{"id":16873,"date":"2026-10-23T08:24:00","date_gmt":"2026-10-23T08:24:00","guid":{"rendered":"https:\/\/accelaronix.in\/blogs\/?p=16873"},"modified":"2026-10-23T08:54:44","modified_gmt":"2026-10-23T08:54:44","slug":"is-account-aggregator-safe","status":"publish","type":"post","link":"https:\/\/www.billcut.com\/blogs\/is-account-aggregator-safe\/","title":{"rendered":"Is Account Aggregator Safe? A Borrower\u2019s Guide to Consent, Fraud and Complaints"},"content":{"rendered":"

By BillCut
Last updated: 22 October 2026<\/p>\n

An Account Aggregator is usually safe to use because it is regulated by the Reserve Bank of India (RBI), cannot move your data without your explicit consent and cannot see the data it carries. The weak point is you approving a request you did not read, or sharing an OTP with a fraudster. Here is how to check, revoke and complain.<\/p>\n

Is Account Aggregator safe by design?<\/h2>\n

The RBI\u2019s Master Direction for NBFC-Account Aggregators<\/a> builds several protections into the system. An AA must be a company with an RBI certificate of registration, and it can act only on your explicit consent.<\/p>\n\n\n\n\n\n\n\n\n\n
Protection<\/th>\nWhat the rules say<\/th>\n<\/tr>\n
Consent first<\/td>\nNo financial information can be retrieved, shared or transferred without your explicit consent<\/td>\n<\/tr>\n
No passwords<\/td>\nThe AA must not request or store your credentials, such as passwords or PINs<\/td>\n<\/tr>\n
Nothing kept<\/td>\nFinancial information the AA accesses must not reside with it<\/td>\n<\/tr>\n
No other use<\/td>\nThe AA cannot use customer information for anything other than its AA business, and cannot support transactions<\/td>\n<\/tr>\n
Your record<\/td>\nThe AA must let you see the consents you gave and who received your data<\/td>\n<\/tr>\n
Exit option<\/td>\nThe AA must give you a way to revoke consent<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The government\u2019s PIB explainer on the AA network<\/a> adds that data is encrypted by the sender and can be decrypted only by the recipient, so the AA itself cannot see it.<\/p>\n

Where can Account Aggregator users still get hurt?<\/h2>\n

The rules protect the pipe, not your choices. Once you approve a request, the lender or app you named receives the data for the purpose stated, and revoking later may not undo what was already shared.<\/p>\n\n\n\n\n\n\n\n
Situation<\/th>\nGenuine AA request<\/th>\nWarning sign<\/th>\n<\/tr>\n
Where it starts<\/td>\nInside an app or site you opened to apply for something<\/td>\nA call, SMS or WhatsApp link you did not ask for<\/td>\n<\/tr>\n
What it asks for<\/td>\nYour approval on a consent screen<\/td>\nYour OTP, PIN, net banking password or screen share<\/td>\n<\/tr>\n
Who gets the data<\/td>\nA named, regulated lender or entity<\/td>\nA vague or unknown recipient<\/td>\n<\/tr>\n
Purpose and expiry<\/td>\nClearly stated, with an expiry date<\/td>\nMissing, or far longer than the task needs<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The Department of Financial Services\u2019 Account Aggregator framework page<\/a> says 17 companies hold RBI certificates as AAs. If an app claims to be an AA, it is reasonable to ask for its RBI registration details before you link anything.<\/p>\n