iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
After linking a budgeting, investing, payment or other financial app, review the connection from your bank’s own security or data-sharing controls. Confirm every authorized app, the accounts and data it can access, and the date it was approved. Revoke anything stale or unfamiliar, then check whether the app retained information it already received. If you gave an app your bank username or password instead of approving a bank-managed connection, change that password immediately and turn on stronger multifactor authentication.
Bank menus differ, but the security review is consistent: inventory connections, remove access you no longer need, protect the credentials and recovery channels that could unlock the account, and enable alerts that expose suspicious activity quickly.
Why a connected financial app deserves a security review
A financial app can receive account data through two fundamentally different arrangements. In a bank-managed authorization flow, you sign in on a bank-controlled page and approve defined access. In a credential-sharing arrangement, you give the app your bank username and password so it can sign in as you. The second arrangement creates a larger risk: anyone who obtains those credentials may be able to access the bank directly, and the bank may not be able to limit activity to the data categories you intended.
A connection also has a lifecycle. An app may remain authorized after you stop using it, after you delete it from your phone, or after a trial ends. Removing the app from your device does not necessarily revoke the bank authorization. The bank’s linked-app or data-sharing page is therefore the authoritative place to see what is still connected.
#1 Best Overall
| Connection characteristic | Bank-managed authorization | Direct credential sharing |
|---|---|---|
| Where you enter the bank password | On the bank’s own site or app, followed by an approval screen | Inside the third-party app or a page it controls |
| Permission control | Often shows selected accounts, data categories or a defined duration; exact controls vary by bank | Usually broad account access tied to the shared username and password |
| Revocation | Can generally be removed from the bank’s linked-app or data-sharing list | Requires changing the bank password and may require additional cleanup |
| What happens to data already copied | Stopping access does not automatically erase historical data held by the app | The app may already have retained information obtained during prior logins |
| Monitoring value | Bank alerts and authorization records can show new access or devices | Credential use can resemble an ordinary bank login, making alerts and password hygiene especially important |
Do not assume that every app listed by a bank is malicious. The goal is to verify that each connection is intentional, limited to the right accounts and still needed.
1. Open the bank’s linked-app or data-sharing page
Sign in by typing the bank’s known web address or using its official mobile app. Do not follow a link in an unexpected email or text. Look for a menu named Linked apps, Connected services, Data sharing, Third-party access, Security center or a similar label. Some banks place it under Security & privacy rather than under account settings.
For example, Chase says customers can review and remove access for specific apps or websites through Linked apps in its Security & Privacy Center at chase.com or in the Chase Mobile app. That is an example of the control to look for, not a universal menu path; your bank may use different wording.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Record the details before changing anything
- App or company name, including an unfamiliar spelling or duplicate entry.
- Which checking, savings, card, loan or investment accounts are included.
- Permission categories, such as balances, transactions, identity details or payment initiation.
- The last-authorized date, renewal date or stated expiration.
- Whether the entry identifies the authorization method or the device used.
Take a screenshot or write down the entries if you may need to discuss an unauthorized connection with the bank. A connection that does not appear in the bank-controlled list deserves extra scrutiny: it may have used direct credentials, an intermediary service, or a setup that the bank does not display in the same location.
2. Revoke stale, duplicate or unrecognized access
Use the bank’s Remove access, Disconnect, Revoke or equivalent control for every connection you no longer need. If the same service appears more than once, keep only the current authorization that you can identify. Remove entries you do not recognize before investigating them inside the third-party app.
Rank #2
Consumer Financial Protection Bureau Regulation §1033.331(e) requires a provider to offer a reasonable method for revoking access and to revoke access after the consumer requests it. The practical path is still the bank’s current instructions: select the connection, confirm the revocation, and save the confirmation or reference number.
Confirm that revocation took effect
- Refresh the linked-app page or sign out and back in.
- Verify that the entry is gone or marked revoked, and note the time.
- Check the third-party app for a disconnected or reauthorization message.
- Watch the bank’s login and transaction alerts for activity that you did not initiate.
