Partners

SMEs exposed to liability through disclosing their bank account details

Research commissioned by BankLink highlights data security risks to New Zealand businesses.

While 83% of New Zealand small businesses report they are not comfortable disclosing their bank account passwords and logins details to third parties, many are willingly handing this confidential information over to save time when it comes to their accounting – exposing themselves to potential financial liability.

For some New Zealand SMEs, the quickest way to have their transactions supplied into their accounting solution requires them to provide sensitive information, including their bank account login details, to a third party data aggregator.

While data aggregation speeds up their accounting by removing the need for most manual data entry, there are risks associated with the practice if the third party aggregator uses ‘screen-scraping’ techniques which require the SME’s confidential details to be disclosed.

Screen-scraping involves accessing data via the business owner’s internet banking account, copying their transaction data and sending it to their accounting software provider.

If businesses have willingly disclosed their bank account password and login details they are at risk of being personally liable for any potential fraud made by any party – even if the fraud is not directly related to the third party data aggregator.

Richard Reese, BankLink General Manager of Operations, the leading accounting solutions company that carried out the research*, says, “the implications of sharing password and login details are well understood on a personal level, but some SMEs seem to be letting their guard down when it comes to their business.”

“SMEs need to be aware how their transactions are being obtained, and should be extremely cautious about disclosing their private bank details to any third party. It’s about taking necessary precautions to protect your business from potential risks and exposure to significant liability.”

Reese continued: “SMEs and accountants should be alert to ask questions when considering different accounting solutions. While screen scraping provides one method for automating how their transactions are supplied, they need to be aware that there are much safer alternatives available which provide these same benefits without the potential risks. Those using solutions where data is supplied by third party aggregators may also not be aware of the techniques used to collect this.”

As well as questions around security, the third party nature of the relationship between the SME and the aggregator means that the aggregator is not necessarily obliged to advise if their data collection practices change. The aggregator may also have a focus on volume and not quality, as there is no onus for them to maintain particular levels of service such as verifying the accuracy of the transactions supplied.

“Security has been BankLink’s top priority for over 25 years and we have invested a significant amount of time, money and effort in maintaining these standards and developing direct relationships with all the financial institutions we work with. We sign legal agreements with each institution, they have complete transparency about the processes we use and there are no third parties involved,” say Reese.

“Our standards of security, and the quality of the service we provide, mean that we are trusted to supply transaction data to other major accounting solutions such as MYOB.”

BankLink supplies secure ‘read-only’ transaction data via direct feeds from financial institutions so businesses can be assured that their data is always protected. The company also complies with the stringent Payment Card Industry Data Security Standard (PCI DSS) for the safe handling of transaction data and SMEs are not required to disclose their passwords at anytime.

With BankLink, transaction data is supplied under strict international security measures which meet the requirements of all the major banks. The SME has to sign an authority form with their bank giving BankLink permission to supply their transactions, which in turn gives the SME peace of mind that their important financial information is always protected.