Quick answer
Screen scraping means an app logs in to your bank with your username and password and copies what it sees. With an API, you approve a limited permission at your bank and the app gets a token, not your password. EU and US regulators have moved away from scraping[2][4].
Key points
- Screen scraping uses your banking credentials to log in as you and read your account pages.
- APIs give the app a limited token after you approve at your bank, so your password stays with you.
- The CFPB describes screen scraping as still common but risky; its main problems are shared credentials and over-collection of data.
- EU technical standards under PSD2 ended screen scraping for regulated access once the standards applied.
- If an app asks you to type your bank password into the app itself, ask how it connects before you agree.
On this page
#What is screen scraping?
Screen scraping is a way for an app to get your bank data by logging in as you. You give the app your online banking username and password; its software signs in to your bank's website, reads the pages, and copies balances and transactions into the app. The CFPB describes it as an access method that uses consumer credentials to log in to consumer accounts to retrieve data[1].
Screen scraping was common because, for years, there was no other route. Banks did not offer outside apps a proper doorway, so apps used the one designed for humans. By 2022, at least 100 million US consumers had authorised a third party to access their account data, according to the CFPB[1], and in its own words scraping remained a still common but risky practice in which consumers give account passwords to third parties who use them to access data indiscriminately[2].
#How is an API connection different?
An API connection is a doorway the bank builds on purpose for approved apps. The app asks for a specific permission, you are redirected to your bank to log in, and the bank gives the app an access token tied to you and to that one consent[3]. The app never sees your password. Our step-by-step guide to how banking APIs work shows the full conversation between app and bank.
| Question | Screen scraping | API access |
|---|---|---|
| What does the app hold? | Your banking username and password | An access token for one consent[3] |
| What can it see? | Whatever your login can see on screen | Only the data the consent covers |
| Where do you log in? | Inside the third-party app | At your own bank |
| How do you stop it? | Change your password, which also cuts off every other app that holds it | Withdraw the consent; the token stops working |
| Status in the EU | Ended for regulated access once the PSD2 technical standards applied[4] | Banks must provide a dedicated channel[4] |
#Why do regulators dislike screen scraping?
The CFPB names two core problems: the proliferation of shared consumer credentials and the over-collection of data[1]. Every app that holds your password is one more place it could leak from. And because a scraper sees everything your login sees, it can collect far more than the service needs. Supervisors more broadly list data protection, cyber security and third-party risk among the main open banking challenges[5].
Scraping is also fragile. A scraper reads pages built for humans, so a redesign of the bank's website, a new login step or a security prompt can break it. It can also clash with strong customer authentication, because an automated login cannot easily answer a code sent to your phone. APIs are designed for machines and, in regulated systems, come with performance rules.
Worked example
Worked example: how often your password could be used
Imagine you connect three apps that all use screen scraping, and each one refreshes your data four times a day. Compare that with three API-based connections. These are illustrative assumptions, not measured data. Calculated with code.
- Logins with your password per year: 3 apps × 4 refreshes × 365 days
- 4,380
- Copies of your password outside your head: 3 apps
- 3 (plus any backups those apps keep)
- Logins with your password by API-based apps
- 0: you log in at the bank only when you approve or renew
- Data reachable by each scraper
- Everything your login can see
#What do the rules say about screen scraping?
European Union. When the Commission explained the PSD2 technical standards, it said it will no longer be allowed to access customer data through screen scraping, and that banks must instead set up a communication channel that lets authorised providers access the data they need[4]. Read PSD2 explained for the background.
United Kingdom. The Payment Services Regulations 2017 require account information providers to access only the accounts you designated and to use data only for the service you requested, and they require banks to communicate securely with those providers[6].
United States. The 2024 CFPB rule says a bank cannot meet its data-sharing duty by letting a third party screen-scrape, and that a bank must not let a third party access its developer interface with the credentials you use for online banking[1][7]. However, as of the latest documents we opened, a court has barred the CFPB from enforcing the rule while it reconsiders it[8]. Details are in the CFPB 1033 rule explained.
#How can you tell which method an app uses?
A quick check before you connect
Watch where you are asked to log in
If the app shows its own form asking for your bank username and password, that is a sign of credential sharing. In API flows you are sent to your bank's own site or app[3].
Read the permission screen
In an API flow your bank shows you the permission you are giving. Scraping has no bank-side permission screen, because the app simply logs in as you.
Check the provider is regulated
In the UK and EU, account information and payment initiation providers must be authorised or registered. Look the firm up on the regulator's register.
Ask the app directly
A reputable provider can tell you whether it uses your bank's API. If it cannot or will not, treat that as a warning sign.
Common beginner mistakes about screen scraping and APIs
Thinking 'read-only' scraping is harmless
A scraper only reads, but it reads with your full login, which can usually do much more than read.
Assuming a well-known app must use an API
Some services have used scraping where banks offered no API. Check how each one connects.
Forgetting to change your password after disconnecting a scraper
Deleting the app from your phone may not delete the credentials the provider stored on its own systems. Change your password if you ever shared it.
Believing APIs remove all risk
APIs protect your password, but scams can still trick you into approving a consent or a payment. See authorised push payment fraud.
The bottom line
Screen scraping and APIs can deliver the same numbers to an app, but they put very different keys in its hands. Scraping hands over your full login; an API hands over a narrow, revocable permission approved at your bank. Regulators have moved firmly toward APIs, and you can apply the same preference by checking where you log in before you connect anything.
Frequently asked questions
Is screen scraping illegal?
Why did apps use screen scraping at all?
Before banks offered APIs, logging in as the customer was often the only way to read account data automatically.
Does an API share less data than scraping?
Usually, yes. An API returns only what the consent covers, while a scraper can see whatever your login sees, which is why regulators worry about over-collection[1].
How do I stop an app that used my password?
Disconnect it in the app, then change your online banking password so the stored copy no longer works.
Sources
- Required Rulemaking on Personal Financial Data Rights (final rule, 89 FR, 18 November 2024) — Federal Register (Consumer Financial Protection Bureau), 2024 Primary
- CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services — Consumer Financial Protection Bureau, 2024 Primary
- Read/Write Data API Profile v4.0.1 — Open Banking Limited, 2026 Primary
- Payment Services Directive (PSD2): Regulatory Technical Standards (RTS) enabling consumers to benefit from safer and more innovative electronic payments (MEMO/17/4961) — European Commission, 2017 Primary
- Report on open banking and application programming interfaces (APIs) — Bank for International Settlements (Basel Committee on Banking Supervision), 2019 Primary
- The Payment Services Regulations 2017, regulation 70 (Account information services) — legislation.gov.uk, 2017 Primary
- 12 CFR 1033.311 — Requirements applicable to developer interface — eCFR (US Code of Federal Regulations), 2026 Primary
- Forcht Bank, NA et al. v. Consumer Financial Protection Bureau et al., No. 5:24-cv-00304, Document 90 (order granting preliminary injunction, 29 October 2025) — US District Court for the Eastern District of Kentucky (via Justia), 2025 Primary
- The Payment Services Regulations 2017, regulation 77 (Payer's liability for unauthorised payment transactions) — legislation.gov.uk, 2017 Primary
.jpg){kind=link}
