4. How secure are APIs?

In the open banking infrastructure, APIs sit between the PSP and the TPP to make sure data can be shared between the two. To ensure banks implement secure API infrastructure by design, account scraping is a banned practice under PSD2. Account scraping is often used by fintechs to gather user data as well as by bots with malicious intent.

It’s therefore vital to work with your eyes wide open here. APIs are becoming an increasingly attractive target for cyber-attacks alongside websites and applications. Establishing a resilient API environment is absolutely crucial to maintaining a truly secure and high-functioning ecosystem in which both interconnected parties are protected.

If an API is exposed, bots can be used to takeover accounts, scrape data and prevent the API servicing users.

API’s have three points of vulnerability – browser, mobile app and the API server – and each must be secured with appropriate mitigation methods.