# Is it safe to connect your bank to an app?

> What a regulated Open Banking connection can and cannot do, who is on the other end of it, and the questions actually worth asking before you approve one.

Source: https://trybica.com/guides/is-open-banking-safe/
Updated: 2026-08-18

---

The hesitation is reasonable. Handing an app access to your bank account feels like it ought to be a bigger decision than a two-minute redirect makes it look, and "it's regulated" is the kind of reassurance that reassures nobody in particular.

So it is worth being precise about what the connection actually is, because the honest answer is more specific — and more limited — than either the marketing or the worry suggests.

## Your bank login never reaches the app

This is the part most people assume wrongly. When you connect an account, you are not typing your banking credentials into the app. You are sent to your own bank's login screen, you authenticate there exactly as you always do, including the usual second factor, and you approve the connection at your bank.

The app never sees your password, never receives it, and has nothing to store. What it gets back is a consent token: permission your bank issued to read specific accounts.

If any tool ever asks you to type your bank password into its own form, that is not Open Banking, and the answer is no.

## Read-only is a permission, not a promise

Under PSD2, reading account information and initiating payments are two separate permissions. They are authorised separately and held separately. A tool that reads your transactions does not hold the payment permission, which means moving money is not something it is choosing not to do — it is something the access it holds cannot express.

That distinction matters because it survives the worst case. "We would never move your money" depends on the company keeping its word and its systems intact. "The access does not include moving money" does not.

## Who is actually on the other end

Access is not granted to anyone who asks. The party reading your accounts has to be licensed and supervised by a financial regulator — Banco de Portugal for firms based here, an equivalent authority elsewhere in the EU — under obligations that exist whether or not the app is any good.

Two practical consequences. Your bank keeps a list of the connections you have approved, in its own app, and can revoke any of them without involving the app at all. And the consent expires on its own schedule, so you re-approve every few months rather than granting something permanent. Both of these are constraints on the app, not features of it.

## What could still go wrong

An honest version of this article does not stop at the reassuring part.

- **The app itself can be breached.** It cannot move your money, but it holds a detailed record of where you shop, when, and for how much. That is genuinely sensitive, and encryption at rest is the minimum you should expect.
- **The data can be sold.** This is the real risk in the category, and it has nothing to do with Open Banking. A free finance app is monetising something, and a transaction history is a remarkably complete picture of a person's life. This one is worth reading the privacy policy for.
- **Your own account can be compromised.** A unique password and a secure email address protect the app account in front of the data. Password resets go to your email, which makes it the key to everything else.

## The question worth asking instead

"Is it safe" is not quite the right question, because it has no useful answer. The connection is read-only, regulated, revocable at your bank, and expiring by default — those are the strongest guarantees available in consumer finance, and they are the same for every licensed app.

What actually varies between tools is what happens to your data afterwards. So the questions that separate them are: what is the business model, is the data sold or shared, is it encrypted at rest, can you export everything, and can you delete your account completely rather than merely deactivating it.

Bica's own answers are in [security](/docs/security/) and [bank sync](/docs/bank-sync/), and the short version is that the subscription is the entire business model, which is what keeps your transaction history off the market.