Is it safe to give a lender your bank login? Screen scraping vs open banking, explained

You’re halfway through a loan application. The lender sends a link to “verify your bank statements”, you pick your bank, and a box asks for your internet banking username and password. Should you type them in?

Short answer: it’s common and usually works fine, but it’s the riskier of two ways to share your data. Know which one you’re looking at before you type anything. The check takes about 30 seconds, and the safer option rarely costs you any time.

Two tools that look almost the same

Lenders read bank statements in one of two ways. On a phone screen they look nearly identical, but underneath they’re very different.

	Screen scraping (credential-based)	Open banking (Consumer Data Right)
Where you log in	A form on the provider’s page	Your own bank’s site or app
What’s handed over	Your username and password	A consent you approve inside your bank
What the service can access	Whatever your login can see	Only the data and accounts you select
Can it move money?	It’s built to read, but the login itself has no such limit	No, it’s read-only by design
How long it lasts	Until you change your password, or as the provider’s terms allow	Up to 12 months, and you can stop it any time
Who regulates it	General privacy law and the provider’s own terms	The CDR rules, ACCC accreditation and OAIC oversight

Screen scraping means a third-party service takes your login, signs in to your internet banking as if it were you and copies the transactions. Treasury’s 2023 discussion paper describes the practice as “inconsistent with cyber security advice”.

Open banking under the Consumer Data Right (CDR) works the other way round. The OAIC’s guide to how the CDR opt-in process works explains that you choose what to share, consent expires after 12 months, and you can stop sharing at any time through a dashboard. Your password stays with your bank.

Both tools get your data to a lender in minutes. That’s why both are used, and why owners often don’t notice which one they’ve been given. Our page on bank-statement links covers what the lender reads once the data arrives.

The 30-second check: which one is this?

Before you type a single character, look at three things.

1. Where does the login box sit? If the link sends you on to your bank’s own website or opens your banking app, that’s open banking. If a form on the provider’s page asks for your bank username and password, often with your bank’s logo shown inside it, that’s screen scraping.
2. What does the consent screen promise? A CDR consent names the accredited recipient, lists the data types (say, transaction details and balances), states how long sharing lasts and explains how to withdraw it. A vague “I agree to the terms” tick box is a sign it’s something else.
3. Can you check the recipient? Anyone collecting data through the CDR has to be accredited, or working under someone who is. You can look them up on the government’s find a provider page.

If the link asks for a one-time security code from your bank and your password on the same third-party form, that’s still screen scraping. The service is just passing the code through to log in as you.

What do your bank’s terms say about sharing your password?

This is the part most owners never think about, and it matters more for business accounts than personal ones.

The ePayments Code doesn’t cover your business account. ASIC’s ePayments Code is the voluntary code most banks sign up to. It sets out who pays when an unauthorised transaction hits an account. In its 2022 update, ASIC dropped a proposal to extend those protections to small business, so the Code still protects individuals only. Business accounts fall back on whatever your bank’s business terms say.

Under the Code, sharing a passcode can shift liability. ASIC’s Report 718 confirmed that the Code’s passcode security rules mean users shouldn’t disclose passcodes to anyone. A consumer who does can carry the loss for an unauthorised transaction if the bank shows the disclosure contributed to it. For business accounts, bank terms usually go at least as far.

What it means in practice. If a reputable scraping service does a one-off read and nothing goes wrong, nobody notices. But if your account is ever compromised, having typed your password into a third-party site gives the bank an obvious argument. On a company account holding next month’s wages and BAS money, that’s a real exposure. Check the security clauses in your own business banking terms; it’s a five-minute read.

Is screen scraping being banned?

Not yet. The CDR statutory review recommended banning screen scraping where open banking is a viable alternative. Treasury’s screen scraping consultation drew 44 submissions, and the industry split. Some financial services bodies backed a ban, while fintech and data-sharing groups argued that open banking isn’t yet good enough to replace scraping everywhere. The debate has carried on into 2026 without a ban starting.

So for now, both methods are legal. The choice falls to you and your lender.

Why lenders still use screen scraping

It isn’t always a red flag. Lenders use scraping because it fills gaps:

• Company accounts that aren’t set up for open banking. A Pty Ltd can’t share through the CDR until the bank has a nominated representative on file. Our guide to setting up a nominated representative explains the 10-minute fix.
• Banks or account types with patchy CDR data. Some smaller institutions and separate business banking platforms don’t return clean data through open banking yet.
• Speed at 9 pm. Scraping works with any login that works, so it’s the path of least resistance when an owner wants an answer tonight.

None of that means you have to use it. It means you should ask.

Want a specialist to work out which data route suits your accounts before anything gets sent? Check your options here. Asking doesn’t touch your credit file.

The safer way to share your data, step by step

Step 1 of 4: Ask for open banking first. Reply to the lender or broker: “Can I share my statements through open banking instead?” Most lenders that use scraping tools also support CDR consent, often through the same provider.

Step 2 of 4: Get your business accounts ready. If you bank as a company, partnership or corporate trustee, check you’re a nominated representative before the link arrives. Without one, your business accounts simply won’t appear.

Step 3 of 4: If you do use a scraping link, limit the damage.

• Only use the link the lender or broker sends, never one from a search result or an unexpected text.
• Confirm the business’s name and ABN first.
• Share only the accounts the lender needs.
• Once the lender confirms it has your data, change your internet banking password.
• Never read your password or a security code to a person over the phone. No genuine lender needs that.

Step 4 of 4: Fall back to downloaded statements. If neither link suits you, download official PDF statements directly from your online banking, covering the exact period the lender asks for, with every page. It’s slower to verify but perfectly acceptable.

Does the safer route slow your loan down?

Barely. Open banking and scraping both deliver data in minutes. The only real delay comes when a company account has no nominated representative, and you can fix that well before you need finance. The Speed Readiness Check flags it along with the other usual hold-ups.

Data is only one stage, though. Once the file is complete, $20k to $250k is possible same day for property-secured loans, up to $5m is possible within 24–48 hours, and same-day funding is possible for smaller unsecured amounts. Title, valuations, payout figures and signatures all take their own time; our page on what still takes time breaks that down.

An illustrative example

Illustrative only. A landscaping business near Toowoomba, run through a Pty Ltd, needs about $40k for a second skid steer before the spring rush. The owner gets a statement link at night and is asked for her internet banking password. Her company account also holds the money set aside for October BAS, and she hesitates.

She texts the broker to ask for open banking. The broker resends the link with the CDR option, and her business accounts don’t appear because no nominated representative is on file. Her bank lets an administrator switch it on in online banking, so she does that in a few minutes and approves read-only sharing for the trading account only. The lender has the data that night, and the file moves the next morning with her password never leaving her bank.

Protect your data, then find out what’s possible

Owners who stop to ask how their data is being collected are usually the ones whose applications go smoothly. They know their accounts, their access and their numbers. If you’re weighing up a purchase, a big order or a tax bill and want to see what funding could look like, the next step is easy.

The enquiry takes around 60 seconds, and your credit file isn’t touched just for asking. We don’t send your details to a pile of lenders. They stay with one specialist, so you won’t spend the week fielding calls from strangers. A real person reads what you’ve sent, thinks about your situation and calls you, and they can tell you up front whether open banking or another route will work best for your accounts.

Please fill in the form accurately, especially your entity type, turnover and how long you’ve traded. Accurate details mean we can match you with the right option first time.

Find out where you stand →