If you use a budgeting app, a debt tracker or a financial aggregator — or any other app or program that asks you to enter your online banking username and password — then you’ve used screen-scraping, and you may have unknowingly waived your fraud protection in the process.
According to the Government of Canada, about nine million Canadians currently share their financial data this way (1). Screen-scraping is the practice of giving a third-party app your banking login credentials so it can log into your account on your behalf, copy your transaction data and store it in its own servers. For millions of Canadians, it has become a quiet routine that’s part of their financial management practice. But despite the benefits of tracking and monitoring your spending and investments, the practice carries risks that most people don’t know about — until something goes wrong.
Canada’s new consumer-driven banking framework, commonly called open banking, is designed to replace screen-scraping with a far more secure approach. The question is: when?
Don’t Miss
- A single line on your car insurance policy could be inflating your premium by up to 30% — here’s what to change
- Here are 5 ‘must-haves’ that Canadians constantly overpay for. How many of these are sabotaging your budget every single month?
- Dave Ramsey says this 1 indulgent purchase stops people from becoming wealthy. Here’s what he recommends instead
What is screen-scraping and why is it risky?
Screen-scraping is not a quirk used by obscure apps. It underlies some of the most widely used budgeting and financial management tools in Canada. The mechanics are simple: you hand over your login credentials, the app logs in as you, reads your account data by copying what appears on screen and then stores it externally.
The problem is what that means for your protection. Most Canadian banks include an online banking guarantee in their account agreements that protects you from unauthorized transactions — but only if you’ve kept your credentials private (2). Once you share your username and password with a third-party app, that protection may no longer apply. For instance, if a fintech app is hacked and your account is drained as a result, your bank may argue that you violated the terms of your account agreement. Several major Canadian banks — including those that prohibit credential sharing in their terms of service — simultaneously offer products powered by screen-scraping (3).
“Everybody should be able to understand where this information goes, who’s going to use it, and what happens when things go wrong,” explained Geoff White, executive director of the Public Interest Advocacy Centre (PIAC), a consumer protection not-for-profit (4).
Stop leaving money on the table — discover which Canadian banks are offering the biggest welcome bonuses right now.
What happens if your data is breached under the current system?
Under the current system, there is no federal framework assigning clear liability when something goes wrong with a screen-scraping connection. The app has your password. If a breach occurs, tracing accountability — and recovering losses — becomes difficult.
Canada’s Consumer-Driven Banking Act (CDBA), enacted as part of Bill C-76 (Budget Implementation Act, 2024, No. 2), which received Royal Assent in December 2024, is designed to change that. Under the new rules, liability in the event of a security breach would rest with the firm that had control of the data at the time (5).
That shift is significant: it means consumers would no longer be left to fight banks and apps over who is responsible when something goes wrong.
The specific accreditation and liability rules under the CDBA are still being finalized through regulation — which means anyone harmed by a data breach through a screen-scraping app today should contact their bank immediately and file a complaint with the Financial Consumer Agency of Canada (FCAC) at fcac-acfc.gc.ca.
Read more: 3 essential money moves to make once you’ve saved $50,000
How Canada’s open banking framework changes response and responsibility
Open banking — Canada’s preferred term is consumer-driven banking — replaces credential sharing with a secure, encrypted connection called an application programming interface (API). Rather than giving an app your password, you authorize your bank to share specific data with a specific accredited provider. You control what’s shared, with whom and for how long. And you don’t give up your password.
The Government of Canada’s framework has three goals:
- Replace risky data-sharing practices like screen-scraping
- Give Canadians legal rights over their own financial data
- Support innovation in the financial sector
That’s the problem open banking is built to solve. Under the new framework, FCAC — the federal regulator responsible for consumer protection in the financial sector — is the designated regulator for consumer-driven banking accreditation and oversight (6). The Bank of Canada’s separate role covers the broader payments ecosystem under the Retail Payment Activities Act.
Need a banking partner? From buying a home to teaching your kids about money, find the right financial partner for your next big milestone.
Timeline: When do the new rules take effect?
While the government and Canadians want open banking solutions, the timeline for when they’ll take full effect remains uncertain. The federal government aimed to launch the consumer-driven banking framework in early 2026. However, as of early 2026, the full accreditation and technical standards are still being developed under the CDBA, and the technical standards body required to set API rules has not yet been designated.
As for the prohibition on screen-scraping, it’s not intended to take effect until after the open banking framework is fully operational. In the meantime, screen-scraping remains legal and widely used.
Phase 2 of the framework — which would expand write access, allowing apps to initiate payments or switch accounts on a consumer’s behalf — is targeted for mid-2027, contingent on the launch of Canada’s Real-Time Rail payments network. Payments Canada’s Real-Time Rail has faced significant delays since its original target; that contingency means Phase 2 timing carries real uncertainty.
For now, Canadians using fintech apps should understand that the current system is not protected by the same rules that will eventually govern open banking.
What to do before open banking arrives
The regulatory solution is coming, but it isn’t here yet. In the meantime, there are practical steps Canadians can take to reduce their exposure.
- Review which apps hold your banking credentials. Log into each app you’ve connected to your bank accounts and check whether it requires your username and password. If you no longer use an app, revoke its access.
- Ask your provider directly. Ask whether the app uses screen-scraping or a secure API connection. Many established providers are moving toward API-based access.
- Read your bank’s account agreement. Understand whether sharing credentials with a third party affects your fraud protection guarantee.
- Monitor your statements regularly. Look for unauthorized transactions, especially if you have connected accounts to multiple apps.
- Know where to complain. If your data is misused today, contact your bank and file a complaint with the Financial Consumer Agency of Canada (FCAC) at fcac-acfc.gc.ca.
- Once open banking launches, use FCAC’s accredited entity registry to verify which apps are approved under the new framework before sharing data.
The new rules will eventually make the current workaround obsolete. Until then, Canadians bear the risk — and the responsibility — of knowing what they are handing over.
What To Read Next
- Here are the 5 biggest differences between rich and poor Canadians — which side do you fall on?
- This 7-step plan from Dave Ramsey is designed to help you ditch debt, save more and build wealth — here’s how it works
- Need to stretch your dollars this month? Copy these 7 shopping habits that are actually saving Canadians money
- Gold still crashing!’: Robert Kiyosaki admits he was wrong — but doubles down on his $35K prediction
Join 19,000+ readers and get Money.ca’s best stories and exclusive interviews first — clear insights curated and delivered weekly. Subscribe now.
Article sources
We rely only on vetted sources and credible third-party reporting. For details, see our editorial ethics and guidelines
Government of Canada (1); Financial Consumer Agency of Canada (2); The Logic (3, 4, 6); Open Banking Tracker (5)
This article provides information only and should not be construed as advice. It is provided without warranty of any kind.