It’s worse than keys, it’s a persistent read-only view of all account data.
At least there is a process for unauthorized ACH debits. For this blatant breach of privacy, there is nothing.
Plaid requires your bank username and password, so they have full read-write access to your account. They can do anything you can do when logged in to the bank's website, and so can anyone else who gains access to Plaid's database.
Plaid requires your bank username and password, so they have full read-write access to your account. They can do anything you can do when logged in to the bank's website, and so can anyone else who gains access to Plaid's database.