Are you really protecting your password?

Everyone knows how important it is to keep passwords secret, especially when it involves banking information. But while you may think you are doing a good job, it’s easy to fall afoul of the agreements you signed when you opened your bank account.

For instance, do you share your banking password with your spouse? If you do, chances are you are violating your banks terms of service.

With the proliferation online banking, the development of banking apps, along with third party websites that organize budgets and track your investment information, sharing online passwords is becoming more of an issue for the financial industry.

Generally, it’s not a good idea to ever share passwords, whether that’s with a family member or a third-party website, says Brian Bowman, a Winnipeg-based business lawyer who specializes in privacy and social media issues. If you violate your terms of service, you may be on the hook for any money that goes missing. “You’re essentially bearing the risk of what happens as result of that,” he says. “If you get cleaned out, the bank will likely not reimburse you with any loss.”

Of course, sharing information within the family is one thing, sharing it with a third-party site is another—and Canadians are doing that, too. Sites like Intuit’s Mint.com will monitor your bank accounts, mortgages and loans to show you how you’re spending your money. But in order for this service to work you have to provide the site with your online banking IDs and passwords.

While Mint.com has gone to great lengths to ensure its system is secure, using it may still be a violation of your banking agreement.

The challenge for financial institutions doesn’t end there. In the near future, online passwords may need to be written into wills and powers of attorney. While Bowman has yet to see a case where that’s been done, he thinks it’s only a matter of time before it happens.

Maura Drew-Lytle, a spokesperson with the Canadian Bankers Association, notes that every institution’s user agreements are different so it’s important to check with your bank to see how the rules apply to you. Although sharing passwords with a third-party site, or a spouse, is against the rules, Drew-Lytle says sharing information when someone’s incapacitated and a power of attorney is acting on the person’s behalf may not violate of those terms, depending on what the power of agreement says.

Generally, a power of attorney—or an estate trustee—is allowed to access your bank account. But when it comes to online banking, Drew-Lytle says you want to make it as clear as possible in the will or power of attorney document that the person in charge of the estate is allowed to access bank information online using the provided passwords.

If nothing is written down, and, say, a spouse gives the power of attorney that banking information, it is possible terms of service could be violated, she says.

Bowman says the power of attorney will still need to go to the bank and make it known that he or she is now responsible for the person’s finances—just as they would normally. The bank, he says, will likely give the power of attorney a new password and ID so that there’s a record of activity pointing to that specific individual.

“Banks have checks and balances to make sure people aren’t being duped out of money,” says Bowman. “So they wouldn’t want to see sharing passwords or user information with just anyone.” He suggests visiting your bank now, before an emergency, to work out details around password sharing.

But there is another solution to get around any of these problems: a joint account. In this situation each family member would have different passwords, which can be used to access the same account. No passwords have been shared and, therefore, no terms have been violated, says Drew-Lytle. If someone becomes incapacitated, then the spouse can still pay the bills and access investments.

In time, as more people use these third-party programs and the more Canadians rely on passwords and IDs to bank, Bowman thinks banks will have to update their policies. “There is pressure on institutions to bring in a process that will allow for greater ease of managing online accounts, especially in the event where someone’s incapacitated or deceased,” he says.

Ultimately, both Bowman and Drew-Lytle say to call your bank and ask them about their polices are around sharing passwords. In Bowman’s experience, if someone violates an agreement that causes money to go missing, then the banks will hold the client responsible.

“The message is don’t share your user ID or password with anyone unless you’ve done your due diligence,” says Bowman. “Losing your savings is not an abstract proposition, so there’s no reason it should be treated like one.”