Why We Refuse to Scrape Your Bank Logins or Read Your SMS Messages

Many personal finance apps promise to track your money automatically by asking for permission to read all incoming SMS messages, or by asking you to input your netbanking username and password into a third-party scraper.

While this sounds convenient, the security and privacy compromises are immense. Bank SMS messages contain one-time passwords (OTPs), sensitive transaction details, and personal communication.

Google Play has rightfully cracked down on apps requesting broad SMS permissions, classifying them as severe privacy risks. Furthermore, screen scrapers frequently break whenever your bank updates its login interface or implements multi-factor authentication.

Research consistently shows that households that spend two seconds logging an expense manually possess far greater awareness of their spending than households relying on passive background scrapers that categorize 40% of transactions as 'Miscellaneous'.

At Kestro, we designed our interface for two-second logging, encrypted in transit with TLS 1.3 and at rest with AES-256. We will never ask for your bank credentials or SMS inbox.