Last Updated: 2 November 2026
Quick Summary
Read-only open banking is secure because you authenticate with your bank rather than handing over login details, and the provider can only view balances and transactions, never move money. Its security rests on encryption, Strong Customer Authentication, regulated access and standardised APIs, though you should still vet the provider and revoke access when you no longer need it.
- Read-only access lets a provider view balances and transactions but cannot initiate a payment.
- Consent under the UK's PSD2-derived rules is time-limited, so you should re-approve rather than assume it rolls on.
- Open banking never stores your bank login details, unlike screen scraping which keeps your password and PIN.
- Most UK banks let you revoke open banking access in the app without contacting anyone.
- Revoking a consent does not delete data the provider already holds, so ask it to delete your data.
What Read-Only Open Banking Actually Means
Read-only open banking is a form of data sharing where a regulated provider can view your account information but cannot move money.
That distinction matters. The question "is open banking read only access secure" usually comes from someone about to hand over access to their current account.
The core point: nobody hands over their bank login details. You authenticate with your bank, not the provider.
Read-Only Versus Payment or Write Access
Open banking comes in two broad flavours, and mixing them up is a common mistake.
- Read-only access: view balances, statements and transactions. No money moves.
- Payment initiation: a provider starts a payment from your account. This is write access.
- Write access more broadly: changing standing orders or moving funds between accounts.
Most consumer worry comes from payment initiation, not read-only. If you only grant account information access, no provider can drain your account through that permission.
A common mistake is assuming every "open banking" prompt is the same. Check which permission the screen is actually asking for.
How Open Banking Consent Works and What You Agree To
Consent is the legal backbone of open banking. You give a regulated provider explicit permission to access named accounts for a set purpose, and you can withdraw it at any time.
Under the UK's PSD2-derived rules, that consent is time-limited. The FCA's guidance on open banking sets out how firms must handle consent and customer protection.
What you are agreeing to, in plain terms:
- Which accounts the provider can see
- What data it can read
- How long the permission lasts
- What it will use the data for
Read the permission screen. It tells you all four.
Open Banking Permissions: What Each One Lets a Provider Do
Each permission is a separate door. Opening one does not open the rest.
| Permission | What it allows | Can it move money? |
|---|---|---|
| Account information | View balances and transactions | No |
| Payment initiation | Start a payment from your account | Yes |
| Funds confirmation | Confirm a balance covers a payment | No |
| Standing order access | View or amend regular payments | Sometimes |
The permission you grant should match the job. A bookkeeping tool needs account information, not payment initiation. If it requests the latter, ask why.
Open banking permissions are granular by design. That granularity is the whole security argument.
Open Banking Data Security: Encryption, SCA and Regulated Access
Open banking data security rests on four layers, and each one closes a different gap.
- Encryption: data is scrambled in transit and at rest.
- Strong Customer Authentication (SCA): you prove identity with at least two factors (EBA publishes an Opinion on the elements of strong customer authentication under PSD2).
- Regulated access: only firms authorised by the regulator can connect.
That last point separates open banking from screen scraping, where a tool stores your bank login details and reads your account by pretending to be you.
For teams weighing the two models, our guide on migrating from scraping to open banking walks through the security case step by step.
How to Revoke Open Banking Access Step by Step
Revoking access is straightforward, and you should know the route before you grant anything. The exact menu names vary by bank, but the path is consistent across UK banking apps.
Where to find your connected apps
In most UK banking apps, open banking consents sit under one of these labels:
- Security or Security & privacy
- Connected apps, Linked apps or App access
- Open banking or Data sharing
If you cannot find it, search the app's help centre for "open banking" or "connected apps." In online banking, the same list is usually under Settings or Profile & settings.
The revocation steps
- Open your bank's app or online banking and sign in.
- Go to the security, privacy or connected-apps section.
- Review the list of providers with access. Each entry usually shows the provider name, the accounts shared, and the date consent was granted.
- Select the provider you want to remove.
- Confirm revocation. Some banks ask you to re-authenticate with SCA before the change takes effect.
- Check the provider's own dashboard to confirm the connection is gone, most show a disconnected or expired status.
Most banks let you revoke open banking access without contacting anyone. If you spot an unfamiliar provider, revoke first and ask questions after.
What happens after you revoke
Revocation stops new data sharing through that consent. It does not delete data the provider already holds. Under UK data protection rules, you can ask the provider to delete your data (ico.org.uk).
