Expense tracker without bank login: what each route hands over

All four routes can produce a list of amounts, dates and counterparties. The login and the Account Aggregator route see a little more, such as ledger lines that never trigger an alert; alerts see a little less; statements see everything, late. On seeing alone, the routes are close to interchangeable.

The second column separates them. A net-banking password is not a read permission. It is the credential you use to add payees and move money, and the bank cannot tell the tracker's session from yours. The other three routes hand over something that cannot move a rupee: a consent that carries data only, a permission to read messages already sent to you, or a file. Columns three and four decide the rest: where your data ends up, and whether you can end the arrangement yourself, today.

Sees: whatever your net-banking screens show, usually the full ledger. For the household that is 4 logins and 8 secrets, a username and password each, held on someone else's systems.

Can do: in principle, anything you can do once logged in. Most banks put an OTP in front of adding a payee or making a transfer, so the password alone rarely moves money. A stored password plus a way to receive your OTP does, and scrapers often need you to relay an OTP, training you in the exact habit fraud depends on.

Must trust: the app's storage of 8 live credentials, its staff and any future owner. A breach there leaks your bank login, not just your history.

Revoke: only by changing the password, which breaks the tracker until you type the new one into the same app. Change each password quarterly and that is 16 re-links a year, each repeating the original risk. So people change passwords less often, and the tracker penalises the habit that protects the account.

Banks tell customers never to share these credentials, and the reason shows up in a dispute. RBI's rules on unauthorised electronic transactions put the loss on the customer where the customer's negligence caused it, and sharing credentials is the textbook case.

Sees: the accounts you approve, for the date range the consent names, straight from the bank's records, so a year of history can arrive on day one, including lines no alert ever mentioned.

Can do: read. The framework carries information, not payment instructions; no consent turns into the ability to move money.

Must trust: the recipient. The framework governs the sharing, not what the recipient does afterwards, so read the purpose and duration on the consent screen: a one-time pull and a 12-month recurring feed are very different grants.

Revoke: in the aggregator's app, yourself, at any time. For the household, one consent can cover all 4 accounts if every institution is live; split by institution, it is up to 4 approvals, each renewed once a year on a 12-month consent. The limit is coverage: not every institution or account type is live yet. The consent flow itself is explained on the Account Aggregator page.

Sees: the amount, date, last digits of the account or card, often the balance, and a counterparty: a merchant descriptor for cards, an address or registered name for UPI. Whether you paid on GPay, PhonePe or Paytm, the bank executes the debit and sends the alert.

Can do: nothing to the account. There is no credential here, so nothing can log in, add a payee or approve a payment.

Must trust: the app's handling of your inbox or SMS, covered two sections down. Revoke: remove email access in your Google account settings and switch off the SMS permission in Android settings, both instant and neither needing the app's cooperation; deleting stored data is a separate step. The Gmail-specific questions are on the page about connecting Gmail.

Unyfy reads your bank and card transaction emails and, on Android, your bank's transactional SMS, with no manual entry and no bank password or UPI PIN, and drops any debit it has already seen through the other channel. That last step matters: if each of the household's 120 debits arrived both ways, that is 240 alerts a month, 50 percent duplicates, and a ₹50,000 month would read as ₹1,00,000.

The route is weaker in three places, and Unyfy with it. Cash: it sees the ₹4,000 ATM withdrawal, not what the cash bought, so 8 percent of the household's spending, ₹48,000 a year, is one line with no detail. Alerts without a merchant: if 30 of 120 carry only a reference number, 25 percent of debits are amounts without names. iPhone: iOS does not let apps read SMS, so Unyfy's SMS reading is Android only; on an iPhone the web app at app.unyfy.co.in works from email alerts and statements.

Sees: every line for the period, including charges and reversals no alert mentioned. Can do: nothing; a PDF is a file, not a connection. Must trust: whoever holds it, and it carries your name, address and full account number. Revoke: you cannot un-send a file, so revocation means deletion; check that the app discards uploads after reading them. If it asks to store your PDF password, which is usually built from personal details, unlock the file yourself instead.

The cost is upkeep: 4 accounts at 12 statements a year is 48 uploads, and at three minutes each, 144 minutes a year. Backfilling a year on day one is another 48. Unyfy parses statement PDFs from five supported banks, so for those accounts the alert and statement routes combine.

'No bank login' promises that the app cannot act on your account. Nothing more.

On Android, SMS permission is not limited to bank senders; the permission that reads a debit alert can read the OTP a minute later. What stops it is design and policy, not impossibility. On email, the read scope decides whether the app sees only the messages it searches for or the whole mailbox.

Four checks for any alert-based tracker, this one included. Read scope: which emails and SMS senders, stated specifically. Raw messages: whether full text is uploaded or only the extracted transactions. Deletion: whether you can erase what it stored from inside the app. Credentials: no tracker ever needs your UPI PIN, whether you pay on GPay, PhonePe or Paytm, because the PIN approves payments and tracking only reads them.

Then the red flags, which apply to any finance app.

Three situations favour a bank-linked route, meaning the Account Aggregator route and never a shared password. Business or high-volume accounts, with dozens of transactions a day and charges no alert mentions, need the bank's full ledger. Needing a complete history now, for a loan application or tax filing, favours a consent that pulls a year on day one, or 48 statement uploads, over whatever alerts your phone kept. And if alerts go to a number or inbox you no longer use, or you are on an iPhone, the alert route has little to read.

For everything else, and for any app, five questions settle it. The first two decide most cases.