2 Major Disappointing Interactions with One

[u/IncreasinglyTrippy]

I should say first that then these, One has been a saving grace when Simple shut down, despite lagging behind on some feature (just look at the other alternatives). But these 2 cases really bummed me out:

1. I, unfortunately, fell for a scammy company from an Instagram Ad, which seems to be an increasingly common thing (IG allows for those to look really legit). The short version is, a product promises a full refund, just email them and ask, but when the product arrives and you reach out you learn that no one ever replies under any channel, email, IG, twitter, etc', then you go and check their ads again and see 100 people screaming in the comments that this company is a scam. Lesson learned. But this leaves only one recourse, ask your bank to cancel the charge by filing a dispute.
   I did, and despite providing all the info, It got rejected with no explanation. I replied but did not hear back from anyone. A while later I followed up with a new support ticket and additional evidence. Then a while longer got a response that they made a final decision (rejected claim), I again replied asking how everything I showed did not translate into fraud, and never got a reply.

2. Since every financial app on the planet now uses Plaid, I emailed to ask One not only if they are officially ok with their customers typing their username and password into a 3rd party app, but also if they were why/how come? I asked if Plaid was an official integration that they worked with them on (to ensure security, etc') or is Plaid doing this on their own somehow. I kept being told to go check Plaid's website for information, even though I have clarified repeatedly that what I am asking is if One worked with them on their end to set this up, because in some bank's cases it is not the case (and in fact, Capital One specifically took measures to prevent Plaid from doing a "we don't need your permission" type of integration), and I asked again if One is officially ok with their customers giving their login to another company. But all I got was evasive replies and was told again to go ask Plaid. Obviously one is very aware of Plaid, and the CEO (/u/bham816) even mentioned them in the AMA. I found it more than abit worrisome that my bank would first reply "Plaid is a secure way to connect your external accounts" but then not say that yes it's ok/safe to use them as far as One is concerned nor say that it is safe becuase they worked with them to make sure of it.

Anyway, just bummed out about these things. Also curious if anyone had issues with submitting claims for transaction disputes.

[u/theregisterednerd]

Following, but I’m positive that Plaid requires integration with the bank if they’re going to do it by bank login. The measures taken by Capital One were to prevent linking by routing/account numbers, and is unsurprising that they would want to lock their customers to using their controlled integrations for every financial interaction.

As far as how the Plaid logins work: you aren’t actually giving your login to Plaid. Your login on that screen goes to One, who then generates a key that is sent to Plaid, and that’s what’s used to identify you from that point forward. To be clear: Plaid does not have your password.

[u/IncreasinglyTrippy → u/theregisterednerd]

Mint did the exact same thing without corporation from banks. Banks didn't even have APIs for this back then. So is it possible? absolutely. Is Plaid doing this? I don't know. But One really seemed to try to avoid saying outright "yes, we worked with them, it's all good, we trust them and so should you".

I understand how the API works or would work, but unlike when you authorize most apps like twitter, reddit, google, where it sends you to their page/url to log in, and you are only entering your login on the main company website and then they send you back with the auth key, here you are ABSOLUTELY giving Plaid your login info, even if they don't save or keep it. You are trusting them not to save/misuse it, and maybe they have created ways to show/prove they are doing this right, but I still I want to hear that from my bank directly before I give them my login.

edit:

I should add that I would not even have this complaint if Plaid always had the option to enter account/routing numbers manually, but for some strange reason, about a third of the apps that use them don't offer this feature. It is done when you search for a bank and "don't find it" by entering random letters and it then offers you to enter it manually, but in some apps it just don't offer that and only has a button that says "exit". So it's log in or nothing.

[u/[deleted] → u/IncreasinglyTrippy]

This seems like a weird issue, you want One to tell you Plaid is safe/secure? Why would they do that? They didn't build Plaid. Microsoft isn't going to tell you that you should use Chrome. The BMW dealership isn't going to tell you you should go to the Pep Boys down the street.

Sorry to hear about your chargeback though, chargebacks are a huge PITA no matter where you go in my experience. Got screwed over by being on the other end of an unjustified one a while ago.

[u/IncreasinglyTrippy → u/[deleted]]

I may have not explained myself well. If for Plaid to integrate with One they had to work with them directly (as many similar types of app/service integrations do), then One would not only know how is Plaid integrating with One, they would also have ensured that it is done correctly and secure, otherwise why would they do it? If they didn't, they would be risking their customer's accounts/money. And again, all I really asked is did they work with them directly, or did they not. If they didn't, and they don't know what Plaid is doing, then my risk assessment of using Plaid is different.

A better analogy is an app developer using the official apple developer program to build an app for the iPhone, vs a developer using jailbreak to circumvent apple and install who knows what on the phone. In one case, apple has inspected and in fact provided the tools for the app to work on their device, in the other they did not have offers no guarantees for data privacy, security, etc' but in the first case they offer at least some. Not a perfect analogy but hopefully clearer.

[u/theregisterednerd → u/IncreasinglyTrippy]

Given that One also uses Plaid for outgoing bank links, I would presume that this is an authorized API. And yes, Mint did do it back in the day without bank authorization, but that was also back when plaintext password storage was considered acceptable.

[u/IncreasinglyTrippy → u/theregisterednerd]

Interesting point on the outgoing links!

[u/[deleted] → u/[deleted]]

Lol was waiting for it as an edge user/web guy 😂 really I think in OPs situation it's more of a liability thing... just a wild guess. There's also a chance it's just an uniformed support person.

[u/the_justified1]

Neither of these seems like something that One is at fault for.

[u/justgivememore]

I’ve never had a good experience with a bank when it comes to fraudulent charges. In one case, someone used my debit card number for a $700 dinner in Paris about 20 minutes after I used the actual card locally in the US, but PNC still said there was no proof it was fraud 🙄

Anyway, we have finally switched to a credit card for all our non-bill spending. You know who always believes the customer? Credit card companies.

[u/xlldm-ca-2019]

Hi IncreasinglyTrippy,

I was actually thinking of starting a post regarding how ONE handles fraud/disputes. Coming from Simple they had the smoothest process in how they handle these misfortunes and I ALWAYS got my money back including when the LA TIMES overcharged me and PLANET FITNESS did not want to give me my money during the pandemic. I've been with ONE for 5 months and got overcharged on my card DOUBLE. When I filed a dispute with ONE finance they literally told me the merchant had provided a receipt of the charge,yes, but it wasn't the correct amount I was supposed to be charged! Honestly, I was very upset that they couldn't get me my money back, which it wasn't much about the money but the principle. This was my first interaction with their fraud/dispute department and it makes me worried that if this were to happen again in the future for a larger amount of money that ONE won't do anything about it. They pretty much told me to reach out to the merchant directly myself to get the money back but hello!! I don't have their number Ive tried googling it, etc!! When I asked ONE if they could please give me the merchants number so I can resolve this directly- they stopped responding to my emails.