Open banking is safe by design. The customer authenticates with their own bank, so the login is never shared with anyone else. Access is read-only unless a payment is separately approved, every provider is authorised and regulated by the FCA, and the customer can withdraw access at any time. It is materially safer than emailing a statement or sharing a banking password.
Why it is safer than sharing login details
The old ways of proving your finances all involve handing something over: a password to a screen-scraping tool, a PDF statement that could be edited, a payslip by email. Open banking removes the handover. The customer proves who they are to their own bank, and the bank releases only the specific data agreed, to a named, authorised party, for a defined purpose. Nothing sensitive travels through the business, and there is no shared secret to be stolen or reused. See open banking vs screen scraping for the contrast.
How it is regulated
Open banking providers are authorised or registered by the Financial Conduct Authority under the Payment Services Regulations 2017. That brings obligations on security, conduct and complaints handling, and it means a customer dealing with a provider has the same kinds of protection they expect from a regulated firm, including recourse to the Financial Ombudsman Service for eligible complaints. For who sits behind the rules, see who regulates open banking.
Strong customer authentication
Every connection is protected by strong customer authentication (SCA): the customer confirms their identity to the bank using at least two independent factors, typically something they have (their phone) and something they are or know (a biometric or passcode). This is the same step they go through for their own banking, and it is run by the bank, not the business. SCA is why a stolen email address or a guessed password is not enough to connect an account. The technical profile behind it is covered in the security profile.
What a customer can revoke, and how
- With the provider: the customer can withdraw a connection in the provider's dashboard, which stops further access.
- With the bank: they can also see and cancel connected parties in their own banking app, independently of the business.
- By expiry: ongoing access is time-limited and has to be reconfirmed, so access does not quietly continue forever.
What happens to data already shared, and the reconfirmation rules, are covered on open banking consent.
What data is never shared
Open banking never shares the customer's login credentials, PIN or full security details; the bank keeps those. A provider only receives the data categories the customer approved, for the accounts they chose. Account information access cannot see into other accounts, cannot change anything, and cannot move money. A payment, if any, is a separate, explicitly approved instruction for a specific amount.
Fraud and Confirmation of Payee
Because a pay by bank payment is set up by the customer at their own bank, with the payee pre-filled, it removes some of the fraud surface of manual bank transfers, where a person can be tricked into typing a criminal's account details. Confirmation of Payee, the UK name-checking service, adds a further check that the account name matches before money moves. No system removes fraud entirely, but authenticated, payee-fixed payments are harder to misdirect than free-text transfers.
From the data consumer's side
Safety is also a conversion tool. Customers hesitate when they do not understand what they are approving, so the firms that get the highest connection rates are the ones that explain, in plain words, that no password is shared, that access is read-only, and that it can be switched off. You can reuse the language on this page in your own flow. The reassurance is accurate, which is why it works.
How Credit Canary does it
Credit Canary delivers open banking through an FCA-authorised provider, with the bank handling authentication and the customer in control of consent throughout. You get verified data and approved payments, with the security and complaints framework of a regulated service, and without ever touching a customer's credentials.
Common questions
Can a provider take money from my account through open banking?
Only a payment the customer has approved, for the amount they approved. Account information access is read-only and cannot move money. A payment needs separate consent and strong customer authentication at the bank.
Does open banking share my bank login or password?
No. The customer authenticates with their own bank, and the login is never shown to or stored by the provider. This is the core reason open banking is safer than screen scraping.
Can I stop sharing my data later?
Yes. The customer can withdraw access at any time, both with the provider and in their own banking app. Ongoing access also has to be reconfirmed periodically.
Who do I complain to if something goes wrong?
Providers are authorised and regulated by the FCA, and eligible complaints can go to the Financial Ombudsman Service. Unauthorised payments are covered by the protections in the Payment Services Regulations 2017.
Related pages
Primary sources
- Payment Services Regulations 2017, SI 2017/752 (checked 14 Oct 2026).
- Delegated Regulation (EU) 2018/389 (SCA RTS) (checked 14 Oct 2026).
- openbanking.org.uk, What is open banking (checked 14 Oct 2026).
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.