No. In Australia a budgeting app can get your transactions three ways: through Open Banking under the Consumer Data Right, where you approve it at your bank and hand over no password; by logging in as you with your bank password (screen scraping); or from you, typed in or imported from a statement. We build Tobsy, a spending tracker that takes the third way, so we read the rules on all three closely, and this is what they say.
Only the second way needs your bank login. The first is the government-run system built so that you do not have to share it, and the third does not touch your bank at all.
The three ways, side by side
| Open Banking (the CDR) | Screen scraping with your login | You enter or import them | |
|---|---|---|---|
| What you give the app | Your consent, then a one-time code at your own bank | Your internet banking customer ID and password | Nothing from your bank. A statement file or a screenshot, if you choose |
| Who can do it | Only providers accredited by the ACCC | Any app that asks | Any app or spreadsheet |
| What it can see | The data you pick, for the time you agree, 12 months at most | Whatever your login can see: the account, plus your name, address and other details | Only the rows you type or import |
| How you stop it | Withdraw consent in the app's dashboard or at your bank | Change your banking password | Stop typing. Delete the file |
| If something goes wrong | The CDR privacy safeguards, complaints to the business then AFCA or the OAIC | Your bank's ePayments Code terms on passcodes apply (see below) | Nothing connected to your bank to go wrong |
| Upkeep | Give consent again when it runs out | Re-enter the login when you change your password | As complete as you keep it |
Way one: Open Banking, under the Consumer Data Right
Open Banking is the banking part of the Consumer Data Right (CDR), set up by the Australian Government and regulated by the ACCC and the OAIC. It is opt-in: nobody's data moves unless they choose it.
The flow is short. On the app's website or in the app, you give consent. Your own bank then checks it is you with a one-time password, and you confirm at your bank which data you want to share. The data moves between the two providers by API, a machine-to-machine connection, so the app does not see your banking password.
Before you agree, the provider has to tell you what data you are sharing and how it will be used, who will have access to it, how long they will have it, and how to manage and withdraw your consent. A consent lasts 12 months at most and then expires, so a feed that has been running for a year asks you again.
Stopping is meant to be easy. An accredited data recipient has to give you a consumer dashboard where you can see and withdraw your consents, and you can also manage what you share from your bank's side. You can ask for the data to be deleted or de-identified when it is no longer needed.
One check worth doing first: only providers accredited by the ACCC can offer a CDR service, and the Find a provider register on cdr.gov.au lists them.
Way two: screen scraping with your bank login
Screen scraping is the older method. You type your internet banking customer ID and password into the app, and the app (or a data company working for it) logs in to your bank as you and reads what is on the screen.
It works. The concerns are about what a login gives away. Commonwealth Bank's guidance says a third party with your NetBank logon could see "everything in your account, including your name, address, and other personal information", and it suggests Open Banking or a CSV export instead. Treasury's 2023 consultation on screen scraping says sharing login details "is inconsistent with cyber security advice" and asked whether to ban the practice where the CDR is a workable alternative. That consultation closed in October 2023, and its page names no final decision.
What the ePayments Code says about passwords
Most Australian banks subscribe to the ePayments Code, which sets the rules for who carries the loss when an unauthorised transaction happens. It is a voluntary code; the current version took effect on 2 June 2022.
Clause 12.2 says a user must not "voluntarily disclose one or more passcodes to anyone, including a family member or friend". There are exceptions where the bank itself authorises or promotes a service (clauses 12.8 and 12.9), for example an aggregator the bank offers.
That does not mean a scraping app makes you liable for any loss. The Code is explicit: "A breach of the passcode security requirements in itself is not sufficient to make a consumer liable." The bank has to show, on the balance of probability, that the breach contributed to the loss. So the fair summary is this: sharing your login breaks the Code's passcode rules unless your bank authorised the service, and it weakens your position if something goes wrong. It is a reason to prefer the CDR, not a reason to panic if you have done it.
If you have shared a login and want to stop, change your internet banking password. CommBank's guidance says that ends the third party's access.
