You're about to connect your bank account to some app — maybe a budgeting tool, maybe a lender, maybe an income verification link a landlord sent you — and it's powered by "Plaid." You've probably never heard of Plaid before, and now it wants your bank login. That hesitation is normal. Here's a plain-English, honest look at what Plaid is, how the connection works, and what's actually safe about it.

What Plaid actually is

Plaid is infrastructure, not a consumer app. It's the technology layer that lets apps connect securely to your bank account without those apps ever building their own direct pipe into your bank. Thousands of apps use it, including Venmo, Chime, Coinbase, and most budgeting and lending apps you've probably already used without a second thought. Plaid doesn't advertise to consumers because you're not really its customer — the app you're using is. That's exactly why it can feel unfamiliar the first time you see its name on a connection screen.

How the connection actually works

When you click "connect bank account" in an app, a Plaid window (called Link) opens on top of it. Here's what happens, step by step:

You select your bank from a list inside the Plaid Link window.
You log in on Plaid's interface, or — for many major banks — you're redirected to your bank's own login page using OAuth, meaning you authenticate directly with your bank, not with Plaid or the app.
Your bank confirms the connection and tells Plaid which accounts you've authorized.
Plaid issues the app a token — a reference key, not your actual credentials — that lets it request the specific data you approved (say, transactions from checking, but not your mortgage account).

The critical detail: the app you're using never sees your bank username or password. In most cases, neither does Plaid's own servers permanently — for OAuth-supported banks, credentials go straight from you to your bank. That separation is the whole point of using an intermediary like Plaid instead of an app rolling its own bank-scraping login form.

Read-only access and tokenization

Plaid connections are read-only for the vast majority of use cases (transactions, balances, income analysis, identity). The app can see the data your bank shares — it cannot log in and move money, change settings, or take actions inside your bank account. Moving money requires an entirely separate authorization (Plaid's Auth or Transfer products), and even then it works through the same tokenized, permissioned system rather than handing anyone your raw credentials.

Tokenization matters because it limits blast radius: if an app's database were ever breached, attackers would get a token scoped to that one app's permissions — not your bank password, which you could otherwise have reused elsewhere.

Encryption and scale

Plaid encrypts data in transit and at rest, undergoes regular third-party security audits, and maintains SOC 2 compliance, as of recent years. It's also simply large-scale, established infrastructure: it powers bank connections for many of the fintech apps already on your phone. That scale cuts both ways — it means Plaid is a well-resourced, security-audited company, but also a bigger target, which is why its security practices get outside scrutiny regularly.

The 2022 privacy settlement — what actually happened

In 2022, Plaid settled a class-action lawsuit (originally filed in 2020) over how its Link product handled bank login credentials in earlier versions of its product, and over data collection practices that predated changes to its consent screens. Plaid didn't admit wrongdoing but paid $58 million to settle and made changes to how it discloses data collection and handles credentials during the connection flow. If you're evaluating "is Plaid safe" today, the more relevant fact is that today's connection flow — OAuth redirects to your bank for supported institutions, clearer consent screens, and a self-service dashboard to review and revoke access — reflects those changes, not the pre-2022 version.

How to review or revoke your Plaid connections

You don't have to take any single app's word for what it can see. Go to my.plaid.com and verify your identity (Plaid's portal typically confirms you by phone number), and you'll see every app currently connected through Plaid, what data each one can access, and a button to disconnect any of them. Revoking access there cuts off that app's ability to pull new data going forward.

Sensible precautions

Only connect through the official in-app Link window — never through a bank-login page linked in a text or email, which is a classic phishing pattern that has nothing to do with Plaid itself.
Check what data an app is requesting during the consent screen before continuing.
Periodically review your connections at my.plaid.com and revoke anything you don't recognize or no longer use.
Use unique bank passwords so a breach anywhere else can't be used to log into your bank directly.

How Income Checker uses Plaid

Income Checker is a Plaid customer, and we use it for one narrow purpose: transaction-based income analysis for rental and other verification use cases. When an applicant connects their bank through our flow, here's exactly what happens — and what doesn't:

The applicant authorizes read-only access to transaction history, the same Plaid connection described above.
We pull the transaction data needed to generate an estimated income report — recurring deposits, income patterns, and consistency — for the person who requested it.
The Plaid access token is deleted immediately after we fetch the data. We don't retain standing access to keep pulling data later.
We are not a credit bureau and this isn't a credit report. Our reports show estimated monthly income and detected deposit patterns — informational analysis, not an employment verification or an eligibility decision.

Want more detail on how we handle data specifically? See our security page. If you're wondering which banks are supported, check supported banks. And if you want a broader walkthrough of how bank-based verification works generally, visit Learn.

Frequently asked questions

Is it safe to give Plaid my bank login?

Yes, in the sense that matters most: for banks that support OAuth, you log in directly on your bank's own page, not a page controlled by Plaid or the app. For banks without OAuth support, Plaid's login form is encrypted and used only to establish the connection — the app itself never sees your credentials either way.

Can Plaid take money out of my account?

No, not through a standard read-only connection like the one used for budgeting apps or income verification. Plaid connections used for viewing balances, transactions, or income are read-only. Moving money requires a separate, explicitly authorized product (like Plaid Transfer), which is a different flow entirely from simply linking an account.

How do I remove Plaid access?

Go to my.plaid.com, sign in, and revoke access for any app listed there. This stops that app from pulling new data through Plaid going forward.

Does Plaid sell my data?

Plaid states it does not sell consumer data to third parties for their own marketing purposes; it shares data only as needed to provide the service the connected app requested and you authorized. Verify current specifics in Plaid's own privacy policy, since practices and disclosures can be updated over time.

Try Income Checker | See how it works