If the bank page will not remove an unfamiliar connection, contact the bank through the phone number on your card or a secure message after signing in. Tell the representative that you are requesting third-party access revocation and that you suspect unauthorized access if that is the case.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Find out what happens to data the app already received
Revocation stops future access; it is not the same as deleting historical data. Bank of America explains that once consent is revoked, the third party can no longer access account information, but it still has data previously shared. To erase that copy, you must request deletion from the third party under its privacy and retention process.
Use a two-part deletion request
- In the app, open its privacy, security or connected-accounts settings and delete stored financial accounts, transaction history and profile data where the controls allow it.
- Send a written deletion request to the provider’s privacy contact. Identify the account or email associated with the app, state that bank-data access has been revoked, and ask what information remains, why it is retained, how long it will be kept and when deletion will occur.
- Ask whether the provider shared the data with processors or partners and whether those copies will be deleted or de-identified.
- Keep the request and any response. Some records may be retained for legal, fraud-prevention or accounting reasons, so ask the provider to distinguish required retention from optional profile history.
Do not send a bank password, full account number or security answers in a deletion email. Use the provider’s authenticated privacy portal when available.
4. Decide whether to change the bank password
Change the bank password immediately if you ever typed it into the financial app, an app-installed browser window, a screen-scraping service or any page whose address you could not verify. Bank of America describes changing the bank password as the safest step when a third party accessed information using the customer’s login credentials.
Use the bank’s password-change page, not a link supplied by the third party. Create a long, unique password that has never been used at another site. After saving it, sign out of all sessions if the bank offers that option, then review trusted devices and active sessions. A password change may invalidate the old connection, but still revoke the app explicitly and check whether it has retained historical data.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhen a password change is still sensible after secure authorization
If you approved the connection on a bank-controlled authorization screen and never disclosed the password, changing it is usually a precaution rather than a requirement. Consider it after an unexpected login alert, a suspicious device, a phishing incident, malware on the device used to connect, or any uncertainty about where the password was entered. A password change does not replace revocation or deletion requests.
5. Strengthen multifactor authentication
Turn on multifactor authentication (MFA) for the bank, the email account used for recovery, and the financial app itself when supported. The Federal Trade Commission advises starting with sensitive accounts such as banks, credit cards, email, tax-filing sites, social media and payment apps. MFA requires an additional factor after the password, so a stolen password alone is less useful.
| Factor | Security characteristics | What to check |
|---|---|---|
| SMS or email code | Better than a password alone, but dependent on control of the phone number or email account and vulnerable to some takeover and phishing techniques | Secure the phone and email account separately; verify that recovery does not silently fall back to an unprotected channel |
| Authenticator app | Generates time-based codes on an enrolled device and is generally safer than text or email when the bank supports it | Enroll a backup device or save the bank’s recovery codes in a protected place before replacing a phone |
| Hardware security key | Uses a physical cryptographic key and resists many phishing attempts; support depends on the bank, browser and device | Register a spare key, store it securely and confirm that account recovery will not bypass the protection |
When enrolling MFA, verify the phone number and email address displayed by the bank. Remove an old number or address before it can receive a one-time code. Never approve an MFA prompt you did not initiate; repeated unexpected prompts can indicate that someone knows your password.
6. Consider a hardware security key
The FTC states: “Security keys are the strongest method of 2-factor authentication because they don’t use credentials that hackers can steal.” A FIDO security key is a practical example, but a key works only where the bank, device and browser support the relevant FIDO or WebAuthn method.
Rank #4
Before relying on a key
- Check the bank’s current MFA documentation for FIDO, WebAuthn or security-key support.
- Enroll two keys if the bank permits it: one for daily use and one stored separately for recovery.
- Confirm that the bank provides recovery codes or an alternate process that you can secure as carefully as the key.
- Test sign-in from your normal phone and computer before removing other factors.
A security key protects the sign-in step; it does not decide which accounts a connected app can read. Continue reviewing linked-app permissions and alerts.
7. Turn on detailed login and transaction alerts
Enable every useful notification the bank offers, then choose delivery channels you can monitor promptly. At minimum, look for alerts for new logins, new devices, password or contact-information changes, new payees, transfers, card transactions and low balances. Some banks also offer alerts for external-account links, profile changes, wire requests or failed sign-ins.
FFIEC interagency authentication guidance published August 11, 2021, discusses fraud and anomaly detection, suspicious-behavior monitoring and timely notification of unauthorized access. Alerts are not a substitute for those bank controls, but they reduce the time between an event and your response.
