Plaid can very well not use the data in this way, but any company using Plaid's APIs and gaining access to the end-user bank account can do whatever they want with the data.
There are no restrictions on potential bad actors who will do this, and no consumer protections.
Second Market tried to make this possible years ago. Now you have options like Forge (formerly Equidate) and Carta recently announced a product called CartaX which will be a market for shares of non-IPO companies.
The NACHA response is missing the forest for the trees. Securing the account data is great, but it's only a small piece of the puzzle.
It doesn't:
a) penalize ACH Originators responsible for submitting the fraudulent entry (beyond the recently implemented $4.50 charge)
b) do anything to promote alternative account numbers for EFTs, which in theory could be better protected as they won't be on paper checks
c) promote better validation tools to prevent the likes of Plaid and entities using their APIs from harvesting broad amounts of private consumer financial data
The WWII in Color series on Netflix has a Midway episode in which they indicate a 90% failure rate of the torpedoes to explode. The article says 70 percent rate but either way its pretty unreliable.
For some of Plaid's partners it is the point. Others are only using Plaid for a simple bank account verification.
Here is the list Fintech companies which use Plaid as published in the Visa Acquisition presentation. Many of these (like non-lenders) have no legitimate use for all that info.
Stash
Dave
N26
Monzo
Acorns
Chime
MoneyLion
Rainist
Transferwise
Robinhood
Circle
SoFi
Revolut
Etoro
Clearscore
Toss
NuBank
Square Cash
Mint
Coinbase
Venmo
Credit Karma
Here is pertinent verbiage from the Plaid Privacy Statement.
Information we collect from your financial accounts. The information we receive from the financial product and service providers that maintain your financial accounts varies depending on the specific Plaid services developers use to power their applications, as well as the information made available by those providers. But, in general, we collect the following types of identifiers, commercial information, and other personal information from your financial product and service providers:
Account information, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, and account and routing number;
Information about an account balance, including current and available balance;
Information about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
Information about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
Information about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;
Identifiers and information about the account owner(s), including name, email address, phone number, date of birth, and address information;
Information about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction; and
Professional information, including information about your employer, in limited cases where you’ve connected your payroll accounts.
The data collected from your financial accounts includes information from all your accounts (e.g., checking, savings, and credit card) accessible through a single set of account credentials.
Plaid is an incredible company and provides a valuable service to their tech partners. That said, their data collection practices are scary. They allow any developer using their software to swallow all of a users banking data - I would love to know how they police bad actors.
PNC Bank says that this is the cause of new security procedures which have the effect of limiting Plaid's ability to verify customer Routing and Account numbers.
While I'm not a customer of PNC I think this is actually a good position for PNC to take - there is a ton of ambiguity in the data that Plaid collects on customers who may only think they're verifying their account for an ACH transaction.
Plaid's business in not necessarily deceptive but it is far from clear to the end user about the extent of their data collection.
This is a big deal, not only for the farmers using machinery from manufacturers like Deere, but for the rest of society who may now have some precedent for right to repair.
There's a company called Mezu which does this - you'll never reveal your identity or personal info the people you tip and vice versa.
https://www.mezu.com/
Everything is Securities Fraud.
https://www.google.com/search?q=matt+levine+everything+is+in...