Are budgeting apps and open banking connections safe to use?

Open banking was designed to replace the genuinely unsafe practice of handing your banking password to a third party. Under it, you authorise access through your own bank, the app never sees your credentials, and the permission is time-limited and revocable. The remaining risks are real but different: unregulated apps, over-broad permissions, and what happens to the data afterwards.

Step by step

1. Check the provider on the FCA register.Account information services and payment initiation services must be authorised or registered. Search the firm name on the FCA register before connecting anything.
2. Understand what access you are granting.Account information access is read-only — balances and transactions. Payment initiation is separate and lets the app start payments. They are authorised separately and you should know which you are agreeing to.
3. Never type your banking password into an app.A genuine open banking connection redirects you to your own bank's app or website to approve. Anything that asks for your credentials directly is either outdated screen-scraping or a scam.
4. Read what the consent screen actually says.Your bank shows which accounts, what data and for how long. This is the moment to check it, not afterwards.
5. Know that access expires.Consent runs for a limited period and must be renewed. That expiry is a feature — it means a forgotten app stops seeing your data.
6. Check what the app does with the data.Read the privacy policy for whether data is shared with third parties or used for marketing. A free app is being paid somehow.
7. Review connected apps in your bank's app.Banks list active open banking connections and let you revoke them. Look at that list twice a year.
8. Be sceptical of anything promising to fix your credit score.There is no legitimate way to remove accurate information from a credit file. Apps promising it are selling something else.
9. Keep two-factor authentication on your bank account.Open banking sits on top of your bank's own security. That security is the foundation and it should be as strong as the bank offers.

Tips

• Revoking access is done in your bank's app, not the third party's. That is deliberate — the control stays with you.
• If an app asks for your banking password rather than redirecting you to the bank, stop. That single test rules out most bad actors.
• A budgeting app is only useful if you look at it. Consider whether a simple monthly review of your own statements would do the same job.

Common mistakes

• Connecting without checking the FCA register — Anyone can build an app that looks like a budgeting tool. The register is the only way to confirm it is a regulated provider.
• Leaving old connections active — Apps you stopped using retain access until consent expires or you revoke it, and their security is no longer something you are watching.

If it doesn't work

Questions people ask