaid.com) Sorry, asterisks were converting to bold

Are you having trouble transferring money out of Ally?

Yes they said that after the investigation is over, they will mail me a check with my balance

That's horrible! Ynab claims ALLY is one of their number one banks! https://support.ynab.com/en_us/direct-import-watchlist-institutions-a-guide-H1_owLF

Might be worth it to file a complaint with the CFPB and the comptroller of currency

And the bbb

What's the complaint? I don't see Ally doing anything wrong here

Anyone knows if capital one has the same issue? In general ally supposed to be a very strict bank.

I thought plaid doesn't collect passwords anymore and relies on oauth approval. Are they still doing that?

I believe it depends on the institution. You can tell by the domain of the auth page. I've never seen an auth page for Ally use ally.com - not with RightCapital, Mint, or any other platform I've used. Same with ACH auth from another bank. I just do manual deposit confirmation.

They're CLOSING the account? What???