Make alerts actionable
- Use push notifications or an authenticator-linked channel when available, while keeping a second secure channel for backup.
- Set transaction thresholds low enough to expose an unfamiliar transfer, not only a large loss.
- Do not whitelist a new device merely because an app requested it; confirm the device name and location first.
- Investigate an alert from a known app if the time, device or account does not match your activity.
For a suspected unauthorized transfer, contact the bank immediately through its official fraud number and follow its instructions for securing the account. Do not wait for the third-party app to investigate first.
Recommended Free Tools
8. Verify the app and website before granting access again
The FDIC warned in its June 2024 guidance on banking with third-party apps that fake bank websites and apps can steal information or install malware. Before reconnecting, obtain the app from the device’s official store, check the developer name and read the requested permissions. Treat a request for a bank password inside an unrelated app as a warning sign.
Check the institution independently
If an app claims to represent a bank or financial institution, type the institution’s known address yourself and compare the domain, spelling and security certificate. The FDIC’s BankFind service can help verify an institution’s official website. Do not rely on a search advertisement, a shortened link or a logo alone.
Inspect permissions before approval
- Confirm that the account list contains only the accounts the app needs.
- Read whether access includes transaction history, balances, identity data or the ability to initiate payments.
- Check the stated duration and whether the app can renew automatically.
- Stop if the consent screen names a company you do not recognize or displays a different website from the one you intended to use.
Keep the app and phone operating system updated. Remove apps that request unrelated permissions, such as contacts or accessibility control, unless you have a clear and documented reason to grant them.
9. Review recovery settings and trusted devices
An attacker who controls a recovery channel can defeat otherwise strong sign-in protection. In the bank’s security settings, review every trusted phone, email address, remembered browser, mobile device and recovery method.
- Delete phones and computers you no longer own or use.
- Remove old phone numbers and email addresses, then add a current address protected by MFA.
- Review backup codes and regenerate them if they may have been copied.
- Check whether a trusted device can approve password resets or add new payees.
- Sign out of sessions you do not recognize and update the device lock on every remaining device.
Secure the recovery email account separately with a unique password and MFA. If your mobile carrier supports an account PIN or port-out lock, enable it to reduce the chance of an unauthorized number transfer undermining SMS recovery.
What to do when a connection or login looks unauthorized
Act in an order that limits further access while preserving evidence.
- Use the bank’s official app or typed web address to change the password and revoke the unfamiliar connection.
- Sign out other sessions and remove unknown trusted devices.
- Call the bank’s fraud department using the number on the card or statement. Report unauthorized logins, payees, transfers or profile changes specifically.
- Freeze or replace cards if card details may have been exposed, following the bank’s instructions.
- Secure the email account and phone number used for recovery.
- Contact the third-party provider to request deletion of data already received, but do not delay bank notification while waiting for its response.
Keep dates, screenshots, confirmation numbers and alert messages. They can help the bank determine which access was authorized and which transactions require investigation.
How often to repeat the review
Perform the full checklist whenever you connect a new financial app, change a bank password, replace a phone, or receive a security alert. A shorter monthly check is useful for the linked-app list, trusted devices and recent alerts. Review again when you stop using an app rather than assuming that deleting its icon ends access.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Because menu names, alert types, authorization duration and FIDO support differ by bank and device, use the bank’s current help pages for the exact clicks. The security principles remain stable: authorize through the bank when possible, limit scope, revoke promptly, ask the provider to delete historical copies, protect credentials and recovery channels, and monitor for anomalies.
Quick Recap
Quick checklist
- Open the bank-controlled linked-app or data-sharing page.
- Match every app, company, account, permission and authorization date to something you intended.
- Revoke stale, duplicate or unfamiliar connections and confirm the change.
- Ask the third party to delete data it already received; revocation alone may not erase it.
- Change the bank password if it was entered into a third-party app or if compromise is possible.
- Prefer an authenticator app or hardware security key over SMS or email when supported.
- Enable login, device, password-change, payee, transfer, card and low-balance alerts.
- Verify the app, developer and website before reconnecting; use BankFind when checking an institution.
- Remove old devices, phone numbers, email addresses and recovery methods.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
