CDR vs screen-scraping
How Australia's Consumer Data Right replaced password-sharing as the way third-party apps get your bank data, and why every connection on BankSync uses CDR, not scraping.
Screen-scraping
Enter your CommBank login
The app saves these and signs in to your bank as you.
Client number
8312 4471
Password
••••••••••••
- No scope: anything you can see
- No end date
- No record at the bank
Consumer Data Right
Share your data with BankSync
Fiskil (ADRBNK000246) is the accredited data recipient; BankSync is its CDR Representative.
Data to share
- Account name, type and balance(shared)
- Transaction details(shared)
- Direct debits and scheduled payments(not shared)
Share for
CDR is the regulated successor to screen-scraping. With CDR, you never share your bank password; consents are scoped, time-bound, and revocable; and every access is audited at the bank. Screen-scraping has none of those guarantees and is being phased out across Australia.
Side-by-side comparison.
- Credentials
- Screen-scrapingYou give the third party your bank password
- CDRYou authenticate with your bank; the third party never sees your password
- Scope
- Screen-scrapingAnything visible after login
- CDROnly the data scopes you explicitly authorise
- Duration
- Screen-scrapingUntil you change your password
- CDRTime-bound: 7 days, 90 days, or up to 12 months
- Revocation
- Screen-scrapingChange your password
- CDROne click in your bank app or the recipient dashboard
- Audit trail at the bank
- Screen-scrapingNone; the bank cannot tell automation from you
- CDREvery access is logged against the consent ID
- Regulator
- Screen-scrapingNone
- CDRACCC and Treasury, with OAIC oversight on privacy
- Bank terms of service
- Screen-scrapingUsually prohibits sharing credentials
- CDRExplicitly endorsed and required by law
- Liability if data leaks
- Screen-scrapingYou may bear liability for unauthorised access
- CDRLiability sits with the Accredited Data Recipient
Why screen-scraping is on the way out.
The 2022 Statutory Review of the Consumer Data Right recommended that screen-scraping be banned once CDR offers a viable alternative. ASIC has flagged credential-sharing tools as a consumer-harm risk, and most major banks now embed warnings against sharing passwords with third parties. CDR closes the regulatory gap by making consented data access first-class infrastructure.
How a CDR consent actually works
- You click "Connect bank" in BankSync.
- You are redirected to your bank's secure CDR authorisation page.
- You log in there (BankSync never sees the credentials).
- You select scopes (transactions, balances) and a duration (7d / 90d / 12mo).
- Your bank issues a token to Fiskil, the Accredited Data Recipient (ADRBNK000246), who passes consented data to BankSync.
- You can revoke at any time from your bank app or BankSync.
The full register of accredited providers is at cdr.gov.au.
Questions, answered.
What is screen-scraping in Australian banking?
Screen-scraping is when a third-party app asks for your internet-banking username and password, logs in as you, and reads the pages it sees. It is unregulated, leaves no audit trail with your bank, and breaches most banks' terms of service. CDR was introduced in 2020 to replace it.
Is screen-scraping illegal in Australia?
Not outright illegal, but it is being phased out. Treasury's Statutory Review of CDR (2022) and ASIC have signalled that screen-scraping should be banned once CDR coverage is broad enough; a formal ban has been recommended. Most banks already discourage it through their terms of service.
Does CDR replace screen-scraping completely?
For data covered by CDR (banking, energy, telecommunications), yes, accredited recipients can get the same or better data via regulated APIs. CDR scopes include account details, balances, transactions, regular payments, and account-holder information.
Why is CDR safer than screen-scraping?
Four reasons: (1) CDR never sees your password, you authenticate with your bank, not the third party. (2) CDR consents are scoped to specific data types and durations. (3) Consents are revocable from your bank or the recipient at any time. (4) CDR is supervised by the ACCC and Treasury, with breach notification and audit obligations.
Does BankSync use screen-scraping anywhere in Australia?
No. Every Australian connection on BankSync is routed through the regulated Consumer Data Right framework via Fiskil (Accredited Data Recipient, ADRBNK000246).
What happens to old screen-scraping tools?
Most have migrated to CDR, partnered with an ADR, or shut down. Pocketbook (Australia's most-loved free PFM, which used screen-scraping) shut in March 2024 partly because of the cost of CDR migration. Tools that remain credential-based should be treated with caution.