BankSync
🇦🇺AustraliaLive·CDR

CDR vs screen-scraping

How Australia's Consumer Data Right replaced password-sharing as the way third-party apps get your bank data — and why every connection on BankSync uses CDR, not scraping.

Start free 14-day trialBack to CDR explained

Choose a CDR bank, review consent, and connect with read-only access.

Quick answer

CDR is the regulated successor to screen-scraping. With CDR, you never share your bank password; consents are scoped, time-bound, and revocable; and every access is audited at the bank. Screen-scraping has none of those guarantees and is being phased out across Australia.

Side-by-side comparison

DimensionScreen-scrapingCDR
CredentialsYou give the third party your bank passwordYou authenticate with your bank; the third party never sees your password
ScopeAnything visible after loginOnly the data scopes you explicitly authorise
DurationUntil you change your passwordTime-bound: 7 days, 90 days, or up to 12 months
RevocationChange your passwordOne click in your bank app or the recipient dashboard
Audit trail at the bankNone — bank cannot tell automation from youEvery access is logged against the consent ID
RegulatorNoneACCC and Treasury, with OAIC oversight on privacy
Bank terms of serviceUsually prohibits sharing credentialsExplicitly endorsed and required by law
Liability if data leaksYou may bear liability for unauthorised accessLiability sits with the Accredited Data Recipient

Why screen-scraping is on the way out

The 2022 Statutory Review of the Consumer Data Right recommended that screen-scraping be banned once CDR offers a viable alternative. ASIC has flagged credential-sharing tools as a consumer-harm risk, and most major banks now embed warnings against sharing passwords with third parties. CDR closes the regulatory gap by making consented data access first-class infrastructure.

How a CDR consent actually works

  1. You click "Connect bank" in BankSync.
  2. You are redirected to your bank's secure CDR authorisation page.
  3. You log in there (BankSync never sees the credentials).
  4. You select scopes (transactions, balances) and a duration (7d / 90d / 12mo).
  5. Your bank issues a token to Fiskil, the Accredited Data Recipient (ADRBNK000246), who passes consented data to BankSync.
  6. You can revoke at any time from your bank app or BankSync.

The full register of accredited providers is at cdr.gov.au.

Keep reading

Accredited Data RecipientsConsent duration explainedCDR data scopesCDR overview
good questions

Frequently asked questions

Screen-scraping is when a third-party app asks for your internet-banking username and password, logs in as you, and reads the pages it sees. It is unregulated, leaves no audit trail with your bank, and breaches most banks' terms of service. CDR was introduced in 2020 to replace it.

Use CDR, not screen-scraping

Connect any Australian bank via the regulated CDR framework. 14-day free trial.

Start Syncing Your Financial Data

14-day free trial • Cancel anytime