Revocation also does not cancel any payment arrangements you set up separately, for example, a standing order or Direct Debit.
How long access lasts and when consent must be renewed
Under the UK's PSD2-derived rules, account information consent is time-limited. The exact interval depends on the provider and your bank, so check the permission screen. If you ignore a renewal prompt, the connection typically expires.
Revoking versus withdrawing consent
Revoking in your banking app withdraws the consent at the bank. You can also withdraw consent directly with the provider, which should then stop requesting data. Doing both is the cleanest approach: revoke at the bank to stop the flow immediately, then confirm with the provider that it has stopped and ask what it will delete.
For the wider picture on safe data sharing, see our explainer on open banking in the UK.
What Read-Only Access Does Not Protect Against
Read-only access blocks money movement. It does not block everything. A read-only provider cannot initiate a payment, set up a standing order, or move funds between your accounts. Securing your financial data requires a broader strategy that incorporates fundamental cybersecurity best practices to mitigate the risks inherent in any digital connection.
Here is what read-only access does not protect against, with the mechanism behind each risk.
Data exposure at the provider
A read-only provider still holds a copy of your transaction history, balances and account identifiers. If that provider suffers a breach, the attacker gets your financial profile even though they cannot move money through the open banking connection. Transaction data reveals income, regular commitments, merchants you use, and sometimes account numbers in payment references.
Phishing and consent phishing
Read-only access does not stop someone tricking you into granting access to a fake app. In consent phishing, you are directed to a convincing lookalike of a legitimate provider, complete a genuine bank authentication journey, and authorise a connection to an app that is not what it appears to be. Because the authentication itself is real, SCA does not save you.
Compromised devices and sessions
If your phone or laptop is compromised, an attacker may be able to act inside your banking app or the provider's app while you are authenticated. Read-only permission limits what they can do through that connection, but it does not stop them reading what is on screen, capturing credentials for other services, or approving a new consent prompt.
Weak provider controls
A regulated firm with poor internal security is still a weak link. Regulation sets a floor for authorisation, capital and conduct; it does not guarantee that every provider encrypts data well, limits staff access, or retains data only as long as necessary.
Oversharing across accounts
Granting access to accounts a tool does not need widens the blast radius. If a budgeting app only needs your current account, there is no reason to connect your savings, credit card and mortgage accounts as well. Each additional account is another dataset that could be exposed.
Misuse of shared information
Read-only access does not control what a provider does with the data once it has it, beyond the purpose you consented to. A provider that uses transaction data for wider purposes, for example, sharing aggregated insights with partners, is a conduct risk rather than a payments risk. Check the provider's privacy notice for how it uses and shares data.
If something seems wrong: incident response
If you spot unfamiliar activity, an unexpected consent prompt, or a provider you do not recognise, act in this order:
- Revoke the connection in your bank's app or online banking. Revoking first limits further data sharing while you investigate.
- Contact your bank using the number on the back of your card or in the app, not a number from an email or search result. Ask them to review recent consents.
- Contact the provider through its official support channel and ask it to confirm what data it holds and to delete it if you are withdrawing consent.
- Report suspected fraud to the relevant authorities and, if you have lost money through a related payment, to your bank's fraud team immediately.
- Secure your accounts: change your banking password, review your email account for forwarding rules or unfamiliar sessions, and check your devices.
Fraud prevention starts with you checking who you authorise. Regulation sets the floor, not the ceiling. To understand how data is actually pulled, our guide on getting bank transaction data via REST API covers the technical side.
Choosing a Provider: A Practical Security Checklist
Use this before you connect anything. It takes five minutes and saves a lot of regret.
- Is the provider authorised and listed on the regulator's register?
- Does it request only account information, not payment initiation?
- Can you see and revoke access from its dashboard?
If a provider cannot answer these plainly, walk away. For finance teams vetting vendors in depth, our finance data security roadmap sets out controls across a 30, 90 and 180 day plan.
Connect Your First Bank Account with Zenith
Zenith connects banks across European countries through read-only open banking. You authenticate through your bank's own PSD2 consent flow, choose the accounts to sync, and we keep balances and transactions up to date.
Data flows into Google Sheets, a REST API, CSV or an AI assistant via MCP. For current pricing, see the Zenith pricing page.
Ready to see it work? Start pulling transactions in minutes.
