It's the moment everyone hesitates: a finance app asks you to connect your bank account, and you wonder — is this actually safe? Can this app move my money?
Short answer: connections through modern aggregators like Plaid are read-only — the app can see balances and transactions, but it cannot move money, and with most major banks it never sees your password. Here's how it actually works, what the real risks are, and how to link accounts safely.
How bank connections actually work
Apps like NetTrack, Monarch, and Copilot don't connect to your bank directly. They use an aggregator — most commonly Plaid, which connects to over 12,000 institutions and is used by apps like Venmo, Chime, and Robinhood.
When you link an account, one of two things happens:
-
OAuth (most major banks today): You're redirected to your bank's own login page — Chase, Bank of America, Wells Fargo, Capital One, and most large institutions work this way now. You log in at your bank, approve specific access, and the bank hands the app a limited token. The app never sees your password. You can revoke the token any time from your bank's security settings.
-
Credential-based (some smaller institutions): For banks without OAuth, Plaid securely passes your credentials to establish the connection. Credentials are encrypted in transit and are Plaid's to protect under bank-partnership security standards — the finance app itself still never stores your banking password.
What a linked app can and cannot do
Can:
- Read account balances
- Read transaction history
- Read investment holdings and positions
Cannot:
- Move, send, or withdraw money
- Make trades
- Open accounts or take out credit
- See your card PIN or full account credentials (OAuth connections)
Read-only access is the whole design. Even in a worst-case breach of a tracking app, the data exposed is information about your accounts — serious, but not the ability to drain them.
The real risks (and how to judge an app)
The honest risk isn't theft from your bank — it's data handling. Before linking, check that an app:
- Uses a major aggregator (Plaid, Finicity, MX) rather than storing bank credentials itself
- Encrypts data in transit and at rest (bank-level / AES-256 is the standard claim to look for)
- Doesn't sell your data — read the privacy policy's sharing section
- Makes money transparently — subscription apps have no incentive to monetize your data; "free" apps deserve more scrutiny
- Lets you delete your data — disconnecting should mean deletion, not dormancy
NetTrack checks all of these: Plaid-powered read-only connections, encrypted storage, a subscription business model with no data selling, and full account deletion on request.
Are you liable if something goes wrong?
US regulators treat aggregator connections as normal consumer behavior, and Regulation E protections for unauthorized transfers still apply to your bank accounts. Banks historically grumbled about credential sharing, but OAuth connections are explicitly bank-sanctioned — that's why the banks built them.
How to link accounts safely: a checklist
- Prefer apps using Plaid or another major aggregator.
- Use OAuth when offered (you'll recognize it — you log in on your bank's own page).
- Turn on two-factor authentication at your bank.
- Review connected apps in your bank's security settings once or twice a year, and revoke anything you no longer use.
- When you stop using an app, disconnect accounts and delete your account in the app.
Frequently asked questions
Can a net worth app steal my money?
No. Aggregator connections are read-only. Moving money requires separate payment authorization that tracking apps don't have.
Is Plaid itself safe?
Plaid is one of the most heavily audited pieces of financial infrastructure in the US, used by thousands of apps and most major fintechs. No system is risk-free, but Plaid connections are dramatically safer than the alternative people fall back to — spreadsheets fed by manually downloaded bank files, or shared passwords.
Does linking accounts affect my credit score?
No. Reading balances and transactions involves no credit inquiry.
What happens when I disconnect an account?
The token is revoked and the app stops receiving data. In NetTrack, you can also delete the historical data or your entire account.
Want the full picture of your money without the worry? NetTrack uses read-only, bank-sanctioned connections to track your net worth automatically. Start free.