Way three: you enter or import them yourself
The third way skips the connection. You type a purchase in when you make it, or you download a CSV statement from your bank and import it, or (in some apps) you drop in a screenshot of your banking app.
What the app knows is exactly what you gave it. There is no consent to renew and no login to change. The cost is your time, and the record is as complete as you keep it. A statement import is the catch-up: a month of rows in one go, checked before they go in.
A worked example: one person, one year
Here is the upkeep for one person with a transaction account and a credit card, using each method for twelve months.
| Open Banking | Screen scraping | Enter or import | |
|---|---|---|---|
| Set-up | Consent once per bank, under two minutes each | Type each bank login into the app | None at the bank |
| During the year | Check categories on new rows | Re-enter the login after a password change | A few taps per purchase, or one statement import a month |
| At month 12 | Consent expires; give it again | Carries on while the login works | Carries on |
| To stop | Withdraw in the dashboard | Change two passwords | Stop |
Neither column is free of work. Feeds still get a look: pending rows can lag or appear twice, and automatic categories need checking, so most people cross-check against their statement either way.
When a feed is the better fit
If you want every account to update without you, and you are happy to approve access at your bank, an app accredited under the CDR is a legitimate choice, and it is the one the system was built for. It suits someone with many accounts, a business with a bookkeeper, or anyone who will not type purchases in. If an app you like asks for your banking password, ask whether it offers a CDR connection instead.
Questions
Is it safe to link my bank account to a budgeting app in Australia?
Under the Consumer Data Right, the app is accredited by the ACCC, you approve the sharing at your own bank with a one-time password, and the app does not receive your banking password. Consent lasts 12 months at most and you can withdraw it from a dashboard. That is the method the government built for this.
Is Open Banking the same as giving an app my password?
No. With Open Banking you give consent and confirm at your bank; the data moves by API between accredited providers. Screen scraping is the method where you give the app your login so it can sign in as you.
How long does CDR consent last, and how do I stop it?
A consent lasts 12 months at most and then expires. You can withdraw it before then in the provider's consumer dashboard or by managing your sharing at your bank, and you can ask for your data to be deleted or de-identified.
Will my bank refuse to cover a loss if I shared my password?
Not automatically. The ePayments Code says a breach of the passcode rules is not enough by itself; the bank has to show it contributed to the loss. Sharing a password breaches the Code's passcode rules unless your bank authorised the service, so it can weaken your position.
Can I track spending without connecting my bank at all?
Yes. You can type purchases in, or download a CSV statement from your internet banking and import it into an app or a spreadsheet. Nothing connects to your bank, and nothing needs renewing.
Sources
- Consumer Data Right: How it works — consent on the provider's site, identity check by one-time password at your existing provider, confirm the data at your provider, transfer by API; read 2026-10-19
- Consumer Data Right: Your rights — opt-in, the four things a provider must tell you, the privacy safeguards, complaints to the business then AFCA or the OAIC; read 2026-10-19
- Consumer Data Right: What is CDR? — opt-in, accreditation managed by the ACCC, live in banking and energy; read 2026-10-19
- Consumer Data Right: Find a provider — the register of accredited data recipients and data holders; read 2026-10-19
- OAIC: Managing your CDR data — "You can stop sharing your data at any time", consent "expires after 12 months", the consumer dashboard, deletion or de-identification; read 2026-10-19
- OAIC: Consumer consent and authorisation — collection period up to a maximum of 12 months; the dashboard must let a consumer withdraw consent; read 2026-10-19
- ASIC: ePayments Code — "presently a voluntary code of practice", subscribed to by most banks; read 2026-10-19
- ASIC: ePayments Code, June 2022 (PDF) — clause 11.2 and its note, clause 12.2(a), exceptions in 12.8 and 12.9, effective 2 June 2022; read 2026-10-19
- Treasury: Screen scraping, policy and regulatory implications — sharing login details "is inconsistent with cyber security advice"; consultation 30 August to 25 October 2023; read 2026-10-19
- CommBank: Risks of sharing your password with a third party app or service — what a third party can see, Open Banking and CSV export as alternatives, change your password to stop access; read 2026-10-19
Pass it on