Ahorro.net reads your bank accounts in exchange for offers

Ahorro.net asks for your online banking credentials in order to sell you offers

The scene repeats itself at every family lunch: someone suggests an app that sorts your accounts, warns you about fees and tells you how to save. It sounds great until you get to the fine print. For Ahorro.net to work, you have to link your current accounts by handing over your online banking login credentials. The project's founder, who introduces himself as CEO, confirmed this in November 2014: the tool imports transactions automatically and only needs read-only credentials, never the ones used to make transactions. The business model, he admitted without beating around the bush, is to learn each person's spending habits and offer them financial products in exchange for a commission.

That's where the problem began. Because there's a big difference between an app knowing you spend money on petrol and it storing the details of every bill, every utility contract and every card number, as one participant pointed out.

What Ahorro.net is and what it asks for to work

The project has been in development for more than two years and runs in the browser, on Android and, in a few days, on iPhone. It groups current accounts, issues fee alerts and offers savings tips. For free. The trade-off is access: the user links their bank using the same credentials they use to log into online banking.

The technical defence rests on the VeriSign SSL EV certificate with the Symantec and Norton seal, 256-bit encryption, "bank-grade security". And on a weighty argument: the credentials requested are read-only. Spanish banks require at least two levels of security, and only the second one — electronic signature, coordinates card or SMS code — allows money to be moved.

The reasoning has a hole that several readers pointed out bluntly. With the read-only credential you can access bills, utility contract numbers, bank correspondence and card numbers. Enough material to cause serious damage without touching a cent.

The business model: your data as raw material

If the service is free, someone is paying. The founder's answer was transparent: learn each user's spending and, based on it, offer them commission-based deals. Someone who spends a lot on fuel gets a credit card with discounts at petrol stations.

The question that then hangs in the air is uncomfortable. To know that you spend money on petrol, there's no need to know that on such a day, at such an hour, you bought ten units of something at a particular shop. The app, however, knows it, as trinc from the service description. And that's where the gap opens between the declared service and the data stored.

Encryption, hosting and the fine print of security

The SSL certificate guarantees communication between the website and the browser. Nothing more. It says nothing about who holds the data or with what key it is decrypted. The site is hosted at OVH, a French data centre which, as was pointed out, has neither Tier 4 nor PCI DSS certification for processing cards. A breach there doesn't expose one account: it exposes all of them.

The founder admitted that the technical questions were beyond him and that he would pass them on to his chief technology officer, with a response time of five or six days.

Trust as the only guarantee

The final argument was that banks already sell data "left, right and centre" and that it all comes down to trust. The team was published, a personal blog was linked. In one of the exchanges, a private message was even offered, half-jokingly, to the readers of a savings forum, inviting them to sign up.

The result was not what was expected. The distrust did not come from technological ignorance, but from being well informed. Anyone who understands what a read-only credential is doesn't hand it over. And anyone who doesn't understand it shouldn't either.

The product flaws that showed up when testing it

Whoever tested it found more mundane cracks. The bank's investment funds and deposits were not shown. The couple's cards were left out. And credit card spending was counted as income, not as expense. For a veteran user of the old version, the one where you enter data by hand, the switch wasn't clean either: transactions got stuck when saving, the Android app was a nightmare and the statistics couldn't be exported to Excel.

The alternative exists and is an old acquaintance: a spreadsheet, AceMoney in its free version limited to two accounts, or Gnucash. No credentials, no third-party servers, no referral commissions.

At the close of this discussion, the founder was still waiting for the technical report from his team. The app, meanwhile, keeps asking for the same thing: the keys to your house. Just to look.