In order to pay import duties, these crazy fuckers are expecting me to enter my bank logon details into their website. What. The. Fuck.

Are you sure this isn’t a scam?

Import duties are a scam to begin with.

That is a scam, they probably send mass texts linked to tracking numbers that have a registered phone number.

I remember one of the funnier scams.

They said they were from USPS, and in order to finish shipping, they needed me to pay the tariff.

It didn't have anything about me. No login. No address. No tracking number. It just wanted me to hit that pay now button.

But even then, why would I pay a tariff for something I didn't order?
- They didn't send it just to you. They sent it to millions. If even one person happened to order something internationally and be stupid, it's already worth it.
- For a while (and still every so often), I received fake texts from delivery companies, but they always referred to me as "There". "There, we tried to deliver your package...", "There, your package may be returned if you don't click this link...". I was curious what I typed in and where that they recorded my name as "There".
- I get that once in a while here in Denmark too, only replace USPS with PostNord, sometimes DHL or GLS
- And this is one of the ways to filter random scams. If a legitimate business or public entity is reaching out to contact you about an issue you need to deal with, they will know some identifying information about you. Especially the ones claiming that there's a warrant (or will be). If that was the case, they would definitely know your name and other specific details.
  
  That said, there are targeted scams, too, so don't assume that if someone can tell you your name that they are legit. Ask them for a callback number (don't call it, ask because they might be dumb enough to give you a number linked to them that you could pass on to investigators), then hang up and call the number you looked up online.
Don't even need an associated list, just a random list of phone numbers. People online shop enough.
It probably isn't as the banking industry is crazy
- Banking network engineer here: Never give out your login details. Not to your mom. Not to your brother. Not to me. Not to a company. Not to a random guy in India. Don't do it.

Ask them for their bank login details so you can deposit the money directly into their account.

This is the best

I would be completely astonished if this was legit. If you’ve already filled out the form, change you banking password and contact your bank immediately.

I have some surprising news for you then
- By all means, surprise away!

It's probably against your bank's TOS to give your password to a 3rd party. No way this is legit. Run away.

My understanding is that should you disclose your credentials you would generally void any fraud protection the banks may offer.
It probably is. Its for convenience reasons. They pull up your bank page in the background and automatic login and parse the page.

It is incredibly dumb and I would strongly advise against it
- Why would you need to give them your login details why couldn't you just sign into your bank account yourself? You still have to provide the details either way so it's not convenient.

Super massive red flag there.

Love that Muse song.
- 🎶 Ooh baby don't you know I suffer Oh baby when you phished my bank You sent me to a dodgy website Using a convincing link
  
  Ooooooh-ooooh You drained my bank account Ooooooh-ooooh You drained my bank account🎶

Scam

Google seems to suggest they’re some sort of fintech company out of South Africa? Either way if that’s their product then I’d run a mile in the other direction, and then another just be sure.

Yeah no. Plaid is one thing but giving access to your bank login to pay an invoice is something quite another. If it's legit they can accept a card payment, or send you to a PayPal invoice.
Yep. They've been around for years.

Normally you would just give them your card info like any other online pay site like PayPal etc. but I don't know why they suddenly decided to give everyone at the company a deluxe lobotomy

I saw this shit yesterday when I was trying to buy a weed cart online (still not sure if it's legal or not. I still hear stories of those moron cops arresting people for "drug possession" i.e. didn't pay a bribe)

Noped out and just gave the clearnet grey market drug website virtual card info that's gonna expire in a few hours anyway

Well that's a scam

Don't. And report them to your bank.

I've seen this in a few places

Just to be clear, the answer is absolutely NO.

Do not share this info. Never. Always a bad idea.

Seen the same thing with other third party payment systems in south africa. Run away my dude.

As a fellow saffer, and a person who works with scam victims, I'm curious as to what services asked you to do that? Feel free to pm me.
This kind of stuff got legalised in Germany: Banks said that e.g. Sofortüberweisung was instigating their customers to break their TOS and should be shut down, anti-trust then said "nuh-uh you can't just shut down legitimate business" (Sofort is indeed legitimate) and instead put third-party systems under banking regulations, and required ordinary banks to have APIs allowing third parties do do sensible things.

...which theoretically could mean that you're sent to your actual bank to authorise and thus getting rid of the normalising phishing problem, dunno, haven't checked I'm boycotting them out of principle for going down that route in the first place. Don't serve any purpose now that we have real-time transfers, anyway.

Yeah... Fuck that noise. I ain't giving my login details to anyone; not even the people who run the thing I'm logging into.

Make sure you email them your mothers maiden name and date of birth too, just to be safe it goes through

What could go wrong?

They look trustworthy, right?
- Swear on me mum, scout’s honor
- Hello sir, ozow.com is best most recognize branding. We are trust top tier bank accounts detailed are encrypted so most safe safer than banks actually!
If you’d like, I can show you. Just uh, need you to sign a waiver saying you authorize this little demonstration and accept all risks.

Also, gonna need your login credentials…

Whatever it is, it isn't worth it

They maybe use Plaid to connect your bank? I still wouldn't do it though. Fuck Plaid. Fuck handing out creds. Find another way.

The crazy part that the bank uses username+password method for authentication.

That's fairly common, 2fa w/loc is after password in a lot of cases.

They’ve been doing essentially the same thing for years. Here’s the site from 2 years ago. Not to say that this is definitely safe, but scam sites usually don’t last this long

https://web.archive.org/web/20220114215955/https://ozow.com/

Step 3: Log in and select your account to pay from. Don’t worry, we have security covered. 🤣

Yeah, scam or not, this method of getting your account and routing information is not at all secure. I'm actually more surprised that the banks allow another site to initiate the login with a plaintext password. This defies all decent security practices.
I've had the same Nigerian prince emailing me for the last 14 years.
- From the same email?

~~Well, it is a payment processor that uses bank accounts. So, that makes sense.~~

That’s what wire transfers are for.

There should be no need for you to give them your credentials. Also, be aware that if you do give a third party credentials, and you get hacked, your banks going to blame you for being stupid.

Because it is stupid.

How stupid is it? Not even the bank support staff will ask for your credentials.
- I just noticed it was login details… my brain was thinking account and routing.

That's unusual, but not unheard of. Some online merchants will allow you to make payments via ACH transfers. Can be useful for things like international purchases or if you don't have a normal credit/debit card to use. Sometimes smaller merchants will prefer this, if they don't have an existing business partnership with a payment processor already.

Usually these will go through a third-party system that tokenizes your login with your bank. This way the merchant can only access your routing/account numbers to do the transfer. As for why you'd need to provide your bank login instead of the routing/account numbers directly, it's usually just a form of fraud prevention, as the login verifies that you're actually the account owner and not trying to pay with a checkbook you found on the street.

It's similar to Plaid, which is a near-identical service that some merchants in the US use. From what I can tell, Ozow appears to be legitimate, so realistically it's probably safe to enter your login details as long as you're not getting any certificate errors on the page.

E: Not sure why this is downvoted. I'm not saying it's a good system, just saying that it's not inherently a scam.

You shouldn’t trust Plaid either.

Especially if all they’re doing is looking for the routing and account number. Because that’s just as easy to give.
- I know someone who works in software security at Plaid. I can't give too many details because there's only like 20 of them - but no, you REALLY should not trust Plaid. (Allegedly) phones intercepting 2FA in their server rooms, (allegedly) bank connection issues that have led to people getting access to the wrong accounts, (allegedly) using browser bots to handle login on the backend for banks without API access, (allegedly) customer info leaks that weren't reported.. Now that I think if it, I should tell my friend about the whistleblower programs
- It's also risky to give. Banks will generally approve all transactions between two accounts if one of them is a business account, because the assumption is that those are business transactions and are legitimate 99.99% of the time, so there's very little scrutiny involved for those transfers. Giving the merchant your routing/account number gives them access to make withdraws from your account at will and at any time and can't be revoked, and giving that access to somebody you may not fully trust the reputation of is a dangerous move.
  
  A trusted financial institution as a middleman can be useful for those situations, because they'll tokenize your details to expose as little as possible to the merchant, directly. These services are typically insured, so even if something did happen to your account, you're more likely to get your money back than if you gave a merchant direct ACH access to your bank account. It's basically a modernized version of Western Union.
- Plaid effectively admitted to stealing your transaction history and selling it to the highest bidder in the past. There was a settlement and they agreed to not to that in the future
  
  Just don't ever share your password, and certainly not your banking password, and definitely not with Plaid.
We have a variation of this system here (India)

During checkout you can select netbanking as payment method. It asks you to select your bank and after you select it and click next/pay, it redirects you that bank's login. You login, provide OTP, and it redirects back to the website you were shopping at, usually to orders page.
- Sounds like a good opportunity to redirect to a fake version of the bank's website.
  
  Honestly I think the best solution is a revokable token from your bank that you can give to a merchant. One token per merchant, make it easy to revoke as the user sees fit. If you see a charge on the token from one merchant by someone else it's immediately obvious that token and possibly that merchant was compromised
It would male way more sense for it to be a OAuth