Oaken - is Flinks to be trusted?? | Page 2 | Oaken Financial | Discussion forum

There have been a lot of concerns expressed in these forums about Flinks and Plaid and possible security issues that could arise from their use.

However, I do not recall anyone reporting any actual security breach. Am I wrong?

Wrayzor said
I'm one who has expressed concern. To my knowledge (and aided by Mr. Google), no security breaches have been publicly reported.

Plaid did settle a class action lawsuit in the US for violating users' privacy by scraping and selling their data. Not exactly confidence building behaviour.  

I'm OK with Flinks because the use of your login credentials is simply for the the initial linkage setup so, one can change that password once the link is established.

Plaid with "permanent" login credentials retention is not something I would want to enable.

Ok with using FLINKS? Here is what you need to know - taken from their "Privacy Statement".....talk about a misnomer!

Types of Personal Information We Process
Flinks processes three types of personal information when it provides its services to its clients:

Information you provide. When you connect your financial account(s), you will provide your login information required by your financial institution to access your account. Typically, this consists of a username and password, but it could also include answers to challenge questions (e.g., a family member's name or maiden name, street you grew up on), or a security token (e.g., multi-factor authentication code or one-time pad (OTP)). Information you provide may also consist of digital copies of bank statements, cheques, or other financial documents where you are sharing these types of documents through Flinks Connectivity with one of our clients.

Information obtained from your financial institution. When Flinks connects to your financial account for the purposes of our clients' services, we retrieve information from such financial institution that maintains the account(s). The information we retrieve may vary depending on:

The information required by our client in order to power their service; and
The information made available by your financial institution.
Information from your payroll or paystub provider. In addition to the ability to connect to your financial institution through our Connectivity Service, Flinks also has the ability to connect to your payroll or paystub provider. This allows Flinks to provide its clients with an up-to-date picture of your sources of income in addition to what is available from your financial institution.

Regardless of the types of information our clients require, the types of information we collect from your financial institutions will include, without limitation:

Account information (e.g., financial institution name, account name, account type, and account and routing number);
Information about an account balance (e.g., current and available balance);
Information about credit accounts, (e.g., statement due dates and balances owed, payment amounts and dates, transaction history, and interest);
Information about loan accounts (e.g., including due dates, balances, payment amounts and dates, interest, loan type, payment plan, and term);
Information about the account owner(s) (e.g., name, email address, phone number, and address information); and
Information about account transactions (e.g., amount, date, type, and a description of the transaction).

Information from your devices. Our technology is integrated into our clients' applications. Thus, when you use one of your devices to connect with a client service, we may receive information about this device, including without limitation the IP address, hardware model, operating system, and other technical information about the device. We may also use cookies or similar tracking technologies to collect usage statistics and to help us improve our services.

Notwithstanding my reluctance, along with many others, I used Flinks to add my Simplii Savings acct. to Oaken, as I wanted to be able to transfer directly into Savings.

I believe I have read (this site likely) that when transferring into Chequing, the resulting Hold freezes the funds in Chequing, @ .01%, as Simplii will not allow transfer into Savings until Hold period is completed ( I stand to be corrected on this).

In any event, all my Simplii accounts were available to be linked, and everything went smoothly. Even though Oaken indicated the linking may take up to 2 days, the link was available same day, and money arrived at destination next day.

I also changed my Simplii password immediately, as suggested by others.

There's no hold on funds arriving at Simplii when the funds are sent or pushed from Oaken or any other bank.

Funds sent/pushed are transferred by direct deposit, just like one's payroll and CRA automatic deposits.

Norman1 said
There's no hold on funds arriving at Simplii when the funds are sent or pushed from Oaken or any other bank.

Funds sent/pushed are transferred by direct deposit, just like one's payroll and CRA automatic deposits.  

If only we could set links to Oaken so that we could push funds to Oaken ...

Dean said
.
Like many others, I'm always a bit leery when using Flinks, but in the end I've never had a problem with it. So many FIs are using it now, it's almost an industry standard.

So the question begs to be asked . . .
Where is the 'Hard Documented Evidence' that Flinks is not secure,
and is dangerous to use❓
.
Dean  

Same here. I've used it a number of times. I still have everything I know I should have.

I've seen the bad press here. Some don't trust it. I've asked why. No real answer.

All I can figure is that it can't be good because we don't know why it's not bad. AKA a fear of the new.

This may or may not be a real answer - my rationale for avoiding Flinks (and others like them) is:

- I don't know what information they are gathering when they scrape financial and personal data
- I don't know what they are doing with the information collected
- using Flinks violates the terms of service set out by the bank*

None of this makes Flinks a bad service. To me it is a personal choice to avoid risk that I don't need to take as there are numerous other options for linking accounts.

I've seen no hard evidence that Flinks isn't secure (unlike Plaid). Still doesn't change my own risk assessment.

*CIBC even calls out the risk in their linking terms document:

"If you enter your Log-In Credentials on the Flinks platform, you may lose the protection your External Financial Institution offers to you against unauthorized transactions. This means you may be liable for losses resulting from unauthorized transactions in your External Account or for any changes to the products and services you receive from your External Financial Institution."

https://www.cibc.com/content/d.....rms-en.pdf

Wrayzor said

*CIBC even calls out the risk in their linking terms document:

"If you enter your Log-In Credentials on the Flinks platform, you may lose the protection your External Financial Institution offers to you against unauthorized transactions. This means you may be liable for losses resulting from unauthorized transactions in your External Account or for any changes to the products and services you receive from your External Financial Institution."

https://www.cibc.com/content/d.....en.pdf  

I think CIBC is probably more interested in protecting CIBC from any liability. A systems/informatics expert who I know well told me a while ago that he doesn't consider online banking truly secure (and avoids it when possible). So perhaps Flinks may not hold any more risk than general use of online banking.