Why audit your bank & payroll feeds now?
Section 1033 of the Consumer Financial Protection Act — as implemented by the CFPB — gives consumers clearer rights to their financial records and places new obligations on banks and third parties that access those records. If you’ve ever connected a budgeting app, rent‑reporting tool, payroll‑sharing service, or credit‑builder product to your bank or payroll feed, that connection may remain active and continue to share data until you revoke it. Knowing who has ongoing access matters: shared cash‑flow or payroll feeds can be re-used for underwriting, income verification, rent reporting, or other data products that affect your credit profile and privacy.
What this guide covers
- Where to find connected apps and consent dashboards at banks and payroll providers.
- How to request access logs or records that show who pulled your data under Section 1033.
- Exactly how to revoke a third party and steps to harden access afterward.
Practical checklists and short message templates are included so you can act quickly and document your steps.
Quick audit: Find and revoke connected apps (step‑by‑step)
Most banks and payroll providers now include a "connected apps" or "third‑party access" page inside online or mobile banking where you can view and immediately revoke active connections. If you find nothing in the app, call online‑banking support and ask for a list of active third‑party tokens tied to your account. Banks are also expected to accept and act on revocation requests and to notify third parties in a timely way.
Step 1 — Check your bank(s)
- Open your bank’s mobile app or online banking and look for links labeled "Third‑party access," "Connected apps," "Authorized applications," or "Access & consent." Example banks provide a revoke button inside the security center.
- If you see services you no longer use (budgeting apps, credit‑builder services, payroll verifiers), click "Revoke" or "Remove" and confirm.
- If you can’t find a dashboard, use secure messaging or call the bank and request they list and revoke all third‑party tokens for your account.
Step 2 — Log into each third‑party app
- Open the third‑party app (Plaid‑connected apps, rent reporters, payroll/benefits apps) and use its account or privacy settings to remove the bank connection. Many aggregator services (e.g., Plaid) expose a consumer portal to manage saved connections.
- Use the app’s revocation flow as well — revoking at both sides is best practice.
Step 3 — Payroll & employer feeds
If an employer or payroll provider (ADP, Paychex, Gusto, etc.) pushes payroll or income feeds to third parties, ask HR or payroll to stop sending data and confirm which vendors have access. Keep a dated record of your request.
Step 4 — Harden access
- Change your bank password and enable multi‑factor authentication to invalidate sessions and reduce credential misuse.
- Review and remove unused payment authorizations (ACH or card tokens) and cancel any autopay permissions you don't want active. For automatic withdrawals, inform the merchant in writing that you are revoking authorization — banks can also block debits if needed.
Requesting access logs and records under Section 1033
One of the most powerful but under‑used rights is your ability to request records about who accessed your data. Under the CFPB's Personal Financial Data Rights rule implementing Section 1033, covered entities must respond to consumer requests for records and provide clear revocation methods; that includes records of third‑party access and retention practices in many cases. Requesting these records gives you an audit trail you can use if a third party later claims a different set of permissions.
How to ask: a compact records request you can send
Subject: Request for records of third‑party access under Section 1033 I am writing under my rights provided by Section 1033 and the CFPB's Personal Financial Data Rights rule. Please provide all records and logs showing which third parties and developer interfaces have accessed or requested access to my account (including timestamps, data scopes requested, and any records retention or disclosure to downstream parties) for the past 24 months. Please also confirm that you have revoked any active tokens for the following third parties: [list apps]. Please respond in electronic form and provide a dated confirmation when revocations are completed. Thank you, [Your name] [Account number / last 4 digits]
Send this message through your bank’s secure message portal and keep a copy. If the bank asks you to use a specific form, use it, but keep a dated screenshot or copy of every communication. If the bank fails to respond, you can escalate to the CFPB with the bank’s response history.
Document everything
- Save screenshots of connected‑apps pages before and after revocation.
- Keep copies of secure messages, call logs (date/time/agent), and confirmation numbers.
- If a third party continues to pull data after revocation, use your saved evidence to escalate to the bank, the app, and — if necessary — file a complaint with the CFPB.
When to consult help
If you suspect unauthorized sharing, repeated re‑connection after revocation, or data used in a way that harms your credit or employment prospects, consider contacting a consumer‑privacy attorney or filing a complaint with the CFPB. The agency’s rulemaking and enforcement tools are specifically intended to give consumers remedies and encourage covered entities to build reliable revocation and logging systems.
Bottom line
Don’t assume a connection you made once automatically expires. Use your bank’s connected‑apps page, sign into third‑party apps, ask payroll/HR about feeds, request access logs under Section 1033, and revoke any services you no longer want. Keep dated evidence of each step — it makes enforcement, disputes, or regulatory complaints far easier to win. For a quick checklist, start with: (1) connected‑apps dashboard, (2) third‑party app settings, (3) payroll/HR confirmation, (4) password + MFA, (5) records request under Section 1033.