Open finance is reshaping how financial data is shared across the U.S. financial ecosystem. As regulatory expectations around consumer-permissioned data access evolve under Section 1033 of the Dodd-Frank Act, financial institutions are increasingly focused on how to provide secure, reliable access to consumer financial data while minimizing operational and security risks.
One of the most persistent challenges during this transition is the continued use of screen scraping, a legacy method of accessing financial data that relies on consumers sharing their login credentials with third parties. While screen scraping helped enable early fintech innovation, it introduces risks that are becoming increasingly difficult for financial institutions to ignore.
FDX estimates that more than 114 million accounts are connected through FDX APIs, a figure that continues to grow as institutions adopt standardized open finance frameworks. While this number continues to rise, a substantial amount of financial data access still occurs through legacy methods such as screen scraping, highlighting the continued coexistence of both models during this transition period.
Screen scraping is the automated extraction of data from user interfaces. Consumers share their online banking credentials with third parties, who then use these credentials to log in to the financial institution’s digital channels to retrieve data. Once credentials are shared, consumers often lose ongoing visibility into how their data is accessed or used.
Billions of consumer login credentials are stored outside financial institutions, increasing the risk of exposure of sensitive financial data. The CFPB has specifically warned that screen scraping creates “risks of over-collection of data, inaccurate data sharing, and the spread of login credentials.” If compromised, this concentration of sensitive financial information in third-party environments can create elevated risk across the financial ecosystem.
Recent industry breach trends have further underscored the risks associated with centralized credential storage outside financial institutions’ direct control. As regulators increase scrutiny on third-party risk management and data access practices, institutions must consider not only how data is accessed, but also how it is secured, monitored, and governed once it leaves their infrastructure.
While screen scraping enables broad connectivity, particularly where secure APIs are not yet available by financial institutions, it also introduces significant security, compliance, and user experience risks.
As open finance gains traction, institutions are increasingly seeking to deliver data via secure API connections. But the availability of APIs does not ensure that screen scrapers use them. These players may continue using screen scraping, especially where the financial institution is smaller or the API integration complexity is high.
Financial institutions standing up secure API-based data access solutions should also consider implementing effective strategies to block bot traffic from screen scrapers, minimizing negative impact on legitimate users, protecting consumer data and incentivizing secure data access.
Supplementing any API access with contractual commitments from the data recipients/aggregators will allow for a more robust execution of anti-scraping strategies but will only affect those that have already committed to API access.
Many fintechs or digital service providers that leverage screen scraped data will attest to the fact that it is an unstable solution.
For example, when a consumer resets their credentials or a financial institution updates their digital banking experience, links often break. This gives way to a friction-prone consumer experience, potentially making screen scraped data unviable for fintechs as it creates a poor user experience, leading to potential loss of consumer trust or even attrition.
As financial institutions move along the continuum from disruption to full blocking, strategies tend to become more technically complex and cost intensive. This needs to be balanced against the level of consumer friction that is deemed acceptable, which is a decision that must be made by each financial institution.
To effectively disrupt and/or block screen scraping attempts, financial institutions can implement a layered perimeter security architecture. The foundation of this approach is in deploying a Web Application Firewall (WAF), capable of inspecting and filtering traffic based on IP reputation, request frequency, headers, and payload characteristics.
Bot management platforms — such as those from Imperva and Cloudflare — can distinguish between legitimate users and malicious bots using behavioral analysis, device fingerprinting, and anomaly detection. Session integrity controls like CSRF tokens and anti-replay mechanisms enhance protection against unauthorized automation.
Further enhancements could include integrating CAPTCHA systems for sensitive workflows, enforcing HTTPS and TLS protocols, and using Content Security Policy (CSP) headers to limit browser behavior. Financial institutions can also use device-level security and certificate pinning on mobile apps to secure communication channels and detect tampering or emulator-based scraping attempts. When layered strategically, these controls form a resilient perimeter against known and emerging scraping methods.
Traditional bot mitigation tools are becoming less effective against AI-enhanced scraping techniques. As screen scrapers adopt AI techniques, such as computer vision, reinforcement learning, and LLMs to mimic user behavior and bypass traditional bot detection, financial institutions must evolve their defenses. These AI-driven bots can simulate mouse movements, respond to dynamic prompts, and even recognize visual elements on the screen, rendering legacy detection strategies increasingly ineffective.
To counter these advancements, institutions should invest in adaptive security frameworks that leverage AI for threat detection, anomaly scoring, and real-time response. Technologies like behavioral biometrics, challenge-response models tailored to each session, and continuous authentication are becoming increasingly essential. Collaboration with threat intelligence providers and industry alliances focused on open finance standards can also ensure defenses evolve in sync with the threat landscape.
Screen scraping presents significant security, operational, and consumer protection risks due to its reliance on credential sharing and automated access to financial institution interfaces. As open finance continues to expand, these risks are receiving increasing scrutiny from regulators, financial institutions, and technology providers across the financial ecosystem.
The industry is steadily moving toward models that prioritize secure, permissioned, and standardized data access. API-based connectivity, combined with strong authentication and clear data-sharing frameworks, enables financial institutions to support consumer-permissioned data sharing while maintaining appropriate safeguards for sensitive financial information.
Addressing screen scraping requires more than implementing technical controls. Financial institutions must also evaluate how they manage third-party access, oversee data recipients, and enforce secure data access practices across their ecosystem.
By working with experienced technology partners that provide secure data-sharing infrastructure and support robust governance frameworks, financial institutions can better protect consumer data, reduce operational risk, and enable a more secure and transparent open finance environment.
Learn more about Akoya’s Open Finance Solution.
Check your financial institution’s open finance readiness with our interactive cost calculator and assessment tool.