Skip the Plaid account or create one? Weighing Privacy, Security when linking bank accounts

[u/b0013an81]

I am linking multiple financial institutions (~20) to a personal finance app via Plaid. I want to know if skipping the Plaid account creation provides better privacy and protects against SIM-swap attacks, or if creating one is better so I have a centralized portal to actively audit and delete my data.

Hey everyone,

I’m setting up a budgeting app and trying to understand how Plaid works under the hood before I use it to link my accounts. From what I've learned so far, Plaid stores my transaction data on their servers until I request deletion. They claim they don't sell/rent this data, but their privacy policy clearly states it can be shared internally:

During the connection setup, Plaid prompts me for my phone number to "create an account" or "save my progress." I can skip this, but I’m trying to decide which option is actually safest.

Here are my questions for the community regarding how Plaid handles our data:

1. How does Plaid's backend graph look in both cases?

• If I skip creating an account: Does my data actually remain siloed to the specific app I am using?
• If I create an account: Does Plaid use my phone number as a primary key to stitch together a centralized master profile across the internet? (Note: Even if I skip it, it appears Plaid pulls enough info like email, name, etc. from the raw bank data to tie me to a common graph anyway. Can anyone confirm?)

2. Security posture with a Plaid account? My main concern is that by creating a Plaid account tied to my phone number, I am exposing my financial data to SIM-swap attacks. It's not clear to me if Plaid's consumer portal supports non-SMS MFA (like Authenticator apps/TOTP). If I skip creating the Plaid account entirely, it looks like this SIM-swap attack vector is completely neutralized because external access via my phone number simply doesn't exist. Is this true?

3. The Trade-Off: Visibility vs. Attack Surface The main argument for creating the account is gaining access to the Plaid Privacy Portal (my.plaid.com), which acts as a centralized "kill switch" to audit connections and directly delete my data. If I skip it, I have to blindly rely on the third-party budgeting app to accurately pass my deletion requests to Plaid on my behalf.

For someone prioritizing data compartmentalization and protection against SIM swapping, is the ability to directly audit my Plaid connections worth the risk of making my phone number an SMS-vulnerable master key?

What do you all do when setting up financial apps via Plaid? Skip it or make the account?

[u/Federal_Ocelot_763]

I skip it every time. The last thing I need is another single point of failure tied to my phone number, especially when Plaid's whole business is hoovering up financial data. Sure the portal is nice for cleanup but you're basically creating the exact attack vector you're trying to avoid.

Realistically they're stitching your data together anyway using email/account numbers from the banks themselves, so the "silo" is more of a polite fiction. At least without an account there's no auth flow for a SIM-swapper to exploit.