Bank apps share too much data: Consumer Reports

Banks need to work on the transparency of their apps, especially when it comes to data sharing and user control of targeted advertising. 

This is one of the findings to emerge from Consumer Reports’ recent evaluation of 10 banking apps for fair and safe consumer practices. The nonprofit covered traditional banks (Bank of America, Capital One, JPMorgan Chase, U.S. Bank and Wells Fargo), online banks (Ally Financial and Varo) and neobanks (Albert, Chime, Current). This report follows the organization’s deep dives into peer-to-peer payments and buy now/pay later, all part of its initiative, which was announced in 2021, to test and rate digital finance products and services with the same scrutiny that it applies to other products.

The report has made an impact: The methodology notes that all but Wells Fargo agreed to discuss Consumer Reports’ findings and that Albert, Ally, Chase, Chime and Current made or are making adjustments in response. 

The financial institutions covered “have been quite receptive to our feedback,” said Delicia Hand, financial fairness director at Consumer Reports.

Consumer Reports’ analysts found that banks share customer data beyond what they consider necessary to use the app’s core services, and don’t always let consumers use the app to control how they are targeted, such as by turning off advertising. 

“Most consumers would not be surprised that their data is used to improve the product within the company or to market new products to them,” said Hand. “Beyond this, especially for marketing with third parties or advertising purposes outside of that specific banking service ecosystem, is what we flagged as concerning and not necessary to use the service.”  

In its review of the 10 banking apps, CR found that almost all use data beyond “what is necessary” to provide the service, including sharing data with marketing partners. 

A survey that CR conducted in December of about 2,000 U.S. adults found that 57% of Americans with bank accounts are somewhat or very concerned that banks may share their data with other companies without letting them know. Further, 76% of those surveyed feel it is very important that banks get their permission to share their banking data with another company, while 69% feel the same about limiting the purposes for which banks can share their data with another company. Yet only half of the apps CR evaluated provided an in-app control to turn off targeted advertising.

The ideal, said Hand, “is you download the bank app and as part of the onboarding process there is a privacy module that lets you know how we share your information and what you can do about it, that is simple and clear.”

However, Jim Perry, senior strategist at Market Insights, wonders if consumers think about these issues in the same way.

“Despite the industry conversations around the Consumer Financial Protection Bureau’s proposed rule to implement section 1033 of Dodd-Frank, most consumers love the benefits that data sharing allows,” he said. “Consumers simply want to stop the tsunami of unsolicited advertising.”

CR also took issue with the lack of a clear commitment to real-time fraud monitoring and notifying users of suspicious activities. It found six of the apps studied explicitly commit to monitoring transactions for fraud in real time, while two make no such commitment and another two commit to real-time alerts only. 

“Our engagement with companies revealed that while robust real-time fraud-monitoring practices may in fact be in place, that is not sufficiently reflected in most company documentation,” says the report. It noted that Chime and Current shared more information publicly through trust and safety blogs after speaking with CR. 

“We think explicit public commitment holds companies more accountable,” said Hand.

Three of the apps studied do not publish consumer education about fraud and scams in their apps, even though all do so on their websites — although the report notes that Ally will launch such content by the end of the month.

“The persistent stream of stories about fraud will eventually make the issue of real-time fraud monitoring to be a must-have functionality in order to be perceived as truly looking out for consumer safety and security,” said Perry.

The report also evaluated accessibility features within the apps, including built-in functionality to accommodate vision and hearing impairments and availability to people who speak Spanish. 

“Much more can be done in this area,” the report concluded.

In terms of accessibility, CR found that most banking service providers it studied met baseline accessibility standards on their websites, but few of them carried over such functionality to the app, beyond ensuring compatibility with operating system features such as screen readers. CR also observed a divergence between traditional banks, which all made their apps available in Spanish, and the digital banking providers, which did not offer the same. 

“This is particularly notable since many of the neobanks or digital-only banking services claim to focus on the needs of underserved communities,” said Hand.

After looking at the findings, Sharon Garcia, director of communications for the National Association for Latino Community Asset Builders, or NALCAB, said, “It makes good business sense for banks to prioritize inclusivity and accessibility for Latinos and Spanish-speaking immigrants, as they constitute one of the largest and most powerful consumer groups in the country. In addition, Latino consumers are loyal to brands and companies that target them authentically, respecting their culture and language.”