Before regulated data sharing, an app that displayed bank balances did so by logging into the bank as the customer, using credentials the customer had handed over. The replacement of that practice reshaped consumer fintech.
How scraping worked
The customer supplied their online banking username and password to a third party, which stored them and used them to log in on a schedule.
Once logged in, the software read the pages a human would see and extracted balances and transactions from the layout of those pages.
Nothing about the arrangement was designed. It was an adaptation to the absence of any sanctioned route to the same data.
Why the arrangement was fragile
Scraping depended on the bank's pages staying the same. Any redesign broke the extraction, often silently, leaving stale data displayed as current.
Access was also all or nothing. Credentials that permit reading a balance permit everything else the customer can do, including moving money.
Security measures created a further conflict, because additional authentication steps designed to stop unauthorised logins also blocked the legitimate scraper.
What the regulated interfaces changed
Open banking rules require banks to expose defined interfaces through which authorised third parties can request data with the customer's explicit consent.
The customer authenticates with their bank directly, and the third party never sees the credentials. It receives a token limited to specified data for a limited period.
Consent is scoped and revocable. A customer can see which parties have access and withdraw it from the bank's own interface.
Why it altered the competitive picture
Data access stopped being a technical capability that favoured firms willing to maintain scrapers and became a licensed permission available to any authorised provider.
That lowered the barrier to building account aggregation, affordability assessment and automated savings tools, which is why those categories expanded quickly.
It also made banks into infrastructure providers for competitors, a position most did not choose and which shaped their response.
Where the model remains uneven
Implementation quality varies. Interfaces differ in reliability, in how much history they return, and in how often re-authentication is demanded.
Re-consent requirements interrupt services periodically, which is a deliberate protection that also causes connections to lapse without the customer noticing.
Coverage differs sharply by country, since some markets mandated the interfaces and others left them to industry, producing